mastodontech.de ist einer von vielen unabhängigen Mastodon-Servern, mit dem du dich im Fediverse beteiligen kannst.
Offen für alle (über 16) und bereitgestellt von Markus'Blog

Serverstatistik:

1,5 Tsd.
aktive Profile

#domainname

0 Beiträge0 Beteiligte0 Beiträge heute

Why Use a Country-Level Domain Extension?

Using overseas hosting (outside the United States) is a smart move and something we encourage — it can provide greater privacy, legal protection, and sovereignty over your data.

However, hosting alone is not enough.

Even if you host your website (for example, on a .com) in a country like Germany, while your files and database may be safe, your domain name itself can still be subject to U.S. law. Many domain extensions — including .com, .net, .org, .info, .us, and .edu — are governed by U.S. jurisdiction.

Additionally, many word-based domain extensions — such as .social — are managed by private corporations based in the United States, which can still put your domain name at risk of legal or commercial interference. Corporations can also be easily bought or influenced, unlike sovereign nations. Historically, sovereign nations tend to seek to hold onto their sovereignty — even when they are financially broke or fundamentally broken.

Domain takedowns are rare, but the possibility exists — especially in today's unstable political climate. For example, even close allies like Canada have experienced tension with the U.S., and Donald Trump even tried to instruct Microsoft to discontinue services to Denmark, raising the question: What is "normal" anymore?

i'm not trying to sell a #domainName but occasionally people inquire about HEALLYEAH DOT COM and i have a boilerplate response that basically says:

- this domain has been on the web and home to about 18 people for about 30 years and it's also a Google Workspace tenant
- every user will need compensation for the cascading shitshow of losing an identity provider

there's some interesting Internet history that happened there but it was a long time ago, regardless it's worth over 3M USD to us.

" What country level domain name extensions are available for everyone?! "
The following, should be available to anyone to register. However, some (see list) will require a "domain agent" if you do not live or own a business in these countries. Many domain registers are happy to be your "domain agent", but you should check first with the register.

.ai – Anguilla

.am – Armenia

.co – Colombia

.fm – Micronesia

.io – British Indian Ocean Territory

.me – Montenegro

.tv – Tuvalu

.cc – Cocos (Keeling) Islands

.ws – Samoa

.in – India

.to – Tonga

.bz – Belize

.uk – United Kingdom (will need a domain agent)

.de – Germany (will need a domain agent)

.nl – Netherlands

.eu – European Union (will need a domain agent)

.ca – Canada (will need a domain agent)

#Domain #DomainName #Fediverse #ActivityPub #UsJurisdiction

This is how you run a Fedi website outside Us Jurisdiction.

mk.absturztau.be = Domain (.be) name is Belgium, while hosted in Switzerland, and the hosting provider is governed under the laws of Switzerland.

mastodon.au = Domain (.au) name is Australia, while hosted in Australia, and the hosting provider is governed under the laws of Australia.

Remember, Dot Com, Net, Org, Info, Us, and Edu is governed by the United States of America. Most word-based domain names, for example, Dot Social, managed by Corporations within the USA.

#Fediverse #ActivityPub #Mastodon #Misskey #DomainName #Domain #WebHosting

Fortgeführter Thread

If more people had some good sense, they would use country extension domain names.

But everyone wants that cool domain, for example, random dot social, as opposed to random dot ch.

Corporate America, governed under Us Law, is going to have a lot more oversight on the Internet, and many of you are not paying attention.

#Internet #WorldWideWeb #Oversight #DomainName #Domain #DomainRegistration #Register #Website

Antwortete im Thread

@sophieschmieg @neilmadden

IMO we need to stop coming up with algorithms to securely store "derivatives" of typically weak passwords, as

IT WILL FAIL.

From akkadia.org/drepper/SHA-crypt.:

In addition, the produced output for [...] MD5 has a short length which makes it possible to construct rainbow tables.

Please correct me if I'm wrong, but even in 2025 suggesting that a rainbow table is feasible for (lets cut a few bits for MD5 weaknesses) random numbers of 120 bits in length is BS (in order to create FUD).

If I'm right about that, the least bad thing to do is:

1) Everyone should use a password manager (pwmgr) because people simply do not have the ability to come up with a sufficiently strong password that is *unique for each account*, let alone for multiple accounts (sometimes hundreds), to remember them absolutely error-free, and to recall which password was chosen for which account.

Note: IMO password *reuse* currently is the biggest threat. Entering a reused password on a fake (phishing) website may have devastating consequences, because (when a password is reused for multiple accounts) chances are that ALL those accounts are compromised. Note that the complexity and uniqueness of the password are IRELLEVANT. And, what KDF is used on the server, is IRRELEVANT as well.

2) Let the pwngr generate a (cryptographically) random password, as long and with as much entropy as allowed by the server.

3) Use a strong master password and NEVER forget it (typical beginner failure).

4) Make sure the database is backed up in more than one place, and make a backup after each modification.

5) Make sure that the device the password mamager is used on, *never* gets compromised.

6) Double check that https:// is used. Better, make sure to use a browser that blocks http:// connections and warns you (Safari on iOS/iPadOS now supports "Not Secure Connection Warning"). In all browsers such a setting is OFF by default: ENABLE IT!

7) On a mobile device: use "Autofill". The OS then transfers the domain name (shown in the browser's address bar) to the pwmgr. If a matching domain name is *not found* in the pw database, assume that you're on a (fake) phishing website! In that case: DO NOT ATTEMPT TO LOG IN by looking up credentials yourself. Reasons for 7, two examples:
----
fake: circle-ci·com
real: circleci.com
----
fake: lîdl.be
real: lidl.be
----

If people would follow this advice (which is not just mine), even MD5 for storing a one-way derivative of the password on the server would be fine.

HOWEVER: don't use MD5 - because "never use MD5 for whatever" is easier to remember than "don't use MD5 if preimage attacks are possible".

P.S. I'm not a cryptographer (although I'm quite interested in the matter).

Antwortete im Thread

@lil5 : passwords *do* prevent phishing on Android and iOS/iPadOS if you set up autofill for your password manager and know what to be aware of.

Details: infosec.exchange/@ErikvanStrat

With Android screenshot: infosec.exchange/@ErikvanStrat

BTW passkeys suck: infosec.exchange/@ErikvanStrat

@robin

Infosec ExchangeErik van Straten (@ErikvanStraten@infosec.exchange)W.r.t. password managers (pw mgrs): 1) Make sure that you *NEVER* forget your master password. 2) Make an *OFFLINE* backup of the (encrypted) pw database after each modification. For example, rotate between multiple USB storage media. 3) Use a pw mgr that can generate strong (random, long, unguessable) passwords. Use that functionality to generate a unique pw for each account. LAST BUT NOT LEAST 4) At least on mobile devices, configure the OS and pw mgr to locate your credentials *automatically* based on the domain name of the website you're visiting (using "autofill", which lets the OS pass the domain name –as used by the browser– to the pw mgr). EXAMPLE WHY If you receive an email (with SPF, DKIM and DMARC all fine) from:     whomever@circle-ci.com that instructs you to revalidate your 2FA settings in, e.g.:     https:⧸⧸circle-ci.com/revalidate Then a properly configured pw mgr will not come up with ANYTHING - because the record is for (without the dash):     https:⧸⧸circleci.com The deja vu after the 2022 attack (https://github.blog/news-insights/company-news/security-alert-new-phishing-campaign-targets-github-users/), described in https://discuss.circleci.com/t/circleci-security-alert-warning-fraudulent-website-impersonating-circleci/50899, is still alive and kicking since March this year (see https://crt.sh/?q=circle-ci.com and https://www.virustotal.com/gui/domain/circle-ci.com/detection). The fake site even looks better than the original one (I don't know whether it is actually malicious, or will just warn users who attempt to log in). NOTE: if your pw mgr does not find a matching record in the pw mgr database, do NOT manually locate the "circleci.com" record. If you do: do NOT autofill or copy/paste your credentials for https:⧸⧸circleci.com to https:⧸⧸circle-ci.com! Using those creds, the fake site may immediately log in to the authentic website AS YOU - pwning your account. WHAT I'M USING I'm using KeePassium on iOS and KeePassDX on Android; they work just fine (disclaimer: I'm not in any way related to their authors, and do no warrant their reliability). @steelefortress #Passwords #PasswordManagers #PasswordManager #KeePassium #iOS #iPadOS #KeePassDX #Android #Autofill #DomainName #DomainNames #DomainNameCheck
Antwortete im Thread

W.r.t. password managers (pw mgrs):

1) Make sure that you *NEVER* forget your master password.

2) Make an *OFFLINE* backup of the (encrypted) pw database after each modification. For example, rotate between multiple USB storage media.

3) Use a pw mgr that can generate strong (random, long, unguessable) passwords. Use that functionality to generate a unique pw for each account.

LAST BUT NOT LEAST
4) At least on mobile devices, configure the OS and pw mgr to locate your credentials *automatically* based on the domain name of the website you're visiting (using "autofill", which lets the OS pass the domain name –as used by the browser– to the pw mgr).

EXAMPLE WHY
If you receive an email (with SPF, DKIM and DMARC all fine) from:

    whomever@circle-ci.com

that instructs you to revalidate your 2FA settings in, e.g.:

    https:⧸⧸circle-ci.com/revalidate

Then a properly configured pw mgr will not come up with ANYTHING - because the record is for (without the dash):

    https:⧸⧸circleci.com

The deja vu after the 2022 attack (github.blog/news-insights/comp), described in discuss.circleci.com/t/circlec, is still alive and kicking since March this year (see crt.sh/?q=circle-ci.com and virustotal.com/gui/domain/circ). The fake site even looks better than the original one (I don't know whether it is actually malicious, or will just warn users who attempt to log in).

NOTE: if your pw mgr does not find a matching record in the pw mgr database, do NOT manually locate the "circleci.com" record. If you do: do NOT autofill or copy/paste your credentials for https:⧸⧸circleci.com to https:⧸⧸circle-ci.com! Using those creds, the fake site may immediately log in to the authentic website AS YOU - pwning your account.

WHAT I'M USING
I'm using KeePassium on iOS and KeePassDX on Android; they work just fine (disclaimer: I'm not in any way related to their authors, and do no warrant their reliability).

@steelefortress

The GitHub Blog · Security alert: new phishing campaign targets GitHub usersOn September 16, GitHub Security learned that threat actors were targeting GitHub users with a phishing campaign by impersonating CircleCI to harvest user credentials and two-factor codes. While GitHub itself was not affected, the campaign has impacted many victim organizations.