Hacker News new | ask | show | jobs
by lockhouse 1035 days ago
Honestly why is that a problem? If a TLD gets confused for a file extension your browser has a serious bug.

We've had .com, .info, .ai, .app, .sh, .st, .pl, .so, and many other TLDs that are the same as existing file extensions for years now and it's never been a problem.
1 comments
afavour 1035 days ago
> Can you quickly tell which of the URLs below is legitimate and which one is a malicious phish that drops evil.exe?

> github.com∕kubernetes∕kubernetes∕archive/refs/tags/@v1271.zip

> github.com∕kubernetes/kubernetes∕archive/refs/tags/v1.27.1.zip

https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld...

link
lockhouse 1034 days ago
The vulnerability still lies within the browser in this scenario. It should actually be somewhat trivial for all the major browsers to prevent this sort of attack.

This is obsolete functionality, I can't remember the last time I needed to authenticate to a website using the username@domainname.tld functionality. It should be something hidden behind a config: setting to turn on if you run into a legacy website still requiring it and know exactly what you're doing.

link
afavour 1033 days ago
..so?

The point is that no-one was asking for a .zip TLD. It's common sense to not make one. "We should break backwards compatibility on the web so that Google can sell a TLD" is not a defensive viewpoint.

link
lockhouse 1033 days ago
That vulnerability exists even without .zip domain names, it just makes it a little easier to pull off.
link