Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

F-Secure Calls for '.safe' TLD

Posted by CmdrTaco on Tue Apr 10, 2007 08:17 AM
from the internet-laughs-at-f-secure dept.
Security IT
Rajesh writes "According to F-Secure, ICANN (Internet Corporation for Assigned Names and Numbers), the organization responsible for the global coordination of the Internet's system of unique identifiers, should introduce a .safe domain name to be used by registered banks and other financial organizations."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

F-Secure Calls for '.safe' TLD 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Maybe its just me.. (Score:3, Insightful)

    by mulvane (692631) on Tuesday April 10 2007, @08:20AM (#18674141)
    But wouldn't something a little more, well, financially sound be better. .safe just makes me think of child protection sites, law enforcement security boards and such. I know .fin is taken, but how about someone put a little more thought into this one. I agree we possibly COULD use a .safe, but for other purposes.

    • Re:Maybe its just me.. (Score:4, Interesting)

      by kisrael (134664) on Tuesday April 10 2007, @08:22AM (#18674171) Homepage
      The choice of ".safe" also sounds like blatant propaganda...

    • Re: (Score:2, Insightful)

      by BDPrime (1012761)
      The article suggests .bank as well. That could be OK, but what about financial firms that might not consider themselves banks?

      • Re:Maybe its just me.. (Score:4, Insightful)

        by eln (21727) on Tuesday April 10 2007, @09:03AM (#18674801) Homepage
        Or financial sites that studiously avoid calling themselves a bank, even though they clearly are one, in order to avoid being regulated like a bank. Such as Paypal.

        Also, .safe is just asking for trouble. It gives people an even greater false sense of security than they already have about "secure" websites. Might as well just call it .lawsuit-magnet.
        • Why is it that everyone seems to think a company that transfers money and holds money in accounts is a bank? Your utility companies do that, credit cards are issued by non-banks all day, et cetera. You might as well argue that Final Fantasy Online is a bank - you can purchase in-game currency, give it to someone else, then have it converted back to real currency. Do rechargeable, releaseable gift cards make every store in the mall a bank? Is my cellular phone company a bank? My cell phone can make payments for me, even.

          Bank regulations aren't about little-guy money transfers, and wouldn't help in virtually any of the "omg paypal skrooed me" situations (which, I might note, I've never actually seen be anything other than the fault of one of the two end-users. Yes, PayPal freezes accounts too easily, but frankly, if you can't tolerate a several-day money lag, you shouldn't be transacting online at all.) Bank regulations are about the investment of held capital and so forth, to prevent messes like the 1914 commodity crash or the 1980s savings and loan scandal. Say what you will about PayPal, but their back-end investments are safe, conservative and shrewd. No bank regulations would affect PayPal in any way that the end users would find significant, other than to increase existing rates (not by enough to affect most transactions, but it would kill the micropayment system dead.)

          The next time you go complaining about regulations, maybe you should name the specific regulation you want. That way, when people read what you say, they won't do what I did, and assume you're some clueless whiner who just wants to repeat what everyone else says to sound smart, when bitching about an online business that they heard screwed a friend of a friend of a friend.

          Of course, that'd require knowing what you were talking about.

    • Re:Maybe its just me.. (Score:5, Interesting)

      by goombah99 (560566) on Tuesday April 10 2007, @08:24AM (#18674201)
      how about .careful ? To remind people not to assume something is safe from it's name. Otherwise please click on my NotAVirus.exe.

      Who will accredit third world banks such as the FIRST BANK OF JOSEPH ENTBE OF NIGERIA?

    • I'm actually mystified as to why UK banks don't use the .plc.uk domain, which is reserved for publicly listed companies.

      • Don't feel bad. I'm miffed that the government uses .com's (and .nets, etc) instead of .gov. I also think they shoulda given a .gov domain for the yearly free credit report stuff. As much as I trust myself, before entering all that juicy info, I actually found links to the .com from the .gov websites, etc. first...

  • .safe (Score:3, Funny)

    by voice_of_all_reason (926702) on Tuesday April 10 2007, @08:21AM (#18674157)
    Brought to you by King Canute. Make things happen by simply commanding them to be so!

    (yes, I'm well aware that interpretation of the story is incorrect).

  • As a matter of principle... (Score:5, Insightful)

    by rlthomps-1 (545290) on Tuesday April 10 2007, @08:22AM (#18674169) Homepage
    I just don't trust anything that comes out and says "trust me, I'm safe." This isn't a good idea, it teaches people to let their guard down as opposed to being aware of the risks of blanketly trusting a website. What if someone gets some exploit code on one of these sites? I think it'll just take a few notable hacked up website before the whole trust of .safe is lost.

    • Re: (Score:3, Insightful)

      by epiphani (254981)
      What if someone gets some exploit code on one of these sites?

      Why, F-secure can offer a service to make sure this doesn't happen! In fact, why not just say F-secure is responsible for validating sites in this TLD. That would be great.

      The idea isn't really flawed, but the source is questionable. Its like a company that makes carbon filtering equipment says that all power plants should meet X carbon emissions. Great idea, not news, and blatantly self-serving.
    • http://mydomain.com/ [mydomain.com]

      I can see this working already ;)

      The tools are already in existence to secure communications, and they are already in use. The flaw in the system is not the domain names or secure connections but the users who are deceived into accessing other sites and to give up personal details. .safe will not end deceptive practices, especially when success = money.

      Education is the way to secure users, that and banks and other entities that really require security to actually employing some decent se
      • My original link was:
        http : // www . barclaysbank . safe @ mydomain . com /

        It's nice to see that slashdot takes care of that anyway.

    • Re: (Score:3, Informative)

      by Bogtha (906264)

      What if someone gets some exploit code on one of these sites?

      This has already happened: Hacked Chinese Bank Server Phishes for US Banks [slashdot.org].

  • Not going to help (Score:3, Insightful)

    by CastrTroy (595695) on Tuesday April 10 2007, @08:22AM (#18674175) Homepage
    As long as people continue to click on links they get in emails, a not verify that they are actually at their bank's website, then there's going to be problems with phishing. It doesn't matter if the url ends in .com, or .ca, or .safe, or .xxx. If you're clicking on links in emails and getting scammed, then changing the domain name won't help anything. I'm surprised there's not more worms out there that change your hosts file, to show you a phishing site when you type in the actual url of your bank. I guess it really is that easy to get somebody to click on a link in an email, because they haven't resorted to more complicated methods.

  • Because you know (Score:5, Insightful)

    by dctoastman (995251) on Tuesday April 10 2007, @08:23AM (#18674181) Homepage
    People are infallible and immune from social engineering attacks and there is no way a shady organization would ever get a .safe domain.

  • Countdown... (Score:5, Insightful)

    by Yoozer (1055188) on Tuesday April 10 2007, @08:23AM (#18674187) Homepage
    Count down to the first case where a .safe domain is corrupted because of nepotism, fraud, forgery, what-have-you.

    A TLD does not solve this problem. An alert user does, aided by tools like regular check-ups, challenge-response systems or cryptography.

    We've all heard how some corporations lose several thousands of records of personal data. What does that .safe TLD mean, in that case?
    • I would like to know my more banks don't offer more secure methods of authentication like RSA keytags and such. This would completely wipe out most of the problems with phishing. Instead they think up other useless methods like making you click on an onscreen keypad to enter your password, or asking you what your favourite movie is. I think that many people would pay for the keytag themselves if they were presented with the option, just for having the peace of mind knowing they are more secure. I know

  • Great but... (Score:5, Insightful)

    by otacon (445694) on Tuesday April 10 2007, @08:25AM (#18674213) Homepage
    People are still pretty dumb and easily tricked, the kind of people that get duped into putting their info in a phishing site are the same people that could be tricked by a fake URL...i.e. safe.financialsite.com or yourbank.com/safe or any other obvious ways to add safe into a URL.

    • Re: (Score:3, Insightful)

      by l0b0 (803611)
      A lot of people seem to be completely oblivious to URLs. You could use insecure.stayaway.ng/porn without raising suspicion from *pulls out a number* 83% of the population.
  • People respond to phishes and Nigerian scams and give all their usernames and passwords voluntarily without ever touching their banks or the safe domains. How can banks protect against such users? Why should it be the bank's responsibility to tell the customers, "It is not a good idea to paint your user name and password on the side of your home in 26inch high letters".

  • Will this really make a difference? (Score:4, Insightful)

    by FredDC (1048502) on Tuesday April 10 2007, @08:26AM (#18674243)
    I don't think so...
     
    There will always be idiots, who will fill in their credit card information at visa.safe.ru!

  • Is it useful? (Score:4, Insightful)

    by efence (927813) on Tuesday April 10 2007, @08:29AM (#18674275)
    There is a much greater need to tell when a site is NOT safe. There is a reason that URLs with IP addresses and domain names such as "www.paypal.secure.dodgydomain.info/..." are still effective. Introduction of a new TLD is not a replacement for user education.
  • If a .safe TLD was introduced then too many people would automatically have the assumption that their PC would never be infected from visiting a .safe site nor would it's details on them ever be compromised. I don't believe anyone can say with 100% certainty that all .safe domains would be hacker proof, in fact I think hackers would be much more attracted to trying to break into .safe sites in the knowledge that people wouldn't automatically be vigilant when visiting those sites.

    • Re: (Score:3, Insightful)

      by geekoid (135745)
      True, but it would decrease risk, which what security implementation is really about.

      They would need to implement some tough rules for who can register them for it to have a chance of working. Smething I don't think they have the backbone to do.

      All this assumes people actually look at where a link goes before clicking it.

  • I have a better idea! (Score:3, Funny)

    by 140Mandak262Jamuna (970587) on Tuesday April 10 2007, @08:30AM (#18674293) Journal
    Let us create a separate domain for phish hosts! All phishing sites must clearly identify them as phishing sites to get a chance to be listed in that domain. Of course, compliance is voluntary. It makes as much sense as the safe domain for the banks.

  • Not a new idea. (Score:3, Interesting)

    by bigmaddog (184845) on Tuesday April 10 2007, @08:30AM (#18674297)
    This sounds a whole lot like RFC #3514 [rfc.net] to me, except on a higher level, which makes the idea at least four years old.
  • Domain names are to easy to fake. That's all. Perhaps a better name system?
  • But surely, to the inexperienced, anything can look "safe" e.g. www.urbank.safe [bizarremag.com]. As others have already suggested above, it's better to educate than attempt structural changes to protect the naive.

  • Nice idea but... (Score:3, Informative)

    by JohnnyBigodes (609498) <morphine@diMENCK ... net minus author> on Tuesday April 10 2007, @08:36AM (#18674379)
    ... I don't think it will work, at least not how they think.

    Many worms change your HOSTS file and there's also the good ol' DNS poisoning, so this ".safe" thing can't be 100% trusted. And if it can't be 100% trusted, we might as well stick to what we (don't) have.

  • Oh God, Not Again! (Score:3, Insightful)

    by user24 (854467) on Tuesday April 10 2007, @08:42AM (#18674479) Homepage
    Are we really going to have to go through every argument why .xxx was a bad idea, replacing "porn" with "safe" and "perverts" with "hackers"

    quick, someone who knows regex copy the most highly modded comments from here [slashdot.org], here [slashdot.org], here [slashdot.org], here [slashdot.org] and here [slashdot.org], and save us [xkcd.com]!

  • This is a great idea, I'm sure it'll work (Score:4, Insightful)

    by mrwiggly (34597) on Tuesday April 10 2007, @08:42AM (#18674485)
    <a href="http://phishers.com">click to login to http://mybank.safe/ [mybank.safe] </a>

  • .safe will be even more unsafe (Score:3, Insightful)

    by IGnatius T Foobar (4328) on Tuesday April 10 2007, @08:47AM (#18674561) Homepage Journal
    The usual phishing tricks will work, and they'll work even better. Phisher creates a link to a phishing site, and the text of the link will point to a ".safe" domain. Naive user is as naive as ever, and thinks "Well, I know that '.safe' means that it's a genuine site, so it's safe to click on it" and cheerfully submits his/her private identity to the phishers.

    Dumb idea, game over. Next...

  • On the face of it... (Score:4, Insightful)

    by Ngarrang (1023425) on Tuesday April 10 2007, @08:53AM (#18674651) Journal
    On the face of it, the idea is not completely awful. As usage of the internet grows, the organization of the domain names will grow in complexity and scope.

    We have .gov for the US government sites. This makes sense. All government-owned web sites are then managed in one place. We have .edu for education institutions.

    Financial institutions are a major power in our society, like government, so maybe they should have a specific domain. This would make looking for a financial place predictable. "I need to find my bank's web site. Ah, I will try bankname.bank" knowing that you will at least get a real bank, and not a phishing scam built on a typo in a name. .shop for on-line shops that actually sell through their web site. eg. Amazon, TigerDirect

    There are other major market segments which could justify a TLD like libraries (.lib?) and medical (.med?).

    We should not let a fear of abusers stop us from trying to organize things in a predictably way. With more TLD options, we could possibly avoid domain names having to be ever longer because their name was already taken.
    • For the most part, I agree with this. It's funny how DNS is starting to look like the original LDAP recommendations on the name hierarchy. LDAP went from an organization based hierarchy to schemas that started looking at lot like the DNS TLDs. And DNS itself may start looking at lot like how LDAP was. As more companies are becoming international, the idea of arbitrary geographical boundaries to information and yes, commerce, seems somewhat quaint.

  • the answer (Score:4, Insightful)

    by CrazyBrett (233858) on Tuesday April 10 2007, @09:12AM (#18674975)
    A: Create a new TLD!
    Q: (what was the question again?)

  • what ever happened to the internet death penalty? (Score:3, Interesting)

    by Almost-Retired (637760) on Tuesday April 10 2007, @02:36PM (#18680491)
    I see by the article that several chinese ISP's were asked to take down phishing sites, but refused.

    To me that's the time to apply the internt death penalty, where the root dns servers refuse to give out the addresses of the offending domains.

    We did it to korea a couple of times, with temporarily mixed results, but IMO the takedown (I think it was only 3 days) wasn't of sufficient duration to really get their attention.

    --
    Cheers, Gene
    "There are four boxes to be used in defense of liberty:
      soap, ballot, jury, and ammo. Please use in that order."
    -Ed Howdershelt (Author)
    Message from Our Sponsor on ttyTV at 13:58 ...

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.