2 ms·
The arguments in that blog feel very much like a Google press release. The main argument against domain confusion is basically that the author doesn't personal
by xg15 4y ago
The arguments in that blog feel very much like a Google press release.
The main argument against domain confusion is basically that the author doesn't personally see it as an issue, underlined with a bunch of strawman arguments of things that could theoretically appear in urls but never do in practice.
But none of that matters, because thanks to forced HSTS, there will surely never ever be a malicious domain on those new TLDs. This is because, though the new domains may make security harder for users, forced HSTS makes security easier for certain other parties which are not users. So users just have to rely on the smooth operation of those theoretical other parties and everything will work out.