4 ms·
there are tools like dnscrypt-proxy or nfq which allow you to sinkhole any punicode dns domains (before DoH became a thing) and I'm glad that some browsers stil
by DyslexicAtheist 4y ago
there are tools like dnscrypt-proxy or nfq which allow you to sinkhole any punicode dns domains (before DoH became a thing) and I'm glad that some browsers still show this as xn-- as it's now the only defense that stands between users clicking on hxxps://аррӏе.com instead of https://apple.com https://apple.com
punicode was a terrible idea to allow in DNS.
- MontyCarloHall 4y ago>punicode was a terrible idea to allow in DNS This is a very western-centric viewpoint. Most of the world does not use the Latin alphabet as its primary writing system.
- DyslexicAtheist 4y agoit is a security centric view point not a "Western" one.
- MontyCarloHall 4y agoThe solution is prohibiting characters that can easily be confused (across all writing systems), not banning Punycode altogether.
- Beltalowda 4y agoOr just allow only using a single script. A domain in all Cyrillic: great! Mixing Latin & Cyrillic: nono. In practice, browsers already check for this and display the "raw" punycode if they detect mixed script usage, but I wish such domains would not be registrable at all. These checks are somewhat complex and difficult, and easy to get wrong.
- duskwuff 4y ago> Or just allow only using a single script. This would still let some homographs through. In particular, Cyrillic has a lot of characters which are confusingly similar to, or even indistinguishable from, Latin characters (e.g. "авсекморѕтѵху").
- Beltalowda 4y agoRight; you can construct "арр.com" or "аррꙆе.com" from that limited subset. Those should be valid domains though IMHO; maybe show the used script in the address bar? I think users might be confused by that though and/or just ignore it, so idk. Then again, displaying "xn--80a6aa.com" and "xn--80ak6aa9058r.com" is pretty confusing too.
- deleted 4y ago[deleted]