Re: [DNSOP] Public Suffix List

[Jeroen Massar <[e-mail]>]

Gervase Markham wrote:
[..]
> Cookies are set for a particular domain or domain suffix, and are sent
> to all sites with that domain suffix. So (under the current code)
> www.mybank.co.uk can set cookies for either www.mybank.co.uk (shared
> with foo.www.mybank.co.uk but not loginFrom [e-mail]  Wed Jun 11 05:21:53 2008
Return-Path: <[e-mail]>
X-Original-To: [e-mail]
Delivered-To: [e-mail]
Received: from [127.0.0.1] (localhost [127.0.0.1])
	by core3.amsl.com (Postfix) with ESMTP id 15EBA3A68FD;
	Wed, 11 Jun 2008 05:21:53 -0700 (PDT)
X-Original-To: [e-mail]
Delivered-To: [e-mail]
Received: from localhost (localhost [127.0.0.1])
	by core3.amsl.com (Postfix) with ESMTP id 43ED03A6950
	for <[e-mail]>; Wed, 11 Jun 2008 05:21:52 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level: 
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5
	tests=[BAYES_00=-2.599, NO_RELAYS=-0.001]
Received: from mail.ietf.org ([64.170.98.32])
	by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id EVu6v3JeIHhp for <[e-mail]>;
	Wed, 11 Jun 2008 05:21:51 -0700 (PDT)
Received: from abaddon.unfix.org (abaddon.unfix.org
	[IPv6:2001:41e0:ff00:0:216:3eff:fe00:4])
	by core3.amsl.com (Postfix) with ESMTP id 951453A6934
	for <[e-mail]>; Wed, 11 Jun 2008 05:21:50 -0700 (PDT)
Received: from [IPv6:2001:620:20:1000:216:d3ff:fe25:14da]
	(spaghetti.zurich.ibm.com [IPv6:2001:620:20:1000:216:d3ff:fe25:14da])
	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
	(No client certificate requested) (Authenticated sender: jeroen)
	by abaddon.unfix.org (Postfix) with ESMTPSA id 7C64A3D2166;
	Wed, 11 Jun 2008 14:22:12 +0200 (CEST)
Message-ID: <[e-mail]>
Date: Wed, 11 Jun 2008 14:22:27 +0200
From: Jeroen Massar <[e-mail]>
Organization: Unfix
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
	rv:1.8.1.14) Gecko/20080421 Lightning/0.8 Thunderbird/2.0.0.14
	Mnenhy/0.7.5.666
MIME-Version: 1.0
To: Gervase Markham <[e-mail]>
References: <[e-mail]>	<[e-mail]>	<[e-mail]>	<[e-mail]>	<[e-mail]>	<[e-mail]>	<[e-mail]>	<[e-mail]>
	<[e-mail]>	<[e-mail]>	<[e-mail]>
	<[e-mail]>
In-Reply-To: <[e-mail]>
X-Enigmail-Version: 0.95.6
OpenPGP: id33E7C23
X-Virus-Scanned: ClamAV version 0.93,
	clamav-milter version 0.93 on abaddon.unfix.org
X-Virus-Status: Clean
Cc: [e-mail], Jelte Jansen <[e-mail]>,
	Jamie Lokier <[e-mail]>,
	David Conrad <[e-mail]>, [e-mail]
Subject: Re: [DNSOP] Public Suffix List
X-BeenThere: [e-mail]
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: IETF DNSOP WG mailing list <dnsop.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/dnsop>,
	<mailto:[e-mail]?subject=unsubscribe>
List-Archive: <http://www.ietf.org/pipermail/dnsop>
List-Post: <mailto:[e-mail]>
List-Help: <mailto:[e-mail]?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dnsop>,
	<mailto:[e-mail]?subject=subscribe>
Content-Type: multipart/mixed; boundary="=======86645380="
Sender: [e-mail]
Errors-To: [e-mail]

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)

Gervase Markham wrote:
[..]
> Cookies are set for a particular domain or domain suffix, and are sent
> to all sites with that domain suffix. So (under the current code)
> www.mybank.co.uk can set cookies for either www.mybank.co.uk (shared
> with foo.www.mybank.co.uk but not log.mybank.co.uk), mybank.co.uk
> (shared with login.mybank.co.uk but not adserver.co.uk) or co.uk (shared
> with adserver.co.uk but not with myorg.org.uk).

With the real fix here simply being that mybank.co.uk only sets a cookie 
for mybank.co.uk and not for co.uk. The is thus a problem of the bank 
being stupid to set a cookie for co.uk.

If adserver.co.uk (as they are 'evil') sets a cookie for co.uk then 
indeed that cookie gets sent to mybank.co.uk too. What harm does/can 
this do? (Except that they might set a cookie identical of type to the 
bank one and maybe auto-login to their bank account!?)

Do you have an example where you actually need that Public Suffix List?

Greets,
  Jeroen

_______________________________________________
DNSOP mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/dnsop