Can anyone just do that to any domain? My website is hosted at GitHub Pages and requires a CNAME file in the repo root as well as the DNS entry at Cloudflare.
Agreed. The copyright holder / trademark owner must be the party that wants to limit distribution, not the government or some unrelated third party.
i.e. if I see you producing fake Coca Cola drinks, I can't sue you for infringing on The Coca Cola Company's trademark. They would have to sue you. Same applies for the government.
And of course, if NSA does have an agreement with Google to reverse proxy https://google.com/, them doing exactly that would be perfectly legal. I presume they have SOME sort of agreement, and aren't just doing this behind Google's back, as the website is on HN's first page in the first 5 places for an hour already, and Google hasn't banned access.
Try getting even 50 Google queries with a reverse proxy, and you will see what I mean -- they will show you a progressively more difficult ReCAPTCHA until a certain treshold, after which the CAPTCHA is unsolvable and is there only to waste your time. This hasn't happened to HN readers [yet].
Meanwhile I presume they misconfigured a service meant for doing captcha checks using Google. What's more likely? Why are you so aggressively.. eh.. okay, not going to write that.
I don’t think it’s unreasonable to point out that lots of the speculation here about NSA hosting phishing pages or secret captcha-free google for analysts under nsa.gov falls firmly into the chemtrail category of crazy conspiracy theories.
Just like with “chemtrails” there exists a very reasonable explanation for what happened here, but people are choosing to ignore that in order to push weird conspiracy theories.
you can do it to any domain that isn't checking the hostname header. Most sites check that the hostname header matches the sites actual domain (like is specified in the CNAME file on github pages)
that's definitely not what's happening here though, most obviously because it has an SSL certificate. If it were just being CNAMEd over to google, the SSL would be invalid. NSA has to be catching the request to terminate the SSL, and then proxying it back to google.
> $ dig captcha.nsa.gov
> ;; ANSWER SECTION:
> captcha.nsa.gov. 13246 IN CNAME www.nsa.gov.edgekey.net.
> www.nsa.gov.edgekey.net. 21528 IN CNAME e6655.dscna.akamaiedge.net.
> e6655.dscna.akamaiedge.net. 19 IN A 23.213.xxx.xxx
The IP addreses at the last one all seem to be Akamai IPs. So So that is fronting Google here it seems?