7 ms·

Here are a few things I do to combat nasty websites: - blacklists entire domains using wildcards (using an "unbound" DNS resolver and forcing all traffic to my

Here are a few things I do to combat nasty websites: - blacklists entire domains using wildcards (using an "unbound" DNS resolver and forcing all traffic to my DNS resolver, preventing my browser to use DoH -- I can still then use DoH if I want, from unbound) - reject or drop a huge number of known bad actors, regularly updated: they go into gigantic "ip sets" firewall rules - (I came up with this one): use a little firewall rule that prevents any IDN from resolving. That's a one line UDP rule and it stops cold dead any IDN homograph attack. Basically searching any UDP packet for the "xn--" string. I do not care about what this breaks. The Web still works totally fine for me, including Google's G Suite (yeah, I know). EDIT: just to be clear seen the comments for I realize I wasn't very precise... I'm not saying all IDN domains are bad! What I'm saying is that in my day to day Web surfing, 99.99% of the websites I'm using do not use IDN and so, in my case, blocking IDN, up until today, is totally fine as it not only doesn't prevent me from surfing the Web (I haven't seen a single site I need breaking) but it also protects me from IDN homograph attacks. Your mileage may vary and you live in a country where it's normal to go on website with internationalized domain names, then obviously you cannot simply drop all UDP packets attempting to resolve IDNs.

SahAssar 4y ago
The last one is very anglo-centric (or at least centric to fully latinized languages). Do you not find the rules[0] in for example chrome working? [0]: https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md https://chromium.googlesource.com/chromium/src/+/main/docs/i...
- TacticalCoder 4y ago
  I'm not even a native english speaker and my native language does have accentuated characters so there's that... I don't like to have to set rules in browsers: I'll do it when mandatory but I prefer things that the browser won't change during it's next update and, also, I use several browsers.
- tsimionescu 4y ago
  Very few countries, even outside the anglosphere, use IDNs.
eurticket 4y ago
Steven Black runs a hosts file on GitHub with regular updates. https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts There are a bunch of file variants to weed out specific bad actors. It's well currated though I will disclaimer it has broken a few websites in the past for me. Maybe that's a good thing.
- whydoyoucare 4y ago
  I use https://oisd.nl/ https://oisd.nl/ which has reasonably curated list on my router with unbound. Works pretty good.
cgb223 4y ago
What’s an IDN and what does blocking them help with?
- NetOpWibby 4y ago
  Mainly homoglyphs. Characters that LOOK like Latin characters but aren't. Scammers register domains to make it look like at a glance you're visiting a reputable site. It's why many browsers started defaulting to showing "xn--<whatever>" (punycode representation of IDN characters). It sucks for domains that are emoji but whatevs. Scammers ruining things for everyone, as usual.
  - quickthrower2 4y ago
    Blocking domains with mixed character sets? Might be hard to come up with the rules. But legit sites should stick to one language mostly.
- buildbot 4y ago
  International domain name - blocking them prevents look alike URLs from working. But also, IMO, this is bad advice for anyone who uses not English as a language...
  - int_19h 4y ago
    If there's any non-English-speaking culture that embraced IDNs, I'd love to hear it. E.g. in my experience as a Russian speaker, Cyrillic very rarely shows up in domain names for legitimate websites, and correlates strongly with malware.
    - ddeck 4y ago
      The numbers agree. Only 69 Cyrillic domains (second-level) registered last year. Chinese is the most popular, but only 760 for 2022 and the aggregate trend is down: 2016: 2378 2018: 2252 2020: 1675 2022: 1518 Internationalized Domain Name (IDN) Annual Report 2022 [1] https://www.icann.org/en/system/files/files/idn-annual-report-2022-16feb23-en.pdf https://www.icann.org/en/system/files/files/idn-annual-repor...
giobox 4y ago
While these are all good practices, killing DoH conclusively on your home network is more difficult than you've made it seem, as ultimately all you can really do is use domain blacklists at your firewall. It's no longer as straight forward as just control port 53 traffic, not like you can realistically shut down 443... Blocking DoH is largely whack-a-mole and I think is only going to get worse as this and similar techniques spread. There are so many sneaky ways to resolve a hostname an app or device can choose to use now. You can force traditional port 53 DNS protocol traffic to your own resolver with firewall rules, the same doesn't work for DoH. a DoH request to a domain your firewall blacklist doesn't have looks just like ordinary https/443 traffic and will pass unhindered.
- TacticalCoder 4y ago
  > While these are all good practices, killing DoH conclusively on your home network is more difficult than you've made it seem Oh I know but so far you can still ask both Firefox and Chromium to not use DoH and hence force them to use port 53 and from what I've seen they really honor that. For the moment. I don't doubt that in a not so distant future we may see companies hardcoding DoH into apps without any possibility of removing that setting! What I do is no panacea but it gets rid of a lot of things. > There are so many sneaky ways to resolve a hostname an app or device can choose to use now. But I whitelist apps that can connect to the net. Browsers, apt (for Debian/Devuan package update), the one that update the NTP/time, SSH out and that's basically it. I know it's a game of whack-a-mole, but I'm still playing it : )
- LinuxBender 4y ago
  Blocking DoH is largely whack-a-mole Maybe this is so but I have yet to see it. AFAIK all the DoT/DoH are on known dedicated IP addresses. I know they don't have to be. They could be on generic Akamai/CF/BunnyCDN/etc... end points but I have yet to come across one utilized in the wild. Have you found any? What are their IP addresses? I would like to add them to my DNS timing/monitoring scripts. I null route about 24 DoT/DoH IP addresses and my one smartphone seemed to figure out automagically that my router was serving up DoT on 853. I can tell if something is bypassing Unbound because there are things I know should not resolve correctly.
srcreigh 4y ago
what's the advantage of DoH? I personally use Timescale magicDNS on all my devices, with pihole DNS running on a home server. The magicDNS can make my home server the 1st responder for DNS queries and it'll block a lot of ad domains.
- tsimionescu 4y ago
  DoH was designed to prevent the network operators from interfering with or snooping on DNS. The stated purpose was to prevent your carrier or country from seeing which domains you access, and/or blocking you from accessing them. However, it also prevents devices like piHole from passively blocking ad requests as easily.
userbinator 4y ago
I venture onto the Asian and Russian parts of the Internet semi-regularly, and in all these years I have seen perhaps one or two sites with IDN that were actually useful to me.
maxerickson 4y ago
I don't do any of that stuff and don't think I am running into nasty websites. What is it supposed to do? I do uBlock origin with pretty standard lists and have a list of allowed persistent cookies. Are the uBlock lists doing all that work in the background?
- dngray 4y ago
  You're on the right track, perhaps take a look at https://www.privacyguides.org/desktop-browsers/#firefox https://www.privacyguides.org/desktop-browsers/#firefox that's really all.
whiw 4y ago
> (I came up with this one): use a little firewall rule that prevents any IDN from resolving. That's a one line UDP rule and it stops cold dead any IDN homograph attack. Basically searching any UDP packet for the "xn--" string. I couldn't see how to do this in Windows Firewall. Which OS/firewall/rule are you using?

SahAssar 4y ago

The last one is very anglo-centric (or at least centric to fully latinized languages). Do you not find the rules[0] in for example chrome working? [0]: https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md https://chromium.googlesource.com/chromium/src/+/main/docs/i...

TacticalCoder 4y ago
I'm not even a native english speaker and my native language does have accentuated characters so there's that... I don't like to have to set rules in browsers: I'll do it when mandatory but I prefer things that the browser won't change during it's next update and, also, I use several browsers.
tsimionescu 4y ago
Very few countries, even outside the anglosphere, use IDNs.

eurticket 4y ago

Steven Black runs a hosts file on GitHub with regular updates. https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts There are a bunch of file variants to weed out specific bad actors. It's well currated though I will disclaimer it has broken a few websites in the past for me. Maybe that's a good thing.

whydoyoucare 4y ago
I use https://oisd.nl/ https://oisd.nl/ which has reasonably curated list on my router with unbound. Works pretty good.

cgb223 4y ago

What’s an IDN and what does blocking them help with?

NetOpWibby 4y ago
Mainly homoglyphs. Characters that LOOK like Latin characters but aren't. Scammers register domains to make it look like at a glance you're visiting a reputable site. It's why many browsers started defaulting to showing "xn--<whatever>" (punycode representation of IDN characters). It sucks for domains that are emoji but whatevs. Scammers ruining things for everyone, as usual.
- quickthrower2 4y ago
  Blocking domains with mixed character sets? Might be hard to come up with the rules. But legit sites should stick to one language mostly.
buildbot 4y ago
International domain name - blocking them prevents look alike URLs from working. But also, IMO, this is bad advice for anyone who uses not English as a language...
- int_19h 4y ago
  If there's any non-English-speaking culture that embraced IDNs, I'd love to hear it. E.g. in my experience as a Russian speaker, Cyrillic very rarely shows up in domain names for legitimate websites, and correlates strongly with malware.
  - ddeck 4y ago
    The numbers agree. Only 69 Cyrillic domains (second-level) registered last year. Chinese is the most popular, but only 760 for 2022 and the aggregate trend is down: 2016: 2378 2018: 2252 2020: 1675 2022: 1518 Internationalized Domain Name (IDN) Annual Report 2022 [1] https://www.icann.org/en/system/files/files/idn-annual-report-2022-16feb23-en.pdf https://www.icann.org/en/system/files/files/idn-annual-repor...

giobox 4y ago

While these are all good practices, killing DoH conclusively on your home network is more difficult than you've made it seem, as ultimately all you can really do is use domain blacklists at your firewall. It's no longer as straight forward as just control port 53 traffic, not like you can realistically shut down 443... Blocking DoH is largely whack-a-mole and I think is only going to get worse as this and similar techniques spread. There are so many sneaky ways to resolve a hostname an app or device can choose to use now. You can force traditional port 53 DNS protocol traffic to your own resolver with firewall rules, the same doesn't work for DoH. a DoH request to a domain your firewall blacklist doesn't have looks just like ordinary https/443 traffic and will pass unhindered.

TacticalCoder 4y ago
> While these are all good practices, killing DoH conclusively on your home network is more difficult than you've made it seem Oh I know but so far you can still ask both Firefox and Chromium to not use DoH and hence force them to use port 53 and from what I've seen they really honor that. For the moment. I don't doubt that in a not so distant future we may see companies hardcoding DoH into apps without any possibility of removing that setting! What I do is no panacea but it gets rid of a lot of things. > There are so many sneaky ways to resolve a hostname an app or device can choose to use now. But I whitelist apps that can connect to the net. Browsers, apt (for Debian/Devuan package update), the one that update the NTP/time, SSH out and that's basically it. I know it's a game of whack-a-mole, but I'm still playing it : )
LinuxBender 4y ago
Blocking DoH is largely whack-a-mole Maybe this is so but I have yet to see it. AFAIK all the DoT/DoH are on known dedicated IP addresses. I know they don't have to be. They could be on generic Akamai/CF/BunnyCDN/etc... end points but I have yet to come across one utilized in the wild. Have you found any? What are their IP addresses? I would like to add them to my DNS timing/monitoring scripts. I null route about 24 DoT/DoH IP addresses and my one smartphone seemed to figure out automagically that my router was serving up DoT on 853. I can tell if something is bypassing Unbound because there are things I know should not resolve correctly.

srcreigh 4y ago

what's the advantage of DoH? I personally use Timescale magicDNS on all my devices, with pihole DNS running on a home server. The magicDNS can make my home server the 1st responder for DNS queries and it'll block a lot of ad domains.

tsimionescu 4y ago
DoH was designed to prevent the network operators from interfering with or snooping on DNS. The stated purpose was to prevent your carrier or country from seeing which domains you access, and/or blocking you from accessing them. However, it also prevents devices like piHole from passively blocking ad requests as easily.

userbinator 4y ago

I venture onto the Asian and Russian parts of the Internet semi-regularly, and in all these years I have seen perhaps one or two sites with IDN that were actually useful to me.

maxerickson 4y ago

I don't do any of that stuff and don't think I am running into nasty websites. What is it supposed to do? I do uBlock origin with pretty standard lists and have a list of allowed persistent cookies. Are the uBlock lists doing all that work in the background?

dngray 4y ago
You're on the right track, perhaps take a look at https://www.privacyguides.org/desktop-browsers/#firefox https://www.privacyguides.org/desktop-browsers/#firefox that's really all.

whiw 4y ago

> (I came up with this one): use a little firewall rule that prevents any IDN from resolving. That's a one line UDP rule and it stops cold dead any IDN homograph attack. Basically searching any UDP packet for the "xn--" string. I couldn't see how to do this in Windows Firewall. Which OS/firewall/rule are you using?