6 ms·

Kind of surprised at how poorly Google handles this (I would have expected at least a correction suggestion)! Heck, it might open the door for an obscure blackh

• DannoHung 11y ago
  Maybe some sort of extortion scheme? Send an email to a small business person that isn't very technically savvy, say you have just erased all the search results for their business from Google, provide link, demand a Bitcoin to return the results. Maybe a low hit rate, but if you could automate it, you could run the scam on a lot of places.
  • mfoy_ 11y ago
    Similar in theme to that trick of sending strangers that "link to your facebook page" (http://facebook.com/profile.php?=73322363 http://facebook.com/profile.php?=73322363)
    • jsnider3 11y ago
      Can someone explain how this works?
      • McP 11y ago
        Any invalid ID redirects to your own page, or something like that.
      • blueflow 11y ago
        The variable name before "=" is missing, therefore the given profile id gets ignored. Per default your own profile id is assumed.
• mfoy_ 11y ago
  Not Google, but apparently one way some malware tries to hide edits to, say, the hosts file is to create a duplicate hosts file with the cryllic homoglyph for 'o' and then hide the real hosts file. Presumably this would trick users who would go check "C:\windows\system32\drivers\etc\" but not show hidden files. Seems like a niche subset, but still a neat trick.
• biot 11y ago
  Or for shady SEO contracts. Not hard to guarantee #1 results if the contract spells out the exact (unexpected Unicode) phrase you're guaranteeing.
• bpicolo 11y ago
  Google operates in a bunch of languages, they can't necessarily just assume you're using codepoints on accident.
• andrewflnr 11y ago
  Forget google. Can you do this in domain names?
  • thousande 11y ago
    No, https://en.wikipedia.org/wiki/Domain_name#Technical_requirements_and_process https://en.wikipedia.org/wiki/Domain_name#Technical_requirem... (last paragraph)
    • alister 11y ago
      No, you're mistaken. It is actually a very big problem. Earlier on the same page you linked to, it explain that "ICANN approved the Internationalized domain name system, which maps Unicode strings used in application user interfaces"[1]. As a concrete example, the following are fake links to Wikipedia (and entirely equivalent): http://xn--wkd-8cdx9d7hbd.org http://xn--wkd-8cdx9d7hbd.org (FAKE, same as below) http://www.wіkіреdіа.org http://www.wіkіреdіа.org (FAKE, same as above) It is true that network protocols encode these internationalized domain names in a subset of ASCII, but the user sees Unicode in his browser address bar or email. There is no restriction on how applications (like browsers) display domain names[2]; they can use Unicode if they want. This lead to all sorts of devious attacks[3]. [1] https://en.wikipedia.org/wiki/Domain_name#Internationalized_domain_names https://en.wikipedia.org/wiki/Domain_name#Internationalized_... [2] https://en.wikipedia.org/wiki/Internationalized_domain_name#Internationalizing_Domain_Names_in_Applications https://en.wikipedia.org/wiki/Internationalized_domain_name#... [3] https://en.wikipedia.org/wiki/IDN_homograph_attack https://en.wikipedia.org/wiki/IDN_homograph_attack