3 ms·
I thought they've rolled back most of this because it made phishing domains indistinguishable from the real ones? I used an-emoji.my.domain for a while until
by 411111111111111 5y ago
I thought they've rolled back most of this because it made phishing domains indistinguishable from the real ones?
I used an-emoji.my.domain for a while until chrome changed it back to punycode
- chrismorgan 5y agoI erred slightly in what I wrote there; I said IDN form for user display, but should have said IDNA form, which is the set of restrictions to mitigate those hazards. That will allow things like उदाहरण.example, while leaving emoji as xn--n3h.example since they’re not valid in IDNA. See also https://en.wikipedia.org/wiki/Internationalized_domain_name https://en.wikipedia.org/wiki/Internationalized_domain_name and https://en.wikipedia.org/wiki/Emoji_domain https://en.wikipedia.org/wiki/Emoji_domain.
- chrismorgan 5y agoActually, I’ve got to add another note because my memory and experience was insufficient here: see also https://en.wikipedia.org/wiki/IDN_homograph_attack#Client-side_mitigation https://en.wikipedia.org/wiki/IDN_homograph_attack#Client-si... for descriptions of what further restrictions browsers do, with the most notable additional filter being disallowing mixing scripts. This is something that would be nice to formalise in some way, though I don’t know of any venue suitable for the task.