3 ms·
>I suppose one solution would be, when IDN is detected, to show both the Unicode and Punycoded versions: That looks like the best solution. The security certif
by Zuider 10y ago
>I suppose one solution would be, when IDN is detected, to show both the Unicode and Punycoded versions:
That looks like the best solution. The security certificate of the site shows the punycode version of the URL. If the address bar URL and the certificate URL are different, then, at least for addresses in English, that should raise an alarm.
- userbinator 10y agoIf the address bar URL and the certificate URL are different, then, at least for addresses in English, that should raise an alarm. There's a mention below ( https://news.ycombinator.com/item?id=14119826 https://news.ycombinator.com/item?id=14119826 ) that some browsers will show the IDN in the certificate too, presumably because it would otherwise be equally confusing if they didn't match (they do match.) This isn't a problem that can be solved without showing both the IDN and punycode.
- beaconstudios 10y agono-one checks the certificate readout - it'd have to be inline for regular users to see any benefit.
- usrusr 10y agoThe least-impact visualisation could be using colors: group the characters in the domain name by script family, then use regular colors for the largest group (so that e.g. an all-Korean domain name would look just fine) and highlight those exotic relative to the rest.
- beaconstudios 10y agoor maybe just disallow mixed-charset domains. After all there's not much use for a domain that's partially Cyrillic and partially Latin. Not that I'm aware of anyway - and the rule could be more granular if there are legit uses.
- 01000001 10y agothis makes a lot of sense
- Prego 10y agoNo it doesn't. You can do this within the entire Cyrillic character range.
- krallja 10y agosee https://news.ycombinator.com/item?id=14120372 https://news.ycombinator.com/item?id=14120372 - this example uses all-Cyrillic
- beaconstudios 10y agothe point is that is reduces the number of potential variations. There would only be 1 or 2 possible visually-identical phishing domains for any latin domain, as opposed to potentially hundreds or thousands as it stands now.