5 ms·

Which, isn't really a problem any more since browsers don't display Punycode any more. https://imgur.com/a/COCrJGy https://imgur.com/a/COCrJGy

half-kh-hacker 7y ago
So, if you're a non-English speaker, doesn't this render distinguishability for real IDNs completely useless? Compare http://кто.рф http://xn--j1ail.xn--p1ai and https://дом.рф https://xn--d1aqf.xn--p1ai - If rendered to punycode, they look like this: kto.rf: xn--j1ail.xn--p1ai dom.rf: xn--d1aqf.xn--p1ai To note: Firefox (Nightly) on desktop for me rendered the false Apple domain near-identically to the real Apple, and for the two RF domains, the Cyrillic was used.
- Macha 7y ago
  Iirc, the rule being used is the IDN gets rendered unless it crosses character sets. So your domain entirely in Cyrillic or Kanji is fine, but mixing them with Latin characters should be a no-no.
  - TazeTSchnitzel 7y ago
    It should be. Unfortunately even really obviously fine cases like Swedish government agencies on the Sweden TLD (försäkringskassan.se), which by the way supposedly has a proper IDN policy that browsers should respect, don't get respected by all modern browsers :(
    - wolf550e 7y ago
      That Swedish domain doesn't have a TLS certificate for their fancy name. Compare: https://www.ssllabs.com/ssltest/analyze.html?d=xn--frskringskassan-2kb71a.se https://www.ssllabs.com/ssltest/analyze.html?d=xn--frskrings... https://www.ssllabs.com/ssltest/analyze.html?d=www.forsakringskassan.se&s=194.71.65.16 https://www.ssllabs.com/ssltest/analyze.html?d=www.forsakrin...
      - TazeTSchnitzel 7y ago
        Why should they need one to have the IDN respected?
        wolf550e 7y ago
        I don't know what försäkringskassan.se looks like in modern browsers because it redirects (302) to https://www.forsakringskassan.se/ https://www.forsakringskassan.se/ EDIT: woah HN did a funky thing with a URL in a post to fight against misleading domains! http://försäkringskassan.se http://xn--frskringskassan-2kb71a.se
neogodless 7y ago
Looks like this is fixed in Chrome and Edge by default. In Firefox (release 67.0) you have to dig into about:config and flip the switch on network.IDN_show_punycode (this is discussed in the above demonstration article.)
- madeofpalk 7y ago
  Defined 'fixed'

half-kh-hacker 7y ago

So, if you're a non-English speaker, doesn't this render distinguishability for real IDNs completely useless? Compare http://кто.рф http://xn--j1ail.xn--p1ai and https://дом.рф https://xn--d1aqf.xn--p1ai - If rendered to punycode, they look like this: kto.rf: xn--j1ail.xn--p1ai dom.rf: xn--d1aqf.xn--p1ai To note: Firefox (Nightly) on desktop for me rendered the false Apple domain near-identically to the real Apple, and for the two RF domains, the Cyrillic was used.

Macha 7y ago
Iirc, the rule being used is the IDN gets rendered unless it crosses character sets. So your domain entirely in Cyrillic or Kanji is fine, but mixing them with Latin characters should be a no-no.
- TazeTSchnitzel 7y ago
  It should be. Unfortunately even really obviously fine cases like Swedish government agencies on the Sweden TLD (försäkringskassan.se), which by the way supposedly has a proper IDN policy that browsers should respect, don't get respected by all modern browsers :(
  - wolf550e 7y ago
    That Swedish domain doesn't have a TLS certificate for their fancy name. Compare: https://www.ssllabs.com/ssltest/analyze.html?d=xn--frskringskassan-2kb71a.se https://www.ssllabs.com/ssltest/analyze.html?d=xn--frskrings... https://www.ssllabs.com/ssltest/analyze.html?d=www.forsakringskassan.se&s=194.71.65.16 https://www.ssllabs.com/ssltest/analyze.html?d=www.forsakrin...
    - TazeTSchnitzel 7y ago
      Why should they need one to have the IDN respected?
      - wolf550e 7y ago
        I don't know what försäkringskassan.se looks like in modern browsers because it redirects (302) to https://www.forsakringskassan.se/ https://www.forsakringskassan.se/ EDIT: woah HN did a funky thing with a URL in a post to fight against misleading domains! http://försäkringskassan.se http://xn--frskringskassan-2kb71a.se

neogodless 7y ago

Looks like this is fixed in Chrome and Edge by default. In Firefox (release 67.0) you have to dig into about:config and flip the switch on network.IDN_show_punycode (this is discussed in the above demonstration article.)

madeofpalk 7y ago
Defined 'fixed'