3 ms·

I think you're right about paths but aside from that we have website urls, usernames or similar identifiers.. People look at those and assume that they can comp

by klabb3 5y ago

I think you're right about paths but aside from that we have website urls, usernames or similar identifiers.. People look at those and assume that they can compare them. If I see `google.com` I assume it consists of certain characters that represent a specific institution. Are we doomed to live with ascii for the forseeable future or is there some form of reduced set of unicode that we can use without these types of impersonation attacks?

BoorishBears 5y ago
you shouldn't get away with an IDN Homograph attack in any modern browser They just turn your url into punycode, and more recently display that instead of the raw url: https://en.m.wikipedia.org/wiki/Punycode https://en.m.wikipedia.org/wiki/Punycode
- account42 5y ago
  > and more recently display that instead of the raw url Technically, punicode is the raw URL and old enough browsers will display all non-ASCII domains as punycode. It was only for a short while that browsers naively decoded punicode without restrictions.
staticassertion 5y ago
That's basically why Google wants to get rid of urls. They're terrible at conveying trust.
- toomanydoubts 5y ago
  >That's basically why Google wants to get rid of urls. Wink-wink ;)
- rightbyte 5y ago
  Google want you to search on Google to see ads and be spied upon, not use a direct url.