Tangentially related - 20+ years ago I managed to register a π domain under one of the primary TLDs.
As in, the registration form was accepted and the fee was charged.
Then, few days after they emailed to say that "due to technical difficulties" the registration can be registered and they have no choice but to unregister it.
My brother had a friend who tried to register fuck.com in the early days of the Internet, around 1994, and the registrar was confused and wanted to know why he wanted to register it. This was when the Internet was mostly universities and a .com cost $100 to register.
I managed to register a one letter domain below a CC-tld, despite that country having a rule against it. Their signup form had two stages and the check was only on the first page... so all it took was changing a hidden form field.
I had it for a while until they started charging a lot for it (it was Turkmenistan).
As to me I'm running my own DNS resolver (I use unbound) and everything goes through port 53 UDP (and AIUI technically 53 TCP should be allowed, but nothing will happen if you just block it), unencrypted. What then unbound does on the Internet, that's up to you: you can encrypt those requests...
The nice thing with everything being in the clear, is that you can null route / NX DOMAIN every single domain that uses Unicode (punnycode) characters and you can even do that at the firewall level, by inspecting UDP packets.
Of course you gotta be sure to really block DoH / DoT internally but it's all doable.
I set that up years ago and I've been running like that since then without any issue.
Just as entire countries's IP blocks do not exist in my world, domains using Unicode characters do not exist. And I really don't care about your feelings about it: I'm just explaining that technically it can be done to block them all and that the Internet keeps working just fine.
Unicode really is just too complex to ever be secure. And those who don't understand that are part of the problem.
my grandmother used her offline-only computer for solitaire
what are grandmothers even doing on the internet, theres dangerous viruses and worms on there!
is there any other medium where the range of participants in the pool goes from "55 year career professional" to "hardened criminal" to "kindly grandmother"
This has given me a lot of trouble with emails.
I have a domain that contains Nordic characters and it is a crapshoot if the email client will accept and send.
Meanwhile I have not encountered problems with http access.
Looks like HN broke the URL after submitting. Let's try again:
Here is the backup link:https://shkspr.mobi/blog/2018/11/domain-hacks-with-unusual-u...
That shows up as ₛᵖ.ⓜ, so a bunch of characters are missing.
HN seems to encode it as punycode when it shouldn’t; it skipped normalization.
Firefox doesn't even let me open the link, wow.
Same here on Firefox mobile, link is not clickable.
Same, can't open on Firefox
Tangentially related - 20+ years ago I managed to register a π domain under one of the primary TLDs.
As in, the registration form was accepted and the fee was charged.
Then, few days after they emailed to say that "due to technical difficulties" the registration can be registered and they have no choice but to unregister it.
I was so close, damn amateurs.
My brother had a friend who tried to register fuck.com in the early days of the Internet, around 1994, and the registrar was confused and wanted to know why he wanted to register it. This was when the Internet was mostly universities and a .com cost $100 to register.
Was that friend Justin Hall of Wired?
There was a story about Jon Postel (pre-ICANN) and fuck.com, this might be it:
https://www.links.net/webpub/fuck.com.html
What was his response? Did they refuse to allow it?
I managed to register a one letter domain below a CC-tld, despite that country having a rule against it. Their signup form had two stages and the check was only on the first page... so all it took was changing a hidden form field.
I had it for a while until they started charging a lot for it (it was Turkmenistan).
My favorite unicode character is zero width space. One of its funniest properties is that it's not a whitespace.
Also, some programming languages treat it as a valid identifier.
On Firefox, hover-over of the link doesn't show the URL in the bottom left of the browser.
I click on the link on Android Firefox and nothing happens.
My browser refuses to open this link. It couldn’t find the server.
Which of course Bruce Schneier predicted in 2000:
https://www.schneier.com/crypto-gram/archives/2000/0715.html...
"Unicode is just too complex to eve be secure"
As to me I'm running my own DNS resolver (I use unbound) and everything goes through port 53 UDP (and AIUI technically 53 TCP should be allowed, but nothing will happen if you just block it), unencrypted. What then unbound does on the Internet, that's up to you: you can encrypt those requests...
The nice thing with everything being in the clear, is that you can null route / NX DOMAIN every single domain that uses Unicode (punnycode) characters and you can even do that at the firewall level, by inspecting UDP packets.
Of course you gotta be sure to really block DoH / DoT internally but it's all doable.
I set that up years ago and I've been running like that since then without any issue.
Just as entire countries's IP blocks do not exist in my world, domains using Unicode characters do not exist. And I really don't care about your feelings about it: I'm just explaining that technically it can be done to block them all and that the Internet keeps working just fine.
Unicode really is just too complex to ever be secure. And those who don't understand that are part of the problem.
Does this also allow you to work with DNS in a fully private/anonymized way?
Now, please present a list of these to your grandmother, and ask her which ones are phishing, and which are legitimately from the government.
Now, present the same list to an I.T. professional with the same questions. Perhaps make sure they are not carrying any weapons before you try.
This is just one reason why visual inspection of URLs and "hover over this link" haven't been useful defenses for a long time.
my grandmother used her offline-only computer for solitaire
what are grandmothers even doing on the internet, theres dangerous viruses and worms on there!
is there any other medium where the range of participants in the pool goes from "55 year career professional" to "hardened criminal" to "kindly grandmother"