jonpugh

I build systems (devshop/aegir) that create and destroy websites on the fly.

If I'm working on a feature related to that process I could create and delete a dozen or more arbitrary domains in a day.

I also know plenty of web development teams that are less technical and could deal without manual hosts file tweaking on a daily basis.

I also use multiple computers. With this domain, I never have setup Dnsmasq, never have to edit a hosts file, never have to edit DNS.

Being obsessed with automation and efficiency, anywhere I can save a few seconds, I will.

I never suggested using the domain for anything but web browser requests, not sure why anyone would need to use it to connect in any other way.

So as long as users don't use it for connecting to their local server are they safe?

Don't most people connect to local servers via Vagrant or docker shared volumes, anyway?

Not sure why anyone would use it for accessing their local machine when there are existing methods for that.

Thanks for the details.

The benefit is not zero, it is having unlimited domains pointed to local without having to ever mess with DNS or /etc/hosts.

Sure, but this record goes to 127.0.0.1. How would I get the IP of your development server other than 127.0.0.1? When you request local.computer, it's not sending me your IP, it's requesting one.

Right? Public DNS for a private IP doesn't get me anything I don't already know, right?

I still can't quite put my finger on the security risk for others, can you help explain what makes it one?

Here's the only scenario I can think of:

Say you are a web developer and you use mybusiness.local.computer for developing your client's website. You use it every day, you are used to loading up the URL and seeing your website.

One day I, owner of local.computer turn the dark side. I decide that I want to attack you, this one person who I know uses mybusiness.local.computer, and change mybusiness.local.computer to redirect to my nefarious server.

When I do that, when you come to work, you load up mybusiness.local.computer and expect to see the site you've been working on.

Because I know my victim, I know exactly what website to spoof, so I have my spoof up and running on my nefarious server.

Then, when the victim goes to visit mybusiness.local.computer, thinking they are visiting a copy of their website, it's actually being served from my server.

Hopefully, you then input some information, like their username and password, which I then capture in my spoof website.

This is the only way I can imagine using this domain against someone.

It involves quite a few assumptions:

- The one in control of DNS is the attacker. - The attacker has one specific victim in mind, because they can only spoof one website. - The attacker already knows what site the victim is expecting to load at a .local.computer domain. This requires personal knowledge of the victim's site because the DNS for .local.computer goes straight to 127.0.0.1. Requests are not proxied or logged. (Ok, after writing this, I realize I could change the local.computer to go through my servers then redirect the user to 127.0.0.1 enabling me to at least learn what subdomains are being requested. Still, I have no idea what that site is supposed to be.) - The attacker is able to spoof that website well enough that the victim (a developer of the website) is able to be fooled into giving up information.

Is there another way this could be abused? I seriously would like to know.

Thanks!