News for hackers. Stuff that matters.

A comment on What is 1e100.net?. Parent comment

Re:What is 1e100.net? by greenhouse_gas on Friday June 01, 2018 @09:51PM (#17212168)
>If they'd named it sfo07s13-in-f14.google.com, then browsing to that URL sends google cookies. If it's some server from a recent acquisition that may not be up to Google's level of security, that's dangerous.

Sorry, I'm slightly confused.

I browse newproduct.google.com. My browser calls the DNS, asking for the IP. The IP comes back as 192.168.0.1 [1]. It connects to 192.168.0.1. Gets hit by an XSS, and sends your cookie value to evildoer.example.com.

How would it help you that the reverse-IP of 192.168.0.1 issfo07s13-in-f14.1e100.net? The browser doesn't know that. It thinks its going to newproduct.google.com.

[1]. Yup, that number is just an example.

[ Parent | on HN ]
Re:What is 1e100.net? by sowbug on Saturday June 02, 2018 @11:00AM (#17214850)
Your example is not the same as the one in the comment you replied to. You picked a product hostname. The example was an infrastructure hostname.

The point is that Google (or any company with the same mindset) scopes down the number of machines that can receive your google.com cookie. Even their own machines often don't need it to do their job, so it's not worth the security risk to have your cookie sent more than necessary.

[ Parent | on HN ]