Chrome to force .dev domains to HTTPS via preloaded HSTS
<p><pre><code>  Sorry for top-leveling a grand-child comment, but reading between
  the lines, this is the attack vector: 
   
  &gt; And for the last question: Again, there are no .dev domain
  &gt; names. There never have been. It&#x27;s never been available for
  &gt; registration. The recommendation for a long time has been to
  &gt; only use either (a) domain names that you actually own, or (b)
  &gt; domain names that are reserved for testing and are guaranteed
  &gt; never to exist a la RFC 2606. Using domain names for testing
  &gt; that don&#x27;t yet exist but could in the future is a huge security
  &gt; hole that you must fix now. Do it now while the domain names
  &gt; still fail to resolve. Once they resolve, and you don&#x27;t own
  &gt; them, then your security situation gets a lot worse.   
   
  Google is concerned with nation-state attacks.  This means they
  have to assume ninja-assassin-scuba-divers have tapped all their
  cables underground.  They&#x27;re also concerned about 
  ninja-assassin-usb-stick-droppers, and all kinds of other use
  cases.                                                   
                                                           
  What they&#x27;re doing is:                                   
                                                           
  1) Requiring *.dev to match PRE-LOADED HSTS certs.  This allows
  google to &quot;safely&quot; boot up a computer from scratch.  Just so long
  as &quot;clone-a-computer-from-scratch.dev&quot; matches  the 
  public&#x2F;private handshake for HSTS&#x2F;HTTPS then google knows that no
  MITM, no nation state DNS takeover, etc. is possible.    
                                                           
  So long as the VERY FIRST CONTACT WITH THE INTERNET is a *.dev
  domain, then that computer can be &quot;as secure as possibly known&quot;.
   
  2) Forcing people to bounce &quot;off&quot; of invalid TLD&#x27;s as a network
  administration method.                                   
                                                           
  Remember, google is concerned about nation states.  Remember
  wanna-cry?  How it was disabled by some random researcher
  registering xyz-abc-123.com?                             
                                   
  That attack costs $15.  Now imagine a nation-state, intentionally
  registering a gTLD of &quot;\*.haha-now-your-company-infra-is-pwnd&quot;
  which they somehow glean is the gTLD your developers use for
  local development &#x2F; testing &#x2F; intranet portal.

  If you could spoof IBM&#x27;s intranet by doing something like:
  &quot;http:&#x2F;&#x2F;www.welcome.ibm&quot; or &quot;https:&#x2F;&#x2F;www.welcome.ibm&quot; (b&#x2F;c the
  *.ibm wasn&#x27;t cert-pinned.....) then you could trivially cause
  *.ibm to resolve to some sort of spoofed site to collect
  passwords.  Or what if they&#x27;re catching `mysql -uroot -pxyz
  staging.product.ibm`?  Whoops.

  Or... perhaps another gTLD we&#x27;ll see google register is &quot;*.go&quot; or
  maybe their internal builds of chrome already do cert-pinning on
  that.  (Reason is I&#x27;ve seen&#x2F;heard they allow
  &#x27;http:&#x2F;&#x2F;go&#x2F;my-internal-shortlink&#x27; ... I know that other tech
  companies have had similar setups).

  Same attack vector.  You control the DNS, you control ALL
  responses. And when somebody types www.microsoft.com, it may be
  _impossible_ to know if that &quot;Down for Maintenance&quot; banner is
  real or fake if their DNS is controlled by somebody who really is
  your enemy.</code></pre>