[00:00.000 --> 00:04.800]  So, I guess, uh, we're a little, we're definitely early, we're definitely on the clock.
[00:04.880 --> 00:13.080]  Uh, welcome to Speaker Workshops, and now it is the, uh, 210 talk. And, uh,
[00:13.080 --> 00:18.980]  want to say, just have a little bit to say about, uh, our presenters, Sam Erb. So, Sam Erb, uh,
[00:18.980 --> 00:26.940]  just real quick, Councilor 9, and I, uh, also, I, uh, I think you're the very first black badge
[00:26.940 --> 00:33.300]  holder I know personally. Ooh, is, wait, is that a radio, that's radioactive, right? Is that the
[00:33.300 --> 00:38.800]  radioactive one, or thou shall not speak of it? Are we going to light this thing on fire?
[00:49.010 --> 00:51.590]  Uh, without much ado, Sam Erb!
[00:53.930 --> 01:00.870]  Thank you. Um, so, uh, long-time listener, first-time speaker, um, so let's get going.
[01:00.930 --> 01:05.350]  Uh, so, you're going to connect to the wrong domain name, so, um, for whatever
[01:05.350 --> 01:09.630]  reason for the past few years, I've been very interested in domain names, and, uh,
[01:09.630 --> 01:14.430]  this is kind of a look at some of the, um, different ways that you can be tricked,
[01:14.430 --> 01:20.930]  or your computer can be tricked, uh, or you can be phished to connect to, uh, the wrong domain name.
[01:20.990 --> 01:28.290]  Um, so, uh, a bit about myself, uh, software engineer, I work at a cool company called Akamai,
[01:28.290 --> 01:33.690]  uh, we're hiring people like you, I have to say that, uh, and, uh, I have a, uh,
[01:33.690 --> 01:37.570]  Defcon23 and Defcon24 Uber Black Badge with the Council of Nine.
[01:37.930 --> 01:41.730]  Um, yeah, that's me at closing ceremonies since last year.
[01:42.290 --> 01:47.830]  Um, a disclaimer, uh, the opinions expressed here are my own, and no one was phished in
[01:47.830 --> 01:51.210]  the creation of this presentation, which will become a bit more obvious later on.
[01:52.330 --> 01:58.070]  Um, yeah, so I'm going to start out from kind of least severe and kind of build up from there.
[01:58.210 --> 02:02.170]  Um, and so, just to get going, um, we have to start out with typosquatting.
[02:02.170 --> 02:06.250]  Humans aren't perfect, they're going to connect, they're going to mistype the domain name they
[02:06.250 --> 02:11.950]  type in, um, and a malicious person could register these and, uh, trick somebody into
[02:11.950 --> 02:13.750]  entering their bank credentials, for instance.
[02:14.670 --> 02:21.070]  So this example here is looking at all the one-keyboard-letter-off variants of americanexpress.com.
[02:21.370 --> 02:25.490]  If you actually look up the registration status of each of these, um, like the example here
[02:25.490 --> 02:29.250]  is qamericanexpress.com, all but two of them are actually currently registered,
[02:29.250 --> 02:32.350]  or actively registered, as of April, I believe.
[02:33.930 --> 02:38.610]  I did all this, most of the research here in April 2017, so that's roughly when all
[02:38.610 --> 02:39.630]  this data's from.
[02:42.910 --> 02:46.810]  So the reason why I chose americanexpress here is that it's long enough that no one's
[02:46.810 --> 02:51.550]  company name is going to be qamericanexpress.com, whereas with a shorter website, you might
[02:51.550 --> 02:56.850]  get some legitimate websites, whereas I could argue that none of these are actually legitimate.
[02:58.570 --> 03:02.210]  So, building up from there, we have to look at bit squatting.
[03:02.350 --> 03:05.950]  This is one where your computer is actually going to get the domain name wrong by flipping
[03:06.090 --> 03:06.750]  a bit.
[03:07.490 --> 03:12.950]  The example I gave here is I swapped a bit on Google Analytics, and I end up with Eagle
[03:12.950 --> 03:14.110]  Analytics.
[03:15.630 --> 03:22.610]  This is a very low-probability event, but as most phones and personal electronic devices
[03:22.610 --> 03:26.830]  don't have error-correcting memory, this happens at a non-zero rate across the internet.
[03:28.210 --> 03:32.890]  So, in order to give a demo for this talk, I actually wanted to register one of these
[03:32.890 --> 03:38.730]  domains, and so I actually searched for the 1-bit variants of GoogleAnalytics.com.
[03:39.810 --> 03:44.250]  Part of the reason for looking at GoogleAnalytics.com is you want a website that people are going
[03:44.250 --> 03:46.710]  to visit a lot, but not mistype.
[03:47.210 --> 03:50.750]  Google Analytics falls in that, as do most CDNs.
[03:51.630 --> 03:54.890]  When I searched for domains, this was the only one available.
[03:55.650 --> 04:03.430]  So, I went ahead and registered it, and I put up a server on it and got a TLS certificate
[04:03.430 --> 04:04.470]  for it.
[04:04.530 --> 04:08.150]  And within 24 hours, I saw two what I would call hits.
[04:08.150 --> 04:10.570]  One HTTP, one HTTPS.
[04:11.350 --> 04:20.100]  This is one Android browser and one Android application actually connecting to my server.
[04:20.490 --> 04:24.530]  If you actually go and look at the source website of where this came from,
[04:24.530 --> 04:29.890]  the source website says GoogleAnalytics.com, but something within their phone caused a
[04:29.890 --> 04:34.290]  bit to flip in such a way that they went to the wrong website.
[04:35.730 --> 04:37.830]  Now, one other thing, when I actually...
[04:37.830 --> 04:43.230]  So, with a very popular website, from what I've seen, this is about what to expect.
[04:43.230 --> 04:46.790]  You'll get a few random hits per day.
[04:46.790 --> 04:49.490]  Once I got these hits, I actually took this down.
[04:49.490 --> 04:53.850]  But when I turned on this website, I immediately was getting spammed by this one very particular
[04:53.850 --> 04:54.250]  domain name.
[04:54.250 --> 05:01.090]  So I went to it, and it was actually a Swedish diving company's website had somehow managed
[05:01.090 --> 05:06.190]  to mess up their Google Analytics tag to point to my website.
[05:06.330 --> 05:09.810]  So every person that was visiting their website was also connecting to this.
[05:10.630 --> 05:13.350]  That's a picture of the code at the bottom there.
[05:13.350 --> 05:18.330]  It's a little bit hard to read from a distance, but it's pointing to EagleAnalytics.com.
[05:20.690 --> 05:21.650]  Yeah.
[05:25.310 --> 05:29.650]  So that's just an example of how to do this.
[05:30.930 --> 05:34.230]  If you're looking for more information on this, there's actually a really great white
[05:34.230 --> 05:36.370]  paper that Cisco put out.
[05:36.370 --> 05:39.670]  And I believe it's actually on DefCon.org, if you search for it.
[05:41.790 --> 05:43.510]  Or sorry, no, that's something later.
[05:43.510 --> 05:44.590]  I'm getting these confused.
[05:44.790 --> 05:47.530]  There was a talk at DC19 on this, I believe.
[05:47.530 --> 05:48.410]  That's what it was.
[05:49.390 --> 05:49.930]  Yeah.
[05:50.570 --> 06:10.590]  And so, being familiar with BitSquadian, I wanted to look at some other variants of
[06:10.590 --> 06:11.430]  BitSquadian.
[06:11.430 --> 06:16.650]  And one thing that I noticed is that there have been some recent registered top-level
[06:16.650 --> 06:21.170]  domain names, or TLDs, that actually BitSquad on other TLDs.
[06:21.410 --> 06:29.530]  So in this case, the registrar requested .got, which BitSquad's .gov.
[06:29.530 --> 06:35.210]  I reported that one in April of 2016 to the registrar, and they claimed to have implemented
[06:35.410 --> 06:35.930]  a fix.
[06:36.910 --> 06:40.270]  It's not actually testable right now, because you can't actually register those domains.
[06:40.270 --> 06:44.930]  But that's a very tractable problem, because there's a limited number of .gov websites.
[06:44.930 --> 06:50.230]  However, a recent one, which is .bom, actually BitSquads all of .com, which is a much more
[06:50.230 --> 06:53.730]  intractable problem, as there are a large number of .com domain names.
[06:55.690 --> 06:59.830]  A funny thing about .bom is that it was actually objected to by VeriSign, because it looks
[06:59.830 --> 07:04.710]  too similar to .com, and that objection was overruled, but it also BitSquads on .com,
[07:04.710 --> 07:06.110]  which is very unfortunate.
[07:07.150 --> 07:13.370]  I know it didn't report that one, as I'm not sure what value there would be from reporting
[07:13.370 --> 07:13.990]  that.
[07:19.110 --> 07:23.950]  This is actually something that was mentioned in the Cisco white paper, but these are more
[07:23.950 --> 07:26.130]  recent TLDs from that point.
[07:33.050 --> 07:37.290]  BitSquatting, like I said before, it only really targets random end-users.
[07:37.290 --> 07:40.850]  You can't really target a specific user with it, but you could target a user base, such
[07:40.850 --> 07:42.490]  as a bank.
[07:42.490 --> 07:45.470]  If you could only steal a few credentials per day, that could still be a lot of money.
[07:45.470 --> 07:51.350]  Or if you're BitSquatting a .gov website, that could get you a few inbound emails to
[07:51.990 --> 07:54.970]  intelligence agency per day, which could be significant.
[07:57.910 --> 07:59.330]  Going to the next slide...
[08:01.110 --> 08:03.490]  I'm getting a bit more serious.
[08:05.090 --> 08:10.190]  A lot of the reason why I gave this talk, actually, is I wanted to look at IDN homoglyphs.
[08:10.190 --> 08:15.890]  Homoglyphs are two characters that look the same, but have different meanings.
[08:16.570 --> 08:20.410]  IDN is an internationalized domain name, which is something that, if you're an English language
[08:20.410 --> 08:23.710]  speaker, you might not come across very often.
[08:26.570 --> 08:34.830]  Depending on your browser, you'll either see their source piny code, which is xn dash dash,
[08:34.830 --> 08:38.290]  or the ASCII equivalent of that.
[08:39.070 --> 08:48.510]  Piny code is a way to encode a larger character set into a smaller space.
[08:48.510 --> 08:52.250]  In the format that's used, you have the xn dash dash identifier.
[08:52.710 --> 09:01.690]  This is all standardized, followed by the English alphabet letters, or standard letters,
[09:01.690 --> 09:03.890]  followed by a dash, followed by...
[09:06.270 --> 09:10.470]  There's a standardized algorithm for actually computing what comes after that.
[09:11.630 --> 09:13.850]  There's an RFC on it and everything.
[09:14.490 --> 09:17.170]  I'm not going to give a great explanation of that, so I won't.
[09:17.810 --> 09:20.130]  With that, you can end up with a...
[09:20.130 --> 09:23.930]  That same machine will determine which letter and what location it will get placed into the
[09:25.190 --> 09:26.750]  URL that gets rendered.
[09:28.510 --> 09:30.790]  I gave two examples here.
[09:31.430 --> 09:33.770]  These are actually both registered domain names.
[09:33.770 --> 09:38.030]  Google.com, where both the O's are Cyrillic O's.
[09:39.530 --> 09:41.830]  I believe they're Cyrillic O's.
[09:41.830 --> 09:43.190]  It might be Latin, sorry.
[09:43.590 --> 09:48.290]  And Time.com, where every letter is actually from the Cyrillic alphabet.
[09:51.270 --> 09:52.910]  I'll show you how I found those later.
[09:52.910 --> 09:55.450]  Those are both actually registered domain names.
[09:58.270 --> 10:01.570]  I wanted to conduct a survey of existing homoglyphs
[10:02.230 --> 10:04.930]  and IDN domain names against popular.com domain names.
[10:04.930 --> 10:08.570]  I wanted to look for people who were impersonating .com domain names.
[10:08.570 --> 10:14.490]  I chose to focus on .com, as that's where most of the popular English language websites are.
[10:14.650 --> 10:17.710]  I only speak English, so I'm very limited there.
[10:17.890 --> 10:20.930]  There's really three options if you want to gather a large number of domain names.
[10:21.010 --> 10:24.250]  One is you could get the zone files for .com.
[10:24.250 --> 10:28.230]  That requires filling out a form, which really isn't that fun.
[10:28.630 --> 10:31.510]  And some of the zone files are actually impossible to acquire,
[10:31.950 --> 10:35.750]  such as North Korea's, who actually leaked, I believe, last year.
[10:36.650 --> 10:40.670]  You could go to Certificate of Transparency, which is a log of certificates.
[10:41.850 --> 10:43.370]  Or you could go to a third party.
[10:43.370 --> 10:44.950]  And there are third parties where you could pay a few hundred dollars
[10:44.950 --> 10:47.690]  and get a list of domain names, but that isn't that fun either.
[10:47.690 --> 10:49.830]  So I chose to go with Certificate of Transparency.
[10:50.070 --> 10:53.170]  And for this, I pulled down the Google pilot log.
[10:53.170 --> 10:55.930]  This contains about 100 million certificates.
[10:56.590 --> 11:01.170]  That's 96.5 million domain names, roughly.
[11:01.170 --> 11:04.290]  This is also completely searchable if you go to cert.sh.
[11:05.010 --> 11:08.310]  Certificate of Transparency, if you haven't heard of it before,
[11:08.310 --> 11:13.170]  is an initiative to log every publicly trusted certificate on the internet.
[11:13.910 --> 11:16.410]  It's largely a Google initiative.
[11:18.190 --> 11:21.730]  But there are logs hosted by other companies.
[11:21.730 --> 11:25.550]  I chose the Google pilot log, simply as it's the largest right now.
[11:30.390 --> 11:32.590]  There's another reason that I wanted to use Certificate of Transparency.
[11:32.590 --> 11:37.270]  If a certificate was registered, that means it's far more likely to have been used.
[11:38.810 --> 11:41.810]  Especially with the bit-squatting and typo-squatting domain names,
[11:41.970 --> 11:44.750]  a large number of these are registered but never actually utilized,
[11:44.750 --> 11:46.030]  which I found interesting.
[11:49.530 --> 11:51.590]  In order to use the CT log, I built a pipeline.
[11:51.590 --> 11:58.230]  I pulled out the common domain and subject-alternative domain fields from that.
[11:58.230 --> 12:02.430]  I then filtered out all of the PunyCode domain names.
[12:04.010 --> 12:07.950]  There's a great Python library called unidecode-package,
[12:07.950 --> 12:12.990]  where somebody actually went through and said what each Unicode character looks like,
[12:12.990 --> 12:17.010]  what its ASCII equivalent looks like,
[12:17.010 --> 12:19.370]  and actually went through character by character and did that,
[12:19.370 --> 12:21.190]  which is a great amount of work.
[12:21.190 --> 12:22.310]  It's very impressive.
[12:23.290 --> 12:30.310]  So that maps ASCII letters to what looks like their English equivalent.
[12:30.470 --> 12:34.710]  I then cross-referenced that list with the Alexa top 1 million domain names.
[12:34.910 --> 12:40.650]  At the end of the day, I got 1900 CT certificates that impersonated
[12:42.490 --> 12:45.030]  the Alexa top 1 million domain names.
[12:45.030 --> 12:50.030]  I then also went ahead and modified the Chromium unit test
[12:50.650 --> 12:53.870]  to check whether or not they would actually be rendered as PunyCode
[12:53.870 --> 12:57.170]  or whether an end user would see xn dash dash.
[12:59.210 --> 13:04.890]  In Chrome and Firefox right now, that test is actually standardized across all languages,
[13:04.890 --> 13:06.970]  so this would be applicable to all end users.
[13:07.470 --> 13:11.670]  In other browsers, I believe Internet Explorer or Microsoft
[13:11.670 --> 13:16.610]  will take into account your local language to determine whether or not
[13:16.610 --> 13:19.670]  you actually render the PunyCode variant.
[13:20.950 --> 13:23.050]  I've actually posted that list online.
[13:23.350 --> 13:27.450]  There are a few false positives in there, like there are valid websites.
[13:27.590 --> 13:34.170]  They just simply happen to look like their English equivalent website,
[13:34.170 --> 13:39.930]  but I chose to include those as I didn't want to actually filter all of these.
[13:42.510 --> 13:45.510]  What is much more interesting is actually showing the results.
[13:46.070 --> 13:48.570]  These are all real domain names.
[13:48.570 --> 13:50.910]  I would encourage you not to visit any of these.
[13:52.090 --> 13:55.610]  There are some really bad ones in here in that list, unfortunately,
[13:55.610 --> 13:58.050]  and I spent a decent amount of time actually reporting phishing websites
[13:58.050 --> 14:00.810]  to the Google phishing page.
[14:04.370 --> 14:09.710]  These are just some of the worst ones that I saw grouped by what character they used.
[14:10.430 --> 14:17.470]  There's a Latin small letter K, and the L with a stroke looked pretty bad,
[14:17.470 --> 14:21.450]  and then the dotless I was one of my personal favorites.
[14:21.450 --> 14:23.410]  I didn't know that was actually a thing before this.
[14:23.850 --> 14:25.550]  That's actually part of the reason why I took this approach,
[14:25.550 --> 14:31.330]  was I'm not an ASCII expert, if there even is such a thing.
[14:31.550 --> 14:37.190]  I really tried to go about finding the worst abusers
[14:37.190 --> 14:40.890]  without having to necessarily have a knowledge of ASCII in the first place,
[14:41.730 --> 14:43.950]  or knowing which letters to look for.
[14:48.290 --> 14:51.830]  As expected, the most popular websites towards the top of the list
[14:51.830 --> 14:54.410]  were much more likely to actually be impersonated.
[14:55.210 --> 14:57.370]  One of the more interesting things that I saw,
[14:57.370 --> 14:59.970]  which actually bypassed the Chromium check.
[15:00.670 --> 15:05.770]  The formatting here is the last entry in that field,
[15:05.770 --> 15:07.970]  whether or not it bypassed the Chromium check.
[15:07.970 --> 15:11.490]  In this case, they'd actually be rendered as time.com.
[15:12.170 --> 15:20.070]  They only used Cyrillic characters to represent the English equivalent.
[15:24.090 --> 15:27.910]  A breakdown of the Unicode blocks that I observed while going through this.
[15:29.070 --> 15:32.950]  Latin and Cyrillic are kind of as expected, but there was a long tail,
[15:32.950 --> 15:34.850]  and I really want to call out one at the very end,
[15:34.850 --> 15:39.770]  which is the Canadian Aboriginal Celbic Unicode block.
[15:39.770 --> 15:43.270]  That one really struck me as odd, as I wasn't really familiar with what that was.
[15:43.290 --> 15:46.890]  I went ahead and I looked at that Unicode block,
[15:46.890 --> 15:48.730]  and the characters that are contained in it.
[15:50.730 --> 15:53.570]  I went ahead and made a bunch of sample domain names,
[15:53.570 --> 15:58.530]  and I plugged them into the Firefox and Chrome browser,
[15:58.530 --> 16:01.630]  and they weren't converted to their Unicode equivalent.
[16:02.650 --> 16:05.310]  None of these were actually registered.
[16:06.210 --> 16:10.410]  I simply tested whether or not they bypassed the Firefox and Chromium check,
[16:10.410 --> 16:13.330]  and then went ahead and reported security bugs.
[16:14.690 --> 16:21.310]  The end result of this was that Chromium actually will now not allow
[16:21.310 --> 16:24.770]  the mixture of Canadian Aboriginal Celbic characters and English characters,
[16:24.770 --> 16:25.990]  which they did before.
[16:25.990 --> 16:29.930]  And they're actually working on a much more comprehensive anti-phishing fix,
[16:29.930 --> 16:33.730]  which I believe is still a work in progress.
[16:35.210 --> 16:40.030]  Within Firefox, this check is a bit more interesting,
[16:40.030 --> 16:43.950]  because Canadian Aboriginal Celbics actually fell under this thing called
[16:46.330 --> 16:48.930]  aspirational Unicode blocks, which allowed them to be mixed
[16:48.930 --> 16:53.430]  as part of the standard Firefox profile with their English language characters.
[16:53.990 --> 17:00.890]  And in order to resolve this issue, they simply increased the level of that check
[17:00.890 --> 17:09.110]  to disallow a mixture of English characters and this aspirational character block.
[17:09.390 --> 17:15.070]  And I believe they actually filed a request with some...
[17:15.070 --> 17:17.530]  I'm not exactly sure what agency tracks this,
[17:17.530 --> 17:25.870]  some external request to actually update the rules regarding this aspirational block,
[17:25.870 --> 17:28.290]  as some of the characters do look like English characters.
[17:30.050 --> 17:33.770]  So as was news to me and the Firefox and Chromium engineers,
[17:33.770 --> 17:35.930]  who actually were working on the fixes for these,
[17:35.930 --> 17:38.530]  you can't actually register any of these domain names.
[17:39.090 --> 17:42.030]  And this is where, believe it or not, policy comes to the rescue.
[17:42.090 --> 17:45.230]  When you try to register any of these domains,
[17:45.230 --> 17:46.750]  you're stopped.
[17:51.090 --> 17:54.590]  The reason for this is that VeriSign actually has a policy
[17:54.590 --> 18:01.590]  that you can't mix Canadian original syllabic characters with certain other characters,
[18:01.590 --> 18:03.650]  which includes English language characters.
[18:03.650 --> 18:08.710]  And they have this for every Unicode block, which I was completely unfamiliar with.
[18:08.810 --> 18:10.430]  One of the more interesting things about this
[18:10.430 --> 18:13.050]  is when I actually tried to register these domain names,
[18:13.050 --> 18:17.050]  because this is a failure at such a late stage in the registrar process,
[18:17.050 --> 18:19.010]  most registrars actually took my money.
[18:19.110 --> 18:21.690]  And in one case, I actually had to fight to get it back.
[18:22.170 --> 18:23.530]  I wasn't the biggest fan of that.
[18:25.610 --> 18:29.090]  So I kind of walked through three different examples of different ways that
[18:31.270 --> 18:34.190]  you or your computer could connect to the wrong domain name.
[18:34.430 --> 18:37.110]  So now we're just going to look at personal mitigations.
[18:37.630 --> 18:39.790]  I'm kind of preaching to the choir here.
[18:40.490 --> 18:42.930]  So the reason to use a password manager is simply because
[18:42.930 --> 18:45.890]  your computer won't be confused by any of this.
[18:46.470 --> 18:50.450]  However, if you actually own or are responsible for any popular domain name,
[18:50.450 --> 18:53.630]  it's probably worth looking into whether or not somebody's impersonating you.
[18:53.770 --> 18:57.510]  You could actually file an ICANN complaint and issue a takedown request,
[18:57.510 --> 18:59.470]  especially if your trademark's being violated.
[19:00.190 --> 19:07.710]  And if you work in IT or are at all curious,
[19:07.710 --> 19:10.690]  I would be... something that's worth checking is what happens
[19:10.690 --> 19:14.830]  when you plug these into your email client.
[19:14.830 --> 19:15.950]  What renders.
[19:18.610 --> 19:20.810]  Yeah, that's probably going to depend on the email client.
[19:24.350 --> 19:31.090]  So as I had the super transparency log, I went ahead and just had some fun with it.
[19:31.090 --> 19:33.330]  I graphed the key types over time.
[19:33.330 --> 19:40.470]  RSA 2K keys dominate, followed by ECJSA P26 keys, and then RSA 4K keys.
[19:42.610 --> 19:45.710]  There was also this fun long tail, which proves that
[19:46.850 --> 19:53.090]  when you give users options, you can always trust them to be consistent.
[19:53.630 --> 19:57.430]  Some of my favorite ones in there is somebody actually issued an RSA 500 key,
[19:58.130 --> 20:00.570]  and there's also an RSA 2600 key as well.
[20:03.010 --> 20:07.830]  And at the very end there, there's a DSA 512 key, which is really unfortunate.
[20:10.370 --> 20:18.270]  So we actually have an intern this year within my company who's actually looking more into this.
[20:18.530 --> 20:22.910]  And if you're at all interested in this, I'll publish a link to it on my Twitter feed
[20:24.010 --> 20:28.290]  with much more details on what's actually contained in the super transparency log
[20:28.290 --> 20:30.270]  when you look at the log as a whole.
[20:31.950 --> 20:36.430]  So, yeah, questions.
[20:37.670 --> 20:40.890]  Questions, anyone? If you have any questions,
[20:40.890 --> 20:44.590]  feel free to have the stage and feel free to come to the mic.
[20:44.590 --> 20:45.230]  Feel free.
[20:53.060 --> 20:54.680]  Oh, we got a question.
[21:03.620 --> 21:08.540]  I might have missed something in the beginning, but I think you showed examples of
[21:08.540 --> 21:14.900]  domains that were registered with those mixture of English and non-English characters.
[21:14.920 --> 21:19.420]  And then later you said that that's not allowed. Is that just something that changed?
[21:19.660 --> 21:24.720]  So it depends on which block you're looking for.
[21:24.720 --> 21:29.120]  So the reason why Canadian Aboriginal syllabics actually appeared in this list,
[21:29.120 --> 21:31.820]  I actually went back later and looked at that domain name,
[21:31.820 --> 21:37.340]  and it was two Canadian Aboriginal characters, not mixed with any English characters.
[21:37.740 --> 21:41.800]  But it simply, when it was passed through the Python package,
[21:41.800 --> 21:46.920]  looked like a, I believe it was like a BB character.
[21:47.260 --> 21:48.560]  The characters looked like Bs.
[21:48.560 --> 21:54.520]  And so it looked like bb.com as the English language equivalent.
[21:54.920 --> 21:58.760]  So that's why it actually appeared on this list, but you can't actually register the mixture.
[22:00.380 --> 22:01.500]  Thanks.
[22:03.220 --> 22:06.200]  So regarding the don't click links suggestion,
[22:06.200 --> 22:10.440]  do you have any recommendations for any other mitigation?
[22:11.180 --> 22:16.760]  Like, for example, say there's a 40-character hex thingy at the end of a URL.
[22:16.860 --> 22:19.280]  I don't think most users are going to type in everything,
[22:19.280 --> 22:22.120]  oh, oops, I mistyped the 23rd letter or something.
[22:22.120 --> 22:23.580]  They're just going to copy and paste it.
[22:23.580 --> 22:26.060]  So is there another way?
[22:31.280 --> 22:32.560]  It's a good question.
[22:33.280 --> 22:36.340]  It's really a question of trust, I feel like.
[22:37.220 --> 22:38.560]  Do you trust the recipient?
[22:38.560 --> 22:44.020]  Can you somehow verify that the link is valid in other ways?
[22:45.040 --> 22:46.780]  Or just cut and paste the end of it?
[22:47.200 --> 22:48.560]  And type in the start of it?
[22:49.040 --> 22:51.840]  It's an intractable problem at the end of the day.
[22:51.900 --> 22:52.220]  Right.
[22:52.420 --> 22:53.580]  Okay, thanks.
[22:55.800 --> 22:57.640]  Once again, Shamrp, everyone!
[22:57.660 --> 22:58.420]  Shamrp!