5 ms·
One common way to defend against a partial (or full) homograph attack is to have clients render IDNs as punycode. The downside is that it kinda pulls the plug o
by egwynn 7y ago
One common way to defend against a partial (or full) homograph attack is to have clients render IDNs as punycode. The downside is that it kinda pulls the plug on non-ascii domains. :-\
- nine_k 7y agoIt has a reasonable workaround: check that all glyphs belong to the same writing system. That is, post.com should have all glyphs from Latin, почта.рф, all glyphs from Cyrillic, and ταχυδρομείο.ελληνικό must have all letters Greek. The fact that the Latin, Cyrillic, and Greek glyphs have same-looking glyphs like o or p is not dangerous if you can't mix them up.
- egwynn 7y agoThat's a cool idea and will normally work, but won't prevent homograph attacks entirely. Identities can still be spoofed if they can be constructed entirely from glyphs in the intersection of two unicode blocks. E.g. `ΝΙΚΕ.ϹΟΜ` and `NIKE.COM`.
- nine_k 7y agoLowercasing them would let the user tell the lowercase L from uppercase i. But I agree, some things may need to be special-cased.