3 ms·
unicode in domains is tricky; on the one hand; it's good that we can allow people whom have non-ascii characters in their language to create domains using them,
by NKCSS 10y ago
unicode in domains is tricky; on the one hand; it's good that we can allow people whom have non-ascii characters in their language to create domains using them, but it introduces the problems pointed out here. It would be sane to say that, when you abuse the system to trick people (as is clear with the google and lifehacker examples), that the registration is voided (and barred from future use).
Maybe it should be restricted to certain TLD's though; e.g. only allow the unicode characters in TLD's that have a good reason for using them. That way, it won't be an issue for .com/.net/etc.
- garblegarble 10y agoI always thought that enforcing domain names use characters in the same glyph subset would solve a lot of problems - either all Latin or all Cyrillic, etc. (although I don't have any experience of what people put in their internationalised domain names so maybe that would conflict with a key use case somehow?)
- 3pt14159 10y agoOr you could also enforce that all characters that look similar become unavailable. For example, thèta.com might be a French fighter jet company, while théta.com could be very easily confused as the same thing, especially to non-French speakers. So I think registering that weird version of google.com should never have been possible, since the Gs could obviously be confused by a layman. Also, in general I think web browsers need to be more machine learning backed. The browser should warn you when you're about to do something dumb or when you're reading lie-based propaganda. We're trying to teach laymen to be intelligent enough to check for HTTPS and to be discerning enough to figure out what news is false, but I don't think a majority of our population is able to do so.
- syberspace 10y agowhy yes, let's cram machine learning into everything so people don't have to learn anymore. Learning is boring and takes so much time. /s I don't understand the love for voluntary infantilism. Why is it such an impossibility to have to learn a system before using it? I don't think anybody here would argue that using a keyboard is too difficult. But couldn't we just back it with machine learning and let that algorithm figure out what we want to type when we just hit random keys?
- Bjartr 10y agoYou say that in jest, but that's basically what the Swype keyboard does, ML and all.
- 3pt14159 10y agoI don't love it, but I'm a realist. People have shown time and time again that they get sucked into stupid conspiracy theories and anti-intellectualism. They don't know basic facts like who is the VP of the USA or the leader of the UK. At some point informed people just throw up their hands and start making it harder for people to hurt themselves or others.
- BrandoElFollito 10y agoSorry but the Vice-President of the US is some peripheral guy or gal for us who are not in the US. Sure, the POTUS is obviously one of the key people in the world but the VP is not. I belive that not much people will know who the president of Italy or Germany is. In Europe we know (*conditions apply) but I would not expect anyone outside our region to have heard about Mr Gauck.
- drzaiusapelord 10y ago>I don't understand the love for voluntary infantilism. Because people seek leisure and ease and going against that means the competitor who recognizes this is going to beat you. Also on a more pedantic front, did you write your own operating system or create your own cpu? What does "learning the system" mean here? Its arbitrary. Even a hard code dev today would seem like a child to the guys in the 60s who had to do literally everything by hand. >I don't think anybody here would argue that using a keyboard is too difficult. Ever watch someone learn a keyboard for the first time? Its painful. The common layouts are questionable and lots of keys are extraneous. I dont need a sysrq or break key, thanks. Look at mobile. When I use a mobile device I either use voice or a swipe keyboard. When I'm at home I use my Google Home and Amazon Fire via voice instead of a hunt and peck virtual keyboard. Keyboards are actually fairly terrible, but right now for a lot of tasks are the least of the worst.
- NamTaf 10y agoThat doesn't really help, though, because now you ask eg: a Cyrillic speaker to use Latin characters in place of their own characters that are different but simply look the same. That's like us expecting Germans to use B instead of ß (I know it's not a close example, but it's the first that came to mind for me) even though ß translates to a 'ss' sound, which is nothing like a B sound. so 'heißt' goes from 'heisst' to 'heibt'. Enforcing all of one subset makes more sense to me, though even that's not foolproof because the above example uses both B and ß in the same language. But at least it'll reduce the attack surface, I guess.
- SeanLuke 10y agoI don't see what the problem is. For example, you could do this: create a string->"final string" hash function, where heißt and heibt both hash to the same final string (let's say it's HEIBT). You're only allowed to register final strings. If I create a company called heißt.com, then going to heibt.com (or HeIbT.com, hêìbŤ.com, or whatever) will also go to that same domain. A company can use heißt.com if it likes, or hêìbŤ.com, or whatever it prefers. But a spammer can't create a lookalike string. Why wouldn't this work?
- OJFord 10y agoYou'd at least be more aware of them though. I don't think I've ever accessed one, and if I ever do it will probably be accidental - something illegitimate like this. If I regularly used a site that legitimately used such a character, I imagine I'd be more in tune to it and less likely to fool for it.
- edent 10y agoSame subset doesn't really help * ɢᴏᴏɢʟᴇ uses all Latin Small Caps * ᏀᎤᎤᏀᏞᎬ uses the Cherokee block * ԌООԌӏЕ uses Cyrillic block Not perfect, but would you notice them in the small type of your typical address bar?
- garblegarble 10y ago>Not perfect, but would you notice them in the small type of your typical address bar? Requiring that all characters come from the same block certainly doesn't solve the problem but it would help make it a little more obvious - your examples above are much easier for me to spot as suspicious vs the ɢoogle.com in the article. I hadn't thought about latin small caps before, that's an interesting one - although perhaps that block could be blacklisted entirely. Overall it's a bit of a mess, isn't it!
- Steko 10y agoSame subset plus identifying flag/icon showing which block is in use?
- vbezhenar 10y agoRestricting to certain TLD's doesn't solve underlying problem, because this problem stays there for those TLD's. There should be better solution.