1

I am about to buy .dev domain. However registrars warn that it is a "secure domain space" and that I will need SSL certificate for the domain. I am more than happy to make sure the web runs over SSL, but I might to also want to connect over unsecure protocols, such as when using my VPS to play games with friends.

What does "Secure domain space" mean technically?

2 Answers 2

2

Secure Domain Space TLD's are encrypted at the domain level using HSTS.

Theoretically you would still be able to connect to it for gaming, but hosted websites will be encrypted by default.

HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks1 and cookie hijacking. Source Wikipedia

2
  • Then does that mean the domain registrar interferes with the connections somehow to enforce https? Dec 20, 2019 at 13:44
  • 2
    Not exactly. HSTS is a browser feature that doesn't allow insecure connections to domains that have declared they will always be HTTPS only. When creating the .dev top level domain, Google got the entire TLD added to the HSTS preload list. Browsers that support HSTS (Chrome and Firefox) will never allow a insecure HTTP connection to a .dev site. Clients that don't support HSTS (such as most games) won't be affected. Dec 20, 2019 at 13:58
1

What does "Secure domain space" mean technically?

Nothing specially, as this is not a technical specification.

Here is what happens.

1) HSTS is a new standard, implemented by many browsers, that prohibits them to connect over HTTP and force HTTPS. This either happens after the first connection through HTTP (the server replies with some headers dictating the browser to restart the connection over HTTPS and keep doing that for a given amount of time - of course this is vulnerable to the first connection being hijacked) OR because the website is registered into an "HSTS preloading list", which is then included in browsers code source (in that case, there is no vulnerability, as even the first connection will be over HTTPS, never over HTTP)

2) Google Registry decided to add all its newer TLDs (DEV, NEW, APP) in the HSTS preloading list. It means no standard browser will ever do an HTTP query to any hostname in those TLDs

3) Contractually, Google Registry forces registrars to display a message during registration, to warn them about the above. Of course, it would have been too simple to just explain the above, and instead they just put some vague marketing terms, and even such nonsense as "SSL certificate". Each registrar can either use the text given by the registry, or any other one, but the registry mandates the registrar to show screenshots of its checkout before Google Registry accepts it as good enough and authorizes domain registrations through this registrar.

So in short, all that means is that due to Google adding its TLDs in the preloading list, if you have a website there and want normal browsers to access it, you need to enable HTTPS (and hence have a certificate), because it will never work over HTTP.

All the above has no consequences at all for any other protocols (which shows that "secure domain space" is a claim without merit, for anyone smart enough to remember that a domain is not necessarily used for the web or not only for that; it is an unfortunate frequent wrong shortcut to think that Internet and World Wide Web are the same thing), or any HTTP client not implementing HSTS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.