If the browsers were the only thing affected, you'd be completely right. But the truth is that browsers are only a part of the issue here. We have to deal with

If the browsers were the only thing affected, you'd be completely right. But the truth is that browsers are only a part of the issue here. We have to deal with: WWW browsers (firefox, chrome, edge, ie, brave, "browser" etc) email clients (LOTS) Signal Twitter Discord Google hangouts Telegram FB messenger And many more. And most of those don't have disambiguation settings like your example with firefox does. And all of them should be guarded against, as they have the same failure modes of "being sent link to log into $fake_service and looking completely real and getting hacked". I still maintain, since unicode provides no protections against homoglyphs, that the only real answer here is to firstly expand them to punycode, and secondarily to remove all homoglyph text.