4 ms·

I recommend setting network.IDN_show_punycode to true in Firefox via about:config. This will help keep you safe from this phishing vector.

• Ndymium 8y ago
  Vivaldi shows domains in punycode by default. I believe this is the only reasonable solution, otherwise browser makers will always be playing catch-up with exploiters.
  • bluejekyll 8y ago
    At that point, how much value is there in supporting Unicode? By only using ascii (punycode), it pretty much eliminates the reason it exists: To allow software to show a domain in someone’s native language. Should we perhaps instead be restricting the domain characters to the glyphs of ascii (rfc1035 compliant) and those glyphs that appear in their locale? Otherwise revert to punycode when the glyphs fall outside those ranges.
    • lmm 8y ago
      > At that point, how much value is there in supporting Unicode? By only using ascii (punycode), it pretty much eliminates the reason it exists: To allow software to show a domain in someone’s native language. Allowing a user to enter a domain in their native language is very much worthwhile, I'd say, even if we revert to ascii for display.
    • tomsmeding 8y ago
      That would still leave e.g. users in a localr with a cyrillic alphabet open to homograph attacks.