3 ms·
Firefox: open about:config, set network.IDN_show_punycode to true. Next time you open the page, the address bar will show https://www.xn--80ak6aa92e.com/ https:
by walrus 9y ago
Firefox: open about:config, set network.IDN_show_punycode to true. Next time you open the page, the address bar will show https://www.xn--80ak6aa92e.com/ https://www.xn--80ak6aa92e.com/ instead of https://www.apple.com/ https://www.apple.com/. Better yet, always type in or bookmark pages where you might enter sensitive information.
I was surprised this was still an issue, as I heard about IDN homograph attacks years ago.
- TeMPOraL 9y agoIDN homograph attacks are old, but - as the original article shows - people are still vulnerable to this when you manage to make a full name homograph entirely within one language in Unicode. The only fixes for it that come to my mind are dropping IDN altogether, disambiguating homographs on IDN level, or... disambiguating Unicode.
- inetknght 9y agoUltimately the problem is related to Unicode. So let's disambiguate that.
- pasta 9y agoThis is strange. Maybe 7 years ago I tested this in all browsers and the only browser that didn't show the punycode was Internet Explorer. Now I'm on Firefox and was fooled by the link. Thanks for the about:config.
- noja 9y agoMaybe the non-ascii characters could be coloured somehow, like with a different colour background. That way we could still show the real characters and not the punycode.
- Operyl 9y agoBut how would one mass-educate all the non-technical users on this? It'd be a dirty little inside secret.
- deleted 9y ago[deleted]
- khedoros1 9y agoI mentioned that in the last thread we had about this. You'd have to be careful with the palettes for the colorblind, and the blind would need screenreader updates, I guess. Some kind of clear, visual indication does make sense to me, though.
- smsm42 9y agoIf you color ASCII with one color and all the rest of characters with another, there still can be cross-charset spoofing. Just not if ASCII domain is the one being spoofed, but the whole point of IDN was to enable people to create non-ASCII domains, so the "solution" that does not work for all non-ASCII domains is not a solution that is compatible with IDN.
- awqrre 9y agoWhy would Mozilla think that it would be a good idea to set the default to false... at least in the English language.