3 ms·
Windows users have a problem. The suggested solution of copying the URL into Notepad to reveal the true 'punycode' address does not work. Both Notepad and Wordp
by Zuider 10y ago
Windows users have a problem. The suggested solution of copying the URL into Notepad to reveal the true 'punycode' address does not work. Both Notepad and Wordpad render the 'punycode' as it appears in the address bar. Similarly for copying and pasting the URL in place, at least on firefox. A Chrome user commented that it did reveal the fake address.
The Scite text editor did reveal the difference:
http://www.ebswift.com/scite-text-editor-installer.html http://www.ebswift.com/scite-text-editor-installer.html
Does it work on any others?
Edit: I am incorrect. Windows and notepad are not the problem. It seems to be a peculiarity of the particular browser I am using, Cyberfox 52.0.4, which is converting the punycode as it is copied.
Edit: It looks like my Anti-virus, Avast is doing the conversion. I tested this on browsers with and without the Avast plugin, and the conversion only occurs on the browsers with the plugin.
- darkhorn 10y agoNotepad++ with ASCII text will help.
- nefitty 10y agoWhen I clicked on the padlock icon of the example site https://www.xn--e1awd7f.com/ https://www.xn--e1awd7f.com/ in Android Chrome, the immediate dialog box showed the real site URL. When I clicked on Details, it showed the certificate as issued to epic.com instead. Wild stuff.
- Zuider 10y agoUsing Cyberfox on windows 10, clicking on the padlock --> more information --> view certificate showed the certificate was issued to www.xn--e1awd7f.com
- zuminator 10y agoNeither Notepad nor Wordpad have any mechanism for converting punycode on the fly -- the copy and paste executes correctly on my box and displays as https://xn--e1awd7f.com/ https://xn--e1awd7f.com/ in both Notepad and Wordpad. You must be somehow copypasting the post-converted url.
- Zuider 10y agoI tried it again with the same result. From the same Copy/Paste, Notepad showed https://www.epic.com https://www.epic.com but Scite showed https://www.????.com/ https://www.????.com/. This demonstrates that I have not copypasted the post-converted URL. Interestingly, pasting the fake address into HN comment box showed https://www.еріс.com/ https://www.xn--e1awd7f.com/ Could it be that notepad now delegates the handling of Unicode to the OS. I tested the above on the latest official release, Windows 10 Creators Update.
- zuminator 10y agoI also have the latest update. Not really sure what to make of this. If you manually type the punycode URL (https://www.xn--e1awd7f.com https://www.xn--e1awd7f.com) into your Notepad or Wordpad and then copy THAT and paste it back on the following line, does it convert?
- Zuider 10y agoManually typing the URL does not result in 'on the fly' conversion. Copying/Pasting from the manually typed URL does not result in a conversion. Copying from the link in your comment above does result in a converted URL. So, you are correct. Notepad is not the culprit. This suggests that the browser is converting the URL before it can be copied, indicating that it converts the punycode rather than rendering it, but refreshing the page does not lead to the real site, so this only happens when copying from the address bar. I am using Cyberfox 52.0.4.
- zuminator 10y agoI agree with your comment below mentioning Cyberfox -- the browser appears to be to blame, not Windows per se. The only question is why your browser is doing that. On both Firefox and Chrome, I am not getting the Unicode inserted into my clipboard, only the actual punycode. In fact, if I attempt to copy the Unicode from the address bar in either browser, it pastes as https://www.xn--e1awd7f.com/ https://www.xn--e1awd7f.com/ in the text editor, not as "epic.com." Edge seems to be completely immune to this exploit; it renders the punycode as punycode in the URL (I suppose it just doesn't "understand" punycode is all.)