9 ms·
The registered domainname in the above example is curl.se, and the registry is se. As far as the registry is concerned, the domainname is all ASCII. The evil
by cryptonector 4y ago
The registered domainname in the above example is curl.se, and the registry is se. As far as the registry is concerned, the domainname is all ASCII. The evil label is created by the operator of the registered domain, not the registry. The only way the registry can act in this case is to ban the domain if the registry observes the attack, but they might never see it.
- teddyh 4y agoOh, I see. In that case, I guess it’s up to the browser. Maybe the address bar should not be displayed as a string, but as separate fields for the different URL components? One field for protocol, one for optional user name (for HTTP auth), one field for host name, one for the path, etc.
- cryptonector 4y agoYes, it's up to the browser -- the UI anyways. The UI should do something to protect users from this. One thing that would be nice is that IRIs you enter, should be in Unicode, while other IRIs should be displayed in A-label form (punycoded), and there should be a button you can use to switch from U-label for to A-label form for the window location URI.