3 ms·
> The only real defense is to glance at the url bar every time you're about to enter your password. With i18n not even that: https://www.theguardian.com/techno
by franciscop 9y ago
> The only real defense is to glance at the url bar every time you're about to enter your password.
With i18n not even that: https://www.theguardian.com/technology/2017/apr/19/phishing-url-trick-hackers https://www.theguardian.com/technology/2017/apr/19/phishing-...
Benign POC: https://www.аррӏе.com/ https://www.xn--80ak6aa92e.com/ (open it and it'll look like a normal "l" in the url box)
- cbr 9y agoBrowser shows https://www.xn--80ak6aa92e.com https://www.xn--80ak6aa92e.com to me, Chrome on Android. What browser are you using that shows non-ascii with .com?
- Macha 9y agoFirefox for android at least shows it as Unicode
- nl 9y agoFirefox on OSX shows it appearing as "www.apple.com"
- pbhjpbhj 9y agoSame, FF54.0 on Ubuntu 17.04.
- franciscop 9y agoI activated it so it would display the punycode. Every major browser up to few months ago would show it as "apple", not sure now. But we know many people cannot just upgrade their browsers, so there must be still many vulnerable browsers out there.
- deleted 9y ago[deleted]
- madeofpalk 9y agoLatest Chrome and Safari shows that as https://www.xn--80ak6aa92e.com https://www.xn--80ak6aa92e.com, no puny code