4 ms·

Firefox users: be sure to set "network.IDN_show_punycode" to "true" in about:config. Test with the fake Apple domain https://www.xn--80ak6aa92e.com/ https://ww

by miles 7y ago

Firefox users: be sure to set "network.IDN_show_punycode" to "true" in about:config. Test with the fake Apple domain https://www.xn--80ak6aa92e.com/ https://www.xn--80ak6aa92e.com/ . See "Phishing with Unicode Domains" for more information: https://www.xudongz.com/blog/2017/idn-phishing/ https://www.xudongz.com/blog/2017/idn-phishing/ .

deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
graton 7y ago
For the situation in the article it would not have changed anything. As the fake domains were just adding an 's' to the end of the domain. Also I'm not sure what effect that will have for Chinese users. It might make many of their URLs look strange to them. See: https://www.reddit.com/r/firefox/comments/7ul9p3/why_is_networkidn_show_punycode_default_to_false/?st=k3vyesfg&sh=26d84cc0 https://www.reddit.com/r/firefox/comments/7ul9p3/why_is_netw...
- yorwba 7y ago
  I'm not aware of any Chinese websites that don't just use Pinyin for their domain name. Some random person is squatting on http://百度.中国/ http://xn--wxtr44c.xn--fiqs8s/ (百度.中国), but Baidu doesn't seem to care. They use http://www.baidu.com/ http://www.baidu.com/ as their primary address.
  - thaumasiotes 7y ago
    > I'm not aware of any Chinese websites that don't just use Pinyin for their domain name. There are tons. One prominent email provider is a three-digit number. There's a job board at 51job.com. (What's 51job? Read in Mandarin, that would be "wǔ yāo job" [five one "job" (the English word)]. This is felt to sound similar to "wǒ yào job" 我要job [I want a job].)
    - tluyben2 7y ago
      Why is 1 = yāo? It is yi isn’t it?
      - thaumasiotes 7y ago
        一 yi (tone varies based on phonological context) is the ordinary word for 1. 幺 yāo is a common word for 1 when vocalizing a stream of digits. (Such as a phone number / credit card number / account number / etc.) I am told that this originated as a way to easily distinguish 1 from 7 (七 qī) when communicating over a low-quality connection. In the presence of static, yi and qi could sound similar. CC-CEDICT has a good gloss ( https://www.mdbg.net/chinese/dictionary?page=worddict&wdrst=0&wdqb=%E5%B9%BA https://www.mdbg.net/chinese/dictionary?page=worddict&wdrst=... ): > one (unambiguous spoken form when spelling out numbers, esp. on telephone or in military)
        tluyben2 7y ago
        Thanks!
    - yorwba 7y ago
      I should've written "... that don't just use ASCII characters instead of Hanzi." Of course domains using numbers or English words aren't Pinyin, but the point is that they don't require Punycode to represent.
stef25 7y ago
The other day I was browsing a list of all my country's domains and noticed a bunch starting with xn-- and you just made me understand what these are. None of them seem worth phishing for. In some cases when you google the site name, google will show results from sitename.tld and when you visit the site with the show_punycode true, it will actually load pages from the xn-- equivalent. So it looks like the "original" domain isn't even indexed or online at all. In another case both the xn-- and "normal" domain sit side by side on the same server. I guess there's no harm in posting these: cadzandie.be and xn--cadzandi-01a.be. Note there's no ë in the first domain Another strange one is xn--rembours-i1a.be When you type in remboursé.be it actually redirects (?) to the xn-- equivalent. I'm fascinated but having a hard time seeing sense in this.
justAnotherNET 7y ago
It is beyond unacceptable that this bug is 3 years in the wild. Real people have been owned by this idiotic response from mozilla. I’ve used Firefox since it was actually called “Mozilla”. I’ve never been more upset at a decision of theirs than now.
deleted 7y ago
[deleted]

by miles 7y ago

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]

graton 7y ago

For the situation in the article it would not have changed anything. As the fake domains were just adding an 's' to the end of the domain. Also I'm not sure what effect that will have for Chinese users. It might make many of their URLs look strange to them. See: https://www.reddit.com/r/firefox/comments/7ul9p3/why_is_networkidn_show_punycode_default_to_false/?st=k3vyesfg&sh=26d84cc0 https://www.reddit.com/r/firefox/comments/7ul9p3/why_is_netw...

yorwba 7y ago
I'm not aware of any Chinese websites that don't just use Pinyin for their domain name. Some random person is squatting on http://百度.中国/ http://xn--wxtr44c.xn--fiqs8s/ (百度.中国), but Baidu doesn't seem to care. They use http://www.baidu.com/ http://www.baidu.com/ as their primary address.
- thaumasiotes 7y ago
  > I'm not aware of any Chinese websites that don't just use Pinyin for their domain name. There are tons. One prominent email provider is a three-digit number. There's a job board at 51job.com. (What's 51job? Read in Mandarin, that would be "wǔ yāo job" [five one "job" (the English word)]. This is felt to sound similar to "wǒ yào job" 我要job [I want a job].)
  - tluyben2 7y ago
    Why is 1 = yāo? It is yi isn’t it?
    - thaumasiotes 7y ago
      一 yi (tone varies based on phonological context) is the ordinary word for 1. 幺 yāo is a common word for 1 when vocalizing a stream of digits. (Such as a phone number / credit card number / account number / etc.) I am told that this originated as a way to easily distinguish 1 from 7 (七 qī) when communicating over a low-quality connection. In the presence of static, yi and qi could sound similar. CC-CEDICT has a good gloss ( https://www.mdbg.net/chinese/dictionary?page=worddict&wdrst=0&wdqb=%E5%B9%BA https://www.mdbg.net/chinese/dictionary?page=worddict&wdrst=... ): > one (unambiguous spoken form when spelling out numbers, esp. on telephone or in military)
      - tluyben2 7y ago
        Thanks!
  - yorwba 7y ago
    I should've written "... that don't just use ASCII characters instead of Hanzi." Of course domains using numbers or English words aren't Pinyin, but the point is that they don't require Punycode to represent.

stef25 7y ago

The other day I was browsing a list of all my country's domains and noticed a bunch starting with xn-- and you just made me understand what these are. None of them seem worth phishing for. In some cases when you google the site name, google will show results from sitename.tld and when you visit the site with the show_punycode true, it will actually load pages from the xn-- equivalent. So it looks like the "original" domain isn't even indexed or online at all. In another case both the xn-- and "normal" domain sit side by side on the same server. I guess there's no harm in posting these: cadzandie.be and xn--cadzandi-01a.be. Note there's no ë in the first domain Another strange one is xn--rembours-i1a.be When you type in remboursé.be it actually redirects (?) to the xn-- equivalent. I'm fascinated but having a hard time seeing sense in this.

justAnotherNET 7y ago

It is beyond unacceptable that this bug is 3 years in the wild. Real people have been owned by this idiotic response from mozilla. I’ve used Firefox since it was actually called “Mozilla”. I’ve never been more upset at a decision of theirs than now.

deleted 7y ago

[deleted]