6 ms·

Interestingly, on some websites with paywalls, placing a dot at the end of the domain name actually allows you to bypass the paywall. It used to work on more s

Interestingly, on some websites with paywalls, placing a dot at the end of the domain name actually allows you to bypass the paywall. It used to work on more sites, but it has since been fixed. I guess someone caught up to the little trick haha

dotancohen 4y ago
What was the mechanism behind this?
- a3w 4y ago
  IIRC, cross site loads fail. Most likely due to TLS mismatches. See: You can bypass YouTube ads by adding a dot after the domain (reddit.com) https://news.ycombinator.com/item?id=23479435 https://news.ycombinator.com/item?id=23479435 I once submitted a bug for Mozilla, it got shot down: The site does not work as expected if you use https://youtube.com https://youtube.com. in Firefox. This can be a security issue, if you are on corporate or public-wifi DNS that is a security issue, too: if the default search happens in companyname.com. by DNS setting of that network and they offer youtube.com.companyname.com., you will get youtube.com served from evil companyname.com Why does that nowadays still exist? A good use case, if you are lazy, is that you can visit webmail.companyname.com by typing https://webmail https://webmail and being in corporate (virtual) private network, which I frequently do. Compare: URLs with trailing dots in host names (FQDN) produce cert name mismatches (for paypal) https://bugzilla.mozilla.org/show_bug.cgi?id=134402 https://bugzilla.mozilla.org/show_bug.cgi?id=134402
jbotdev 4y ago
Reminds me of when I was in school, and you could access blocked sites by appending a dot. Presumably their firewall had a bunch of domain block rules that didn’t take this into account, and the vendor didn’t think to check for both variations of a domain.
jusssi 4y ago
On Firefox, you can type a dot at the end of the domain, and it successfully loads the page. But it seems to consider the domain with dot a different from the one without, for purposes of cookies etc.

dotancohen 4y ago

What was the mechanism behind this?

a3w 4y ago
IIRC, cross site loads fail. Most likely due to TLS mismatches. See: You can bypass YouTube ads by adding a dot after the domain (reddit.com) https://news.ycombinator.com/item?id=23479435 https://news.ycombinator.com/item?id=23479435 I once submitted a bug for Mozilla, it got shot down: The site does not work as expected if you use https://youtube.com https://youtube.com. in Firefox. This can be a security issue, if you are on corporate or public-wifi DNS that is a security issue, too: if the default search happens in companyname.com. by DNS setting of that network and they offer youtube.com.companyname.com., you will get youtube.com served from evil companyname.com Why does that nowadays still exist? A good use case, if you are lazy, is that you can visit webmail.companyname.com by typing https://webmail https://webmail and being in corporate (virtual) private network, which I frequently do. Compare: URLs with trailing dots in host names (FQDN) produce cert name mismatches (for paypal) https://bugzilla.mozilla.org/show_bug.cgi?id=134402 https://bugzilla.mozilla.org/show_bug.cgi?id=134402

jbotdev 4y ago

Reminds me of when I was in school, and you could access blocked sites by appending a dot. Presumably their firewall had a bunch of domain block rules that didn’t take this into account, and the vendor didn’t think to check for both variations of a domain.

jusssi 4y ago

On Firefox, you can type a dot at the end of the domain, and it successfully loads the page. But it seems to consider the domain with dot a different from the one without, for purposes of cookies etc.