Security researcher registers a .Gov web site with no difficulty

[thewayne]

He(?) used a Google Voice account and apparently sailed through the process. Krebs goes on to report that 5 of the 10 largest cities in the USA do not have their names registered as .Govs! Including places like Houston and Miami, not to mention uncountable smaller government cities and municipalities.

Krebs puts forth a simply lovely scenario. Someone phantom registers Miami.gov, and on election day email blasts the city with a 'news report' that there have been multiple bombings at polling places. What does that do to election turnout?

Apparently the Department of Homeland Security is angling to take over the registration of .Govs, which I think is probably a reasonable angle. It makes sense to me for the federal government to handle the registration of government internet domains.

https://krebsonsecurity.com/2019/11/its-way-too-easy-to-get-a-gov-domain-name/

Comments

[dewline]

Why are they not "*.gov.us" domains instead of "*.gov"? Internet tradition?

[thewayne]

At a guess, because "We invented the internet!  So everyone gets to assume that without a country extension, it's USA! USA!" We didn't develop the World Wide Web, which is a point that I stress as most people think the two are one in the same. But really, no idea.  I'm not sure who designed the hierarchy of domain names and the registration system thereof.

[dewline]

So it's definitely "tradition", then.

[thewayne]

So much of the internet's design would be different if it were done now.  The original designers were basing it on their own behaviors, and they were honest and trusting.  They didn't foresee the ridiculous venality of 40some years in the future.  Some of the internet's design has held up, some hasn't.  And some of the "fixes" being discussed are pretty awful.

[rain_gryphon]

ICANN currently has the authority over the TLDs, and delegates control of each TLD to various authorities as per various agreements. Authority of the subdomains in the TLD generally belongs to the registered owner, at least in the normal world. .nk's practices probably don't conform. (I was gonna bust on Iran too, but they seem to follow normal practice. One suspects they need the foreign currency.)

I *think* DARPA was the original TLD authority and the designers of the system. IMHO it has grown and scaled most wonderfully, something of a miracle considering how far it's exceeded the scale for which it was intended. IIRC, it was originally just meant to support mail routing between a few dozen IT labs. It turned out to be kinda robust.

There's already a .us TLD, and technically it wouldn't be hard to group .com, .gov, and .edu under that. It be a huge administrative mess, though, not to mention the confusion it would cause end-users, and doesn't really produce any benefit apart from tidiness,

[rain_gryphon]

You could pretty well see this sort of thing coming when they decided to remove ICANN from US government control.

[thewayne]

Along with the price jump for .org domains.  Maximize profit!

[silveradept]

So much...fun, that you have to remember to trust basically nothing on the Internet, unless you know full well that it's trustworthy yourself.