5 ms·
It's a hard problem. There are valid use cases for mixing characters from different alphabets. They'd need to detect malicious mixing without creating a prohibi
by pluma 10y ago
It's a hard problem. There are valid use cases for mixing characters from different alphabets. They'd need to detect malicious mixing without creating a prohibitive amount of false positives.
IMO it'd be fine if there was an automated flagging mechanism that would require manual review for suspicious domains, though. But good luck getting registrars to do anything more involved than a simple blacklist check.
- roryisok 10y agoSeems like the kind of thing google safe browsing is there for - flagging URLs as malicious. Sure, they have to be discovered first but at least its a start
- azernik 10y agoHomograph detection isn't about prohibiting mixed characters; it's about considering letters that look the same to be the same when checking for existing duplicates.
- nzp 10y agoIt's not that simple. A lot of different characters may or may not look the same depending on the typeface used.
- azernik 10y agoYeah, if I were doing it I'd probably tend to be pretty cautious - if I see any popularly-used typeface that would confuse the characters I'd mark them as homographs. It would absolutely have to be a pretty labor-intensive, manually-maintained database.
- nzp 10y agoAnd thus extremely error prone. I think introducing IDNs at all was a mistake given the (security) cost-benefit tradeoff, and the best solution would be to scrap them but I realize that is unlikely to happen. Domain name script is probably the last place where cultural imperialism needs to be fought, it's just empty PC posturing and a way to extract some more easy money from gullible domain owners.