12

Since 2009, Google has been using a single domain name to identify its servers across multiple products:

Following standard industry practice, we make sure each IP address has a corresponding hostname. In October 2009, we started using a single domain name to identify our servers across all Google products, rather than use different product domains such as youtube.com, blogger.com, and google.com. We did this for two reasons: first, to keep things simpler, and second, to proactively improve security by protecting against potential threats such as cross-site scripting attacks.

Question: How does it protect against application level threats such as XSS? Are there any other advantages of using this technique from security standpoint?

1
  • Deleted my answer in embarrassment upon reading @Tylerl's answer... The third sentence of his second paragraph nails it and should be bolded.
    – gowenfawr
    Jun 8, 2016 at 12:09

2 Answers 2

4

Each production IP address has a unique hostname, which is predictable, consistent, deterministic, and entirely useless to anyone but a few engineers who I suspect can read these addresses like a map. These names matter a lot to those people; but for the rest of us we just care that it doesn't create new problems.

That's where the XSS comes in, because domain names matter a lot in security. On the web, a domain name is a security boundary. Cookies, browser objects, and other resources are shared freely within a domain but can't cross that boundary without certain provisions. So if each address had a hostname ending in "google.com" or "youtube.com" or any other domain that has associated web resources, then theoretically an attacker could request a resource that normally would be outside of the trusted domain, but which is also accessible through the IP's assigned hostname.

Rather than finding and fixing all such potential issues, a safer solution is to put the hostnames on their own unique domain which is never used for any other purpose and therefore can't harbor unwanted surprises.

It's also interesting to note that not all of Google's IPs use 1e100.net. Addresses under user control like those assigned to Google Compute instances resolve back to a name ending in googleusercontent.com.

Disclaimer: I work for Google.
Reclaimer: This is not an official Google response. I don't speak for Google. These thoughts and opinions are my own, and don't reflect those of my employer, my congressman, or the 80's rock band, Toto.

1

I suspect the security aspect (their second reason) is related to 1e100.net simply being different from the product domains (youtube.com, blogger.com, google.com). The fact that all servers identify by the same hostname is nice for simplicity (their first reason), but probably not significant for security.

I'm not sure exactly what the threat profile is here, but if they were to identify a server as server-xyx.google.com, then it might be easier to exploit the google.com origin. By identifying it as server-xyz.1e100.net, they don't necessarily need to entrust it with the google.com domain name.

There was an interesting Hacker News discussion about this: https://news.ycombinator.com/item?id=3338938

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .