6 ms·
I'm honestly surprised at Firefox's behavior here. I thought all of the browsers years ago identified homoglyph attacks and deployed defenses. For example, in S
by lilyball 6y ago
I'm honestly surprised at Firefox's behavior here. I thought all of the browsers years ago identified homoglyph attacks and deployed defenses. For example, in Safari, this domain does render as https://www.xn--80ak6aa92e.com https://www.xn--80ak6aa92e.com because Safari decided this was a homoglyph attack. My impression was all the browsers did this for any domain that used a homoglyph of a latin character, so why is Firefox failing?
- tylerhou 6y agoAs far as I can recall, Firefox (and maybe Chrome) will still display the original glyphs if they are all from the same character set. So for example, all Cyrillic apple will display as apple, but apple where only the a is Cyrillic will display punycode for the a.
- mynameisvlad 6y agoEdge does display punycode, but not sure if it's an Edge thing or a Chromium (and therefore Chrome) thing.
- dimensi0nal 6y agoFirefox wontfix'd it because it would be racist to not show phishy IDNs. https://bugzilla.mozilla.org/show_bug.cgi?id=1332714 https://bugzilla.mozilla.org/show_bug.cgi?id=1332714