Hacker News Reader

Comment by NoZebra120vClip | Hacker News Reader

So GoDaddy is the registrar responsible for the ccTLD, but who is responsible for the 50+ second-level domains? Are those all under GoDaddy's control too?

I mean, I assume that most people registering a .US domain are not registering it at the top level. Do individual states have no control over how their second-level domains are administered and delegated? Furthermore, there are so many sub-sub-domains under all that. Any one of those could be vulnerable to someone entering unauthorized DNS information and getting a host within the domain without any need to register anything at all.

View on HN

> I mean, I assume that most people registering a .US domain are not registering it at the top level.

No, 99% of the people are registering at the top-level. It's not like .uk where there is second-level domains that each domain falls under.

Well except for k12.xx.us, which used to be standard in every state. Some of these domains are still alive, so there are definitely third- and fourth-level domains available for hijacking and malicious injections.

They might exist, but it is a far cry from “most people registering a .US domain are not registering it at the top level,” which is mistaken.

These namespaces are controlled differently. You can't just go to godaddy.com and register "phishingdomain.k12.ny.us"

Yes, that's exactly what I mean. The subdomains are administered by the autonomous IT departments and administrators who run their delegated, authoritative name servers.

Therefore, they are rather more vulnerable than a centralized registry that has the resources to scrutinize every application for veracity.

The article is about how GoDaddy doesn't even bother scrutinizing second level registrations. Nobody is bothering to hack local governments to set up phishing domains. It's a lot easier to navigate to godaddy.com with 5 dollars and a fake address to grab a second-level domain.

tomayto, tomahto

In 2002 the .us TLD started allowing others to register second-level domains as they wish, and those types of registrations became the majority that same year. Locality namespacing in .us is mostly a historical thing now. Some still exist, and their management is delegated to other managers other than GoDaddy.

States usually control a top level domain under .gov (e.g there is labor.ca.gov for California’s department of labor).

.us on the other hand is freely available for anyone to use (and in my experience is usually quite cheap)

States being part of .gov is relatively new. There was a very long period where .gov was exclusively for the federal government. The state governments were under the domain (abbreviation of state).us, and everything was a subdomain of that.

New York City, a municipal government, used to have its website at www.ci.nyc.ny.us, now it’s at nyc.gov. But NYC still has a bunch of active websites hosted at *.nyc.ny.us.

NYC also has a TLD of their own. e.g: https://www.archives.nyc/

That's privately controlled, not like .gov. But yes.

yeah I still remember my grade school website's domain ended in ".k12.<state abbrev>.us"

Seems ripe for abuse if such registrations aren't being securely controlled

But you don't get it. No registration is necessary. All an attacker needs is access to the authoritative DNS servers. They can get a delegation or insert their own resource records. Why go through a registry and give up a credit card and personal details?

I think they're referring to <state>.us registrations

I think at this point it’s been allowed for over 20 years but I’m sure there is a mixture still.

I was mostly trying to point out that registering under .us is pretty trivial. There is no need to try and sneak something into some states’s dns records, anyone can just go on any registrar and purchase something directly under .us

I did get my firstname.us yesterday (for legitimate purposes, maybe a blog post sometime in next decade). One can absolutely register.us at top level. Many institutions like school, counties, departments get countyname.us & then provide sub domains to others. Many in California has switched over to .gov by using .ca.gov at least at state government level.

Reply on news.ycombinator.com