<story><title>The FBI now recommends using an ad blocker when searching the web</title><url>https://www.standard.co.uk/tech/fbi-recommends-ad-blocker-online-scams-b1048998.html</url></story><parent_chain><item><author>TacticalCoder</author><text>Here are a few things I do to combat nasty websites:&lt;p&gt;- blacklists entire domains using wildcards (using an &amp;quot;unbound&amp;quot; DNS resolver and forcing all traffic to my DNS resolver, preventing &lt;i&gt;my browser&lt;/i&gt; to use DoH -- I can still then use DoH if I want, from unbound)&lt;p&gt;- reject or drop a huge number of known bad actors, regularly updated: they go into gigantic &amp;quot;ip sets&amp;quot; firewall rules&lt;p&gt;- (I came up with this one): use a little firewall rule that prevents &lt;i&gt;any&lt;/i&gt; IDN from resolving.  That&amp;#x27;s a one line UDP rule and it stops cold dead any IDN homograph attack.  Basically searching any UDP packet for the &amp;quot;xn--&amp;quot; string.&lt;p&gt;I do &lt;i&gt;not&lt;/i&gt; care about what this breaks.  The Web still works totally fine for me, including Google&amp;#x27;s G Suite (yeah, I know).&lt;p&gt;EDIT: just to be clear seen the comments for I realize I wasn&amp;#x27;t very precise... I&amp;#x27;m not saying all IDN domains are bad! What I&amp;#x27;m saying is that in my day to day Web surfing, 99.99% of the websites I&amp;#x27;m using do not use IDN and so, in my case, blocking IDN, up until today, is totally fine as it not only doesn&amp;#x27;t prevent &lt;i&gt;me&lt;/i&gt; from surfing the Web (I haven&amp;#x27;t seen a single site I need breaking) but it also protects me from IDN homograph attacks.  Your mileage may vary and you live in a country where it&amp;#x27;s normal to go on website with internationalized domain names, then obviously you cannot simply drop all UDP packets attempting to resolve IDNs.</text></item></parent_chain><comment><author>giobox</author><text>While these are all good practices, killing DoH conclusively on your home network is more difficult than you&amp;#x27;ve made it seem, as ultimately all you can really do is use domain blacklists at your firewall. It&amp;#x27;s no longer as straight forward as just control port 53 traffic, not like you can realistically shut down 443... Blocking DoH is largely whack-a-mole and I think is only going to get worse as this and similar techniques spread. There are so many sneaky ways to resolve a hostname an app or device can choose to use now.&lt;p&gt;You can force traditional port 53 DNS protocol traffic to your own resolver with firewall rules, the same doesn&amp;#x27;t work for DoH. a DoH request to a domain your firewall blacklist doesn&amp;#x27;t have looks just like ordinary https&amp;#x2F;443 traffic and will pass unhindered.</text></comment>
<story><title>The FBI now recommends using an ad blocker when searching the web</title><url>https://www.standard.co.uk/tech/fbi-recommends-ad-blocker-online-scams-b1048998.html</url></story><parent_chain><item><author>TacticalCoder</author><text>Here are a few things I do to combat nasty websites:&lt;p&gt;- blacklists entire domains using wildcards (using an &amp;quot;unbound&amp;quot; DNS resolver and forcing all traffic to my DNS resolver, preventing &lt;i&gt;my browser&lt;/i&gt; to use DoH -- I can still then use DoH if I want, from unbound)&lt;p&gt;- reject or drop a huge number of known bad actors, regularly updated: they go into gigantic &amp;quot;ip sets&amp;quot; firewall rules&lt;p&gt;- (I came up with this one): use a little firewall rule that prevents &lt;i&gt;any&lt;/i&gt; IDN from resolving.  That&amp;#x27;s a one line UDP rule and it stops cold dead any IDN homograph attack.  Basically searching any UDP packet for the &amp;quot;xn--&amp;quot; string.&lt;p&gt;I do &lt;i&gt;not&lt;/i&gt; care about what this breaks.  The Web still works totally fine for me, including Google&amp;#x27;s G Suite (yeah, I know).&lt;p&gt;EDIT: just to be clear seen the comments for I realize I wasn&amp;#x27;t very precise... I&amp;#x27;m not saying all IDN domains are bad! What I&amp;#x27;m saying is that in my day to day Web surfing, 99.99% of the websites I&amp;#x27;m using do not use IDN and so, in my case, blocking IDN, up until today, is totally fine as it not only doesn&amp;#x27;t prevent &lt;i&gt;me&lt;/i&gt; from surfing the Web (I haven&amp;#x27;t seen a single site I need breaking) but it also protects me from IDN homograph attacks.  Your mileage may vary and you live in a country where it&amp;#x27;s normal to go on website with internationalized domain names, then obviously you cannot simply drop all UDP packets attempting to resolve IDNs.</text></item></parent_chain><comment><author>eurticket</author><text>Steven Black runs a hosts file on GitHub with regular updates. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;StevenBlack&amp;#x2F;hosts&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;StevenBlack&amp;#x2F;hosts&lt;/a&gt;&lt;p&gt;There are a bunch of file variants to weed out specific bad actors.&lt;p&gt;It&amp;#x27;s well currated though I will disclaimer it has broken a few websites in the past for me. Maybe that&amp;#x27;s a good thing.</text></comment>