I worked for $company where customer dashboards were set up on a wildcard - https://*.$company.com …

Limit usable characters, and just literally check the page doesn't resolve already before allowing the change. Customers will never be locked out and characters can't impersonate others. If you want to allow some symbols you can either whitelist or check if usernames are an appropriate levenshtein distance away from core names (like say slackbot) and either ban such things or flag to a human "hey this could be an issue". It's fundamentally hard to stop everything, but it's not hard to stop the biggest issues.

Zendesk for example puts their customer dashboards on a direct subdomain of their own main domain. They allow people to use their own domains as well. To use your own domain you have to make it a CNAME for the subdomain that they gave you. https://support.zendesk.com/hc/en-us/articles/4408838571930-... I think it’s better to do like GitHub and Shopify and many others do. Have a separate domain at least that customer pages are made subdomains of. GitHub uses GitHub.com as their own domain, and they use GitHub.io as the pages domain with subdomains for users. Shopify uses Shopify.com for their own site and myshopify.com for customer subdomains. The main advantages of using a separate domain for customers include: - You don’t have as many pre-existing or future subdomains that you want for yourself. (You still need to filter so that people don’t use offensive words or misleading words etc.…

"Don't have colliding fundamentally different namespaces" is not really a hard problem to resolve in this case, though.

You're really going to make excuses for Slack here? 'o'/'о' is just about the easiest possible homograph attack ( https://en.wikipedia.org/wiki/IDN_homograph_attack ) that there is: > When it was his time to leave, McKay swapped out his existing profile picture for one that resembled an angrier version of Slackbot’s actual icon. He also changed his name to “Slackbot.” You can’t just change your name on Slack to “Slackbot,” by the way, as the service will tell you that name’s already been taken. It does work if you use a special character that resembles one of the letters inside Slackbot, though, such as replacing “o” with the Unicode character “о.” And in fact, this exact pair of English/Cyrillic was used in one of the first published homoglyph attacks: https://web.archive.org/web/20200102175251/http://www.cs.tec... back in 2001! In 2022, Slack had a valuation of something like $20b and …