https://ₛᵖ.ⓜ/

https://shkspr.mobi/blog/2018/11/domain-hacks-with-unusual-u...

As in, the registration form was accepted and the fee was charged.

Then, few days after they emailed to say that "due to technical difficulties" the registration can be registered and they have no choice but to unregister it.

I was so close, damn amateurs.

Some older RFCs even recommended using it for passwords, which needlessly reduces entropy (yes we need to normalise passwords because of combining characters, but we don’t need to collapse symbols that a user can choose from, like ſ and s).

In my opinion, the compatibility form makes mostly sense for searching text, and even then it’s sometimes annoying (I want to search exactly for ss and not ß, browser). If you know of other good use cases let me know.

It also OK to disallow registering two identifiers with the same compatibility normalisation form (edit: this does not prevent all homoglyph attacks BTW, that is another can of worms), but I don’t see the need to normalise the identifier when it’s used.

Also, some programming languages treat it as a valid identifier.

Also, the author's one-liner, updated for Python 3:

  python3 -c 'import sys;print(sys.argv[1].encode("idna").decode("ascii"))' "℡"

I have a domain that contains Nordic characters and it is a crapshoot if the email client will accept and send.

Meanwhile I have not encountered problems with http access.

  ㍳ │ 003373 │ SQUARE AU │ AU │ Australia
  ㍴ │ 003374 │ SQUARE BAR │ BAR │ Bar, Punto 2012 Sociedad Anonima Promotora de Inversion de Capital Variable
  ㎈ │ 003388 │ SQUARE CAL │ CAL │ Google
  ㏄ │ 0033C4 │ SQUARE CC │ CC │ Cocos (Keeling) Islands
  ㏅ │ 0033C5 │ SQUARE CD │ CD │ The Democratic Republic of the Congo
  � │ 01F12D │ CIRCLED CD │ CD │ The Democratic Republic of the Congo
  ㎝ │ 00339D │ SQUARE CM │ CM │ Cameroon
  � │ 01F190 │ SQUARE DJ │ DJ │ Djibouti
  ㍷ │ 003377 │ SQUARE DM │ DM │ Dominica
  DZ │ 0001F1 │ LATIN CAPITAL LETTER DZ │ DZ │ Algeria
  Dz │ 0001F2 │ LATIN CAPITAL LETTER D WITH SMALL LETTER Z │ DZ │ Algeria
  dz │ 0001F3 │ LATIN SMALL LETTER DZ │ DZ │ Algeria
  fi │ 00FB01 │ LATIN SMALL LIGATURE FI │ FI │ The Republic of Finland
  ㎙ │ 003399 │ SQUARE FM │ FM │ Federated States of Micronesia
  ㏿ │ 0033FF │ SQUARE GAL │ GAL │ Galicia, Spain
  ㎇ │ 003387 │ SQUARE GB │ GB │ United Kingdom
  ㏉ │ 0033C9 │ SQUARE GY │ GY │ Guyana
  ㏌ │ 0033CC │ SQUARE IN │ IN │ The Republic of India
  ㎏ │ 00338F │ SQUARE KG │ KG │ Kyrgyzstan
  ㎞ │ 00339E │ SQUARE KM │ KM │ Comoros
  ㏎ │ 0033CE │ SQUARE KM │ KM │ Comoros
  ㎾ │ 0033BE │ SQUARE KW │ KW │ Kuwait
  ㋏ │ 0032CF │ LIMITED LIABILITY SIGN │ LTD │ Binky Moon, LLC
  ㎃ │ 003383 │ SQUARE MA │ MA │ Morocco
  � │ 01F16A │ RAISED MC SIGN │ MC │ Monaco
  � │ 01F16B │ RAISED MD SIGN │ MD │ The Republic of Moldova
  ㎎ │ 00338E │ SQUARE MG │ MG │ Madagascar
  ㏕ │ 0033D5 │ SQUARE MIL │ MIL │ United States Military
  ㎜ │ 00339C │ SQUARE MM │ MM │ Myanmar
  � │ 01F16C │ RAISED MR SIGN │ MR │ Mauritania
  ㎳ │ 0033B3 │ SQUARE MS │ MS │ Montserrat
  ㎷ │ 0033B7 │ SQUARE MV │ MV │ Maldives
  ㎹ │ 0033B9 │ SQUARE MV MEGA │ MV │ Maldives
  � │ 01F14B │ SQUARED MV │ MV │ Maldives
  ㎽ │ 0033BD │ SQUARE MW │ MW │ Malawi
  ㎿ │ 0033BF │ SQUARE MW MEGA │ MW │ Malawi
  ㎁ │ 003381 │ SQUARE NA │ NA │ Namibia
  ㎋ │ 00338B │ SQUARE NF │ NF │ Norfolk Island
  № │ 002116 │ NUMERO SIGN │ NO │ The Kingdom of Norway
  ㎀ │ 003380 │ SQUARE PA AMPS │ PA │ Panama
  ㎩ │ 0033A9 │ SQUARE PA │ PA │ Panama
  ㎊ │ 00338A │ SQUARE PF │ PF │ French Polynesia
  ㏗ │ 0033D7 │ SQUARE PH │ PH │ The Republic of the Philippines
  ㏚ │ 0033DA │ SQUARE PR │ PR │ Puerto Rico (U.S.)
  ㎰ │ 0033B0 │ SQUARE PS │ PS │ Palestinian Territory, Occupied
  ㎺ │ 0033BA │ SQUARE PW │ PW │ Palau
  ₨ │ 0020A8 │ RUPEE SIGN │ RS │ Serbia
  � │ 01F14C │ SQUARED SD │ SD │ Sudan
  ℠ │ 002120 │ SERVICE MARK │ SM │ San Marino
  ㏛ │ 0033DB │ SQUARE SR │ SR │ Suriname
  � │ 01F14D │ SQUARED │ SS │ SS │ South Sudan
  st │ 00FB06 │ LATIN SMALL LIGATURE ST │ ST │ Sao Tome and Principe
  ㏜ │ 0033DC │ SQUARE SV │ SV │ El Salvador
  ℡ │ 002121 │ TELEPHONE SIGN │ TEL │ Contact data
  ™ │ 002122 │ TRADE MARK SIGN │ TM │ Turkmenistan
  Ⅵ │ 002165 │ ROMAN NUMERAL SIX │ VI │ Virgin Islands, U.S.
  ⅵ │ 002175 │ SMALL ROMAN NUMERAL SIX │ VI │ Virgin Islands, U.S.
  ㌽ │ 00333D │ SQUARE POINTO │ ポイント │ Amazon Registry Services, Inc.

aHR0cHM6Ly/wn4WC8J2WjfCdkKTigpvhtZbwnZKTLuKTnPCdlaDwnZKD8J2Tsi/wn4aG8J+Gg/CfhbU=

https://www.schneier.com/crypto-gram/archives/2000/0715.html...

"Unicode is just too complex to eve be secure"

As to me I'm running my own DNS resolver (I use unbound) and everything goes through port 53 UDP (and AIUI technically 53 TCP should be allowed, but nothing will happen if you just block it), unencrypted. What then unbound does on the Internet, that's up to you: you can encrypt those requests...

The nice thing with everything being in the clear, is that you can null route / NX DOMAIN every single domain that uses Unicode (punnycode) characters and you can even do that at the firewall level, by inspecting UDP packets.

Of course you gotta be sure to really block DoH / DoT internally but it's all doable.

I set that up years ago and I've been running like that since then without any issue.

Just as entire countries's IP blocks do not exist in my world, domains using Unicode characters do not exist. And I really don't care about your feelings about it: I'm just explaining that technically it can be done to block them all and that the Internet keeps working just fine.

Unicode really is just too complex to ever be secure. And those who don't understand that are part of the problem.

Now, present the same list to an I.T. professional with the same questions. Perhaps make sure they are not carrying any weapons before you try.

This is just one reason why visual inspection of URLs and "hover over this link" haven't been useful defenses for a long time.