I hate that Google is exerting even more control on the internet with their TLD, but I don’t really think this attack is made all that much worse with .zip TLD. I can already bury a .com
in a long URL and end it in .zip just fine like so:
https://github.com∕foo∕bar∕baz@example.com/foo/bar/baz.zip
Or even use a subdomain to remove the @:
https://github.com∕foo∕bar∕baz.example.com/foo/bar/baz.zip
The truth is most people don’t look much at URLs outside of a domain to verify its authenticity, at which point the .zip
TLD does not do much more harm than existing domains do.
For mitigation, Firefox already doesn’t display the username portion of the URL on hover of a link and URL-encodes it if copy-pasted into the url bar. It also displays the punycode representation when hovering or navigating to the second example.
Edit: looks like lemmy now replaces 0x2215
which is a character that looks like forward slash with an actual forward slash, so my comment is a bit more confusing. For clarity, the slashes before example.com
in the above urls were 0x2215
and not “/”.
It is likely not worth your effort as whatever you come up with will likely result in discord deactivating your account for breaking their ToS, or them breaking their API forcing you to constantly play catch-up.
This is why open communication protocols are so important. Email is still as ubiquitous as it is because it’s a protocol, not an API.
I personally think it would be less overall effort to get your friends to switch to an open protocol like matrix, or XMPP than it would playing cat and mouse with proprietary APIs. But you do you, I wish you the best of luck!