jakejarvis

Just wanted to say thanks for this! Very helpful for me at the moment. :)

Yikes...

Referenced WSJ article here: https://www.wsj.com/articles/boeing-and-regulators-delay-jet...

(Outline link because paywall: https://outline.com/MpaknT)

Direct link to the study (without autoplaying video!): https://www.ndss-symposium.org/wp-content/uploads/2019/02/us...

Congrats guys, great execution! Surely this can and should be applied to all sorts of other school clubs/events down the road, I know it would have been incredibly helpful for the clubs I was in back then. But I’m always a fan of starting small and niche. :)

The video of the bolded part is even more unbelievable: https://www.youtube.com/watch?v=cRNypdYQoWk&t=69

Glad you guys included this part:

> "Although signing the declaration makes it impossible for a third party to produce arbitrary declarations, it does not prevent them from using force to coerce rsync.net to produce false declarations."

That's always been a question in the back of my mind when seeing all these canaries. Anyone know if ordering a company to do this is feasible under US law, either by force or by authorities taking over private keys and doing it themselves? Canaries appear to be pretty much untested in court.

I assume by "third party" they mean an outside request from someone who doesn't own the service they're hosting. MIT is unambiguously the first-party owner of MIT.edu, even though a third party used Cloudflare to hijack it.

Ooh, good idea. Would probably only have to write ~1 time per day to a separate, parallel list. Or have a small VPS do the work continuously and push changes to a Git repo so others can pull it however often they want.

I’d love to take a look if you end up doing that!

Agreed. Requiring accredited registrars support/enforce 2FA (and preferably hardware OTPs) would be a much more effective response to this, in my opinion.

Wouldn't that loophole work on all DNS-based blockers/black-holes on any platform, namely Pi-hole (and the hosts file for that matter)?

Disconnect Pro for iOS is also a great tool. Hasn't failed me yet and makes adding custom trackers super easy via the list of recent connections. I blocked 30.8k trackers and saved 3 GB of data last month. :)

For those who haven’t heard about it, the nissan.com fiasco was a crazy yet fascinating story: https://en.m.wikipedia.org/wiki/Nissan_Motors_vs._Nissan_Com...

This was solved decades ago[0] with the Reply-To header. Send emails from no-reply@paypal.com and set the Reply-To to support@paypal.com.

Emails then bounce to no-reply@ and any legitimate email client will auto-populate support@ as the To address when the user clicks reply.

[0] https://www.ietf.org/rfc/rfc2076.txt

MarkMonitor specifically is pretty picky about only taking on large-scale corporations (google.com, amazon.com, microsoft.com to name a few) so just the fact that it's registered there is usually a reliable way to confirm legitimacy, but checking whois is still way more research than an average PayPal user should need to do to avoid being phished.

I'm certainly no legal expert, but wouldn't the whole "fruit of the poisonous tree" argument apply to any evidence found after and/or as a result of the MAC address connection?

Just ran across this when browsing HackerOne for fun last night. Bravo, great job!

oof is this susceptible to a takeover? Looks like it's pointing to a deleted Netlify site...

Yup, I always, always, always simply check for domain availability via pinging the TLD’s registry directly using the whois command in my terminal. I’ve been burned like this before by checking on another registrar (I forget which so don’t want to make accusations) and not getting past the checkout process like OP. And with the whois command you don’t need to worry whether the registrar you’re using to search sells the TLD you’re looking for or not, which is a nice plus.

There’s absolutely no reason to ask a third party domain registrar whether a domain already exists. People need to spread the word more!

Yes, I’d third getting started with Digital Ocean or Linode, but even AWS Lightsail isn’t a terrible option if you want to be able to say you’re dipping your feet into the turbulent Amazon waters.

Except when someone's paying them cold hard cash for something like G Suite, you'd think that should be enough of a business model for them...but I think you're right to remain skeptical of that. :\

If running our own gateway server on a cloud provider of our choosing will really be an option, that might sell this for me. Would that remove the yearly $99 requirement? I understand we wouldn’t get support for a lot of the things you handle transparently behind the scenes blacklist/DNS-wise.

Absolutely, I can respect that! Didn't mean to take it out of that context.

> "Our support team asks for reviews only if they sense that the customer is having a positive experience. We also utilize canned responses/snippets to increase efficiency here."

Hmmmmm .... Not sure how I feel about that. But I'm sure that's what everybody does so I appreciate their honesty I suppose?