3 ms·
For firefox, you can disable IDN in the urlbar with: user_pref("network.IDN_show_punycode", true); in your user.js. Then all URLs will appear in their pun
by Arnavion 6y ago
For firefox, you can disable IDN in the urlbar with:
user_pref("network.IDN_show_punycode", true);
in your user.js. Then all URLs will appear in their punycode form, eg apple.com with the cyrillic glyphs will show as:
https://www.xn--80ak6aa92e.com/
Is this good enough? Probably not in general.
- It relies on you to notice the URL bar after you've clicked a link. Worse, it relies on you to notice the URL bar after you've clicked a link and after the website has begun loading long enough so that firefox changes the URL to the target.
- If you're someone who does actually visit websites with punycoded domains regularly, then this conversely makes it harder for you to know you're on the right domain.
- Even if you notice the URL is wrong, you've already started loading the page. Best case your IP is now known to that server. Worst case it had a malicious payload for your browser / OS / hardware and your content blocker wasn't configured / able to block it.
It's good enough for me, at any rate.
- saagarjha 6y agoSadly, this solution makes the situation worse for people who browse sites that aren't trying to run IDN spoofing because punycode URLs all look the same.
- Arnavion 6y agoYes. The second point I made.
- lilyball 6y agoI'm honestly surprised at Firefox's behavior here. I thought all of the browsers years ago identified homoglyph attacks and deployed defenses. For example, in Safari, this domain does render as https://www.xn--80ak6aa92e.com https://www.xn--80ak6aa92e.com because Safari decided this was a homoglyph attack. My impression was all the browsers did this for any domain that used a homoglyph of a latin character, so why is Firefox failing?
- tylerhou 6y agoAs far as I can recall, Firefox (and maybe Chrome) will still display the original glyphs if they are all from the same character set. So for example, all Cyrillic apple will display as apple, but apple where only the a is Cyrillic will display punycode for the a.
- mynameisvlad 6y agoEdge does display punycode, but not sure if it's an Edge thing or a Chromium (and therefore Chrome) thing.
- dimensi0nal 6y agoFirefox wontfix'd it because it would be racist to not show phishy IDNs. https://bugzilla.mozilla.org/show_bug.cgi?id=1332714 https://bugzilla.mozilla.org/show_bug.cgi?id=1332714
- julienb_sea 6y agoIn chrome for me this happened automatically with the cyrillic apple.com. However doesn't happen with any other website. Seems pretty smart.