5 ms·
off-topic, but are we ever going to get to a place where urls like that one appear not as xn—* but as the actual unicode?
by pvinis 4y ago
off-topic, but are we ever going to get to a place where urls like that one appear not as xn—* but as the actual unicode?
- deleted 4y ago[deleted]
- mulmen 4y agoIf course we will. Why would that be in doubt? When I open the link in iOS Safari I see the unicode characters.
- walrus01 4y agofirefox on macos shows the unicode in the address bar properly. I do kind of like that HN retains the xn-whatever as it's actually formatted in an authoritative DNS zonefile, because this is hacker news. As I do not read the language in question the unicode original and the xn-whatever are equally incomprehensible to me.
- SquareWheel 4y agoIt will show in browsers correctly now, except in cases where there's mixed character sets. This is to avoid phishing attacks abusing unicode with look-alike characters.
- layer8 4y agoThat should be the default: https://datatracker.ietf.org/doc/html/rfc5894#section-4.2 https://datatracker.ietf.org/doc/html/rfc5894#section-4.2
- josephcsible 4y agoI'd prefer that we didn't make phishing even easier.
- bla3 4y agoFishing with punycode is a mostly solved problem: Show the Unicode characters only if there are no homoglyphs in it. That's why browsers can show them. See "client side mitigations" on https://en.m.wikipedia.org/wiki/IDN_homograph_attack https://en.m.wikipedia.org/wiki/IDN_homograph_attack
- dolmen 4y agoTell me more about how homoglyphs are a solved problem. What software libraries (or algorithm) exist to tell that 2 UTF-8 strings don't have homoglyphs?
- nerdponx 4y agoThe Unicode Consortium itself maintains a list of "confusables" https://util.unicode.org/UnicodeJsps/confusables.jsp https://util.unicode.org/UnicodeJsps/confusables.jsp