Hacker News Reader

Comment by knorker | Hacker News Reader

> But a compromise of Google's users.

Did it? If you get a link to google.gh, did you at any point assume that's the real Google?

If I received a link to google.co.uk I would, because I'm in the UK. Why would I think otherwise if I were in Ghana and saw a link to google.gh?

Browsers happily killed EV certificates. With EV such a hack would take quite a bit more effort.

But in this case google.gh would have to be "HSTS'd", but preloaded in the browser to only accept EV certs?

Otherwise the attacker could just mint a non-EV cert, right?

EV certs went away because no user checked if the URL bar had the extra flair.

I have a machine in the UK. If I use it to go to google.co.uk, it redirects to google.com.

Hell:

    $ curl www.google.es
    <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
    <TITLE>301 Moved</TITLE></HEAD><BODY>
    <H1>301 Moved</H1>
    The document has moved
    <A HREF="http://www.google.com/">here</A>.
    </BODY></HTML>

Reply on news.ycombinator.com