3 ms·

True, but using visual inspection of the URL is problematic too: Do you mean to be at apple.com or аpple.com ? www.xudongz.com/blog/2017/idn-phishing/

madeofpalk 7y ago
Which, isn't really a problem any more since browsers don't display Punycode any more. https://imgur.com/a/COCrJGy https://imgur.com/a/COCrJGy
- half-kh-hacker 7y ago
  So, if you're a non-English speaker, doesn't this render distinguishability for real IDNs completely useless? Compare http://кто.рф http://xn--j1ail.xn--p1ai and https://дом.рф https://xn--d1aqf.xn--p1ai - If rendered to punycode, they look like this: kto.rf: xn--j1ail.xn--p1ai dom.rf: xn--d1aqf.xn--p1ai To note: Firefox (Nightly) on desktop for me rendered the false Apple domain near-identically to the real Apple, and for the two RF domains, the Cyrillic was used.
  - Macha 7y ago
    Iirc, the rule being used is the IDN gets rendered unless it crosses character sets. So your domain entirely in Cyrillic or Kanji is fine, but mixing them with Latin characters should be a no-no.
    - TazeTSchnitzel 7y ago
      It should be. Unfortunately even really obviously fine cases like Swedish government agencies on the Sweden TLD (försäkringskassan.se), which by the way supposedly has a proper IDN policy that browsers should respect, don't get respected by all modern browsers :(
      - wolf550e 7y ago
        That Swedish domain doesn't have a TLS certificate for their fancy name. Compare: https://www.ssllabs.com/ssltest/analyze.html?d=xn--frskringskassan-2kb71a.se https://www.ssllabs.com/ssltest/analyze.html?d=xn--frskrings... https://www.ssllabs.com/ssltest/analyze.html?d=www.forsakringskassan.se&s=194.71.65.16 https://www.ssllabs.com/ssltest/analyze.html?d=www.forsakrin...
        TazeTSchnitzel 7y ago
        Why should they need one to have the IDN respected?
        wolf550e 7y ago
        I don't know what försäkringskassan.se looks like in modern browsers because it redirects (302) to https://www.forsakringskassan.se/ https://www.forsakringskassan.se/ EDIT: woah HN did a funky thing with a URL in a post to fight against misleading domains! http://försäkringskassan.se http://xn--frskringskassan-2kb71a.se
- neogodless 7y ago
  Looks like this is fixed in Chrome and Edge by default. In Firefox (release 67.0) you have to dig into about:config and flip the switch on network.IDN_show_punycode (this is discussed in the above demonstration article.)
  - madeofpalk 7y ago
    Defined 'fixed'
airstrike 7y ago
huh... Apparently appIe.com takes you to the Amazon page for Apple products through a referral link...

madeofpalk 7y ago

Which, isn't really a problem any more since browsers don't display Punycode any more. https://imgur.com/a/COCrJGy https://imgur.com/a/COCrJGy

half-kh-hacker 7y ago
So, if you're a non-English speaker, doesn't this render distinguishability for real IDNs completely useless? Compare http://кто.рф http://xn--j1ail.xn--p1ai and https://дом.рф https://xn--d1aqf.xn--p1ai - If rendered to punycode, they look like this: kto.rf: xn--j1ail.xn--p1ai dom.rf: xn--d1aqf.xn--p1ai To note: Firefox (Nightly) on desktop for me rendered the false Apple domain near-identically to the real Apple, and for the two RF domains, the Cyrillic was used.
- Macha 7y ago
  Iirc, the rule being used is the IDN gets rendered unless it crosses character sets. So your domain entirely in Cyrillic or Kanji is fine, but mixing them with Latin characters should be a no-no.
  - TazeTSchnitzel 7y ago
    It should be. Unfortunately even really obviously fine cases like Swedish government agencies on the Sweden TLD (försäkringskassan.se), which by the way supposedly has a proper IDN policy that browsers should respect, don't get respected by all modern browsers :(
    - wolf550e 7y ago
      That Swedish domain doesn't have a TLS certificate for their fancy name. Compare: https://www.ssllabs.com/ssltest/analyze.html?d=xn--frskringskassan-2kb71a.se https://www.ssllabs.com/ssltest/analyze.html?d=xn--frskrings... https://www.ssllabs.com/ssltest/analyze.html?d=www.forsakringskassan.se&s=194.71.65.16 https://www.ssllabs.com/ssltest/analyze.html?d=www.forsakrin...
      - TazeTSchnitzel 7y ago
        Why should they need one to have the IDN respected?
        wolf550e 7y ago
        I don't know what försäkringskassan.se looks like in modern browsers because it redirects (302) to https://www.forsakringskassan.se/ https://www.forsakringskassan.se/ EDIT: woah HN did a funky thing with a URL in a post to fight against misleading domains! http://försäkringskassan.se http://xn--frskringskassan-2kb71a.se
neogodless 7y ago
Looks like this is fixed in Chrome and Edge by default. In Firefox (release 67.0) you have to dig into about:config and flip the switch on network.IDN_show_punycode (this is discussed in the above demonstration article.)
- madeofpalk 7y ago
  Defined 'fixed'

airstrike 7y ago

huh... Apparently appIe.com takes you to the Amazon page for Apple products through a referral link...