Domain hacks with unusual Unicode characters (2018)

(xn--69f31l4t57c0mag4b613h.xn--7uh4898msjaso)

22 points | by n_plus_1_acc 2 hours ago

7 comments

  • n_plus_1_acc 2 hours ago
    Looks like HN broke the URL after submitting. Let's try again:

        https://ₛᵖ.ⓜ/
    
    Here is the backup link:

    https://shkspr.mobi/blog/2018/11/domain-hacks-with-unusual-u...

    • zenexer 1 hour ago
      That shows up as ₛᵖ.ⓜ, so a bunch of characters are missing.

      HN seems to encode it as punycode when it shouldn’t; it skipped normalization.

  • Aozora7 8 minutes ago
    My favorite unicode character is zero width space. One of its funniest properties is that it's not a whitespace.

    Also, some programming languages treat it as a valid identifier.

  • huhtenberg 1 hour ago
    Tangentially related - 20+ years ago I managed to register a π domain under one of the primary TLDs.

    As in, the registration form was accepted and the fee was charged.

    Then, few days after they emailed to say that "due to technical difficulties" the registration can be registered and they have no choice but to unregister it.

    I was so close, damn amateurs.

    • waltbosz 1 hour ago
      My brother had a friend who tried to register fuck.com in the early days of the Internet, around 1994, and the registrar was confused and wanted to know why he wanted to register it. This was when the Internet was mostly universities and a .com cost $100 to register.
      • jagged-chisel 59 minutes ago
        What was his response? Did they refuse to allow it?
    • Tepix 57 minutes ago
      I managed to register a one letter domain below a CC-tld, despite that country having a rule against it. Their signup form had two stages and the check was only on the first page... so all it took was changing a hidden form field.

      I had it for a while until they started charging a lot for it (it was Turkmenistan).

  • mmsc 1 hour ago
    On Firefox, hover-over of the link doesn't show the URL in the bottom left of the browser.
  • waltbosz 1 hour ago
    I click on the link on Android Firefox and nothing happens.
  • kccqzy 41 minutes ago
    My browser refuses to open this link. It couldn’t find the server.
  • ButlerianJihad 1 hour ago
    Now, please present a list of these to your grandmother, and ask her which ones are phishing, and which are legitimately from the government.

    Now, present the same list to an I.T. professional with the same questions. Perhaps make sure they are not carrying any weapons before you try.

    This is just one reason why visual inspection of URLs and "hover over this link" haven't been useful defenses for a long time.

    • jareklupinski 37 minutes ago
      my grandmother used her offline-only computer for solitaire

      what are grandmothers even doing on the internet, theres dangerous viruses and worms on there!

      is there any other medium where the range of participants in the pool goes from "55 year career professional" to "hardened criminal" to "kindly grandmother"