tl;dr: Namecheap configured Domain Privacy on my domain, which isn't allowed by my Registry (.in), and then suspended my domain coz the whois info was redacted.
The multiplier comes from being able to design arbitrary fast feedback loops - Claude wrote Python scripts to do decompilation matching for itself, and then use Frida traces from the original as a verification harness.
There are a lot of other implementations of this idea that don't necessarily rely on trust-on-first-use. The securedrop team explicitly includes malicious JS served by the primary-domain in the threat-model and made WEBCAT[0] as an outcome of that research. Their article on webcrypto is much better than this one.
The solution obviously is to go out-of-band:
> When a user visits a website that has enrolled in WEBCAT, before the site can load the content is checked against a signed manifest to ensure that it has not been tampered with (more on enrollment later). If everything checks out, the page loads normally. If, however, any content does not match what’s expected, the page load is aborted and a warning is displayed, protecting the user from potentially malicious content before it can execute.
I wonder how they detect it, is it for known IOCs that they've already found elsewhere, or do they have heuristic detection that flags things that might need further investigation.
I always thought these TLDs were a flight risk to be used in any serious capacity. What if the random state decides you/your business are in violation of [whatever] and kick you off?
The owners of `queer.af` thought that AF only meant “as f*ck”, without realizing that AF also happens to the be the ISO 3166 code for a country controlled by the Taliban, who didn’t like their domain name [1].
Brits that had `.eu` domains lost their domains due to Brexit [2] (unless they had some other EEA ties).
And if the Chagos deal goes ahead [3] and the British Indian Ocean Territory ceases to exist, then all `.io` domains might disappear too (although considering that `.su`/Soviet Union domains are still a thing, they probably would have stayed around).
Assuming the British/American air base remains on some agreement with the Mauritian government, then the Chagos Islands may remain as a special territory of Mauritius, justifying the continual existence of an ISO 3166 code for it.
Actually, Diego Garcia (the British/American military base) already has it's own ISO 3166-1 alpha-2 code, DG: [1]
It's "Exceptionally reserved" "at the request of International Telecommunication Union (ITU)".
Although my gut feeling is that if the deal happens, Mauritius would probably ask to exceptionally reserve `IO` as well. Still, I'm not sure if I'd risk using a `.io` domain since it's not guaranteed.
I wrote superbright to be able to force it: https://github.com/captn3m0/superbright (fork of BrightIntosh). The display does get hit after 10-15 minutes of this though.
Yeah, that's one of those third-party apps, though not one that I've seen before -- but it has the same issue of just plain feeling weird. At the end of the day, a hacky solution is a hacky solution, but I honestly can't wait until OLED makes the backlight obsolete.
tl;dr: Namecheap configured Domain Privacy on my domain, which isn't allowed by my Registry (.in), and then suspended my domain coz the whois info was redacted.
I know a few other people that were impacted.
reply