week in literacy security

· Week of Oct 3–9, 2026 · Educational digest

Week in literacy

Four short literacy notes from primary protocol, wallet, and consumer-protection sources. Original paraphrases only—link out to read the originals. Educational content only — not investment advice.

1. A name is a pointer that can be re-pointed

The original ENS specification splits naming into a registry that tracks owners, resolvers that answer lookups, and registrars that issue names. Because the wallet looks the name up each time, the address behind a familiar name is whatever its controller set most recently, not what it was when you first saw it.

Literacy takeaway: Read the resolved address, not just the name. New walkthrough: ENS names: what they prove.

Source: ERC-137: Ethereum Domain Name Service - Specification — Ethereum Improvement Proposals (2016-04-04) — https://eips.ethereum.org/EIPS/eip-137

2. Normalization helps, but look-alikes remain

ENSIP-15 sets one canonical form for names and lists the spoofing tricks it has to deal with, such as invisible characters and letters borrowed from other scripts that look identical. The standard itself admits that some valid names can still be visually ambiguous.

Literacy takeaway: A name that “looks right” is not proof. Compare the address too. Related: address poisoning.

Source: ENSIP-15: Name Normalization — ENS Docs (2023-04-03) — https://docs.ens.domains/ensip/15

3. Top search result is not the official site

The FTC describes a company that allegedly bought search ads resembling official bill-payment pages, then added fees people did not expect. Its advice is to scroll past sponsored results or type a known address yourself.

Literacy takeaway: The same habit protects wallet and exchange logins: use a bookmark you saved yourself. See common crypto scams.

Source: Searching online: bill pay impersonators — FTC Consumer Advice (2026-08-17) — https://consumer.ftc.gov/consumer-alerts/2026/08/searching-online-bill-pay-impersonators

4. QR codes hide the destination until you look

The FTC warns that people have found fake QR stickers placed over real ones on parking meters, leading to sites that take money or personal details. It suggests checking the link preview for misspellings before opening it, and changing passwords and reviewing statements if you used a bad code.

Literacy takeaway: A QR code for a wallet address or a “connect” page needs the same domain and address check as a typed link. See how to read a wallet prompt.

Source: See a QR code parked somewhere? Don’t scan it…yet! — FTC Consumer Advice (2026-09-03) — https://consumer.ftc.gov/consumer-alerts/2026/09/see-qr-code-parked-somewhere-dont-scan-ityet

Educational content only — not investment advice. This digest paraphrases public educational pages for literacy. It does not recommend buying, selling, or holding any cryptocurrency or token, and it is not financial, tax, or legal advice.

← All Week in literacy editions · Educational docs