3 ms·
Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different defau
by Semaphor 3y ago
Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different default?
edit: As someone mentioned further down, it’s an about:config setting for network.IDN_show_punycode
- tialaramex 3y agoThe TLD registries are supposed to each have defined rules for IDN which can prohibit abuses and to police the use of your service. If you operate the registry for say, Switzerland, it makes sense to allow what Swiss and maybe German people would want, then forbid everything else. But if you operate .COM or .INFO or .FREE-MONEY or whatever, your goal isn't to help anybody it's to obtain the most money possible without anybody senior going to jail. Crooks want to pay you money to help them target victims? Yes please. So in practice the browser vendors have to cook up heuristics to try to guess whether the IDN is a trick and in this case I'd guess Chrome's heuristic didn't consider this a problem whereas Mozilla's did. I believe Mozilla were so exasperated by the IDN abuses at these registries they may have just switched off IDN rendering for the entire registries affected which is thorough.
- Semaphor 3y agoAh, that is interesting, thank you.
- Semaphor 3y agoAlso apparently wrong.
- tialaramex 3y agohttps://kb.mozillazine.org/Network.IDN.whitelist https://kb.mozillazine.org/Network.IDN.whitelist.* Disappointingly .info is whitelisted, if it wasn't (like .com) then Firefox would use Punycode here instead. Perhaps Mozilla should re-consider the decision for info, or, perhaps they have and they decided that .info is doing enough (though clearly not in this case) to say that on balance it's acceptable.
- ryanjshaw 3y agoFF Android changes it to the ķeepass[.]info form. EDIT: FF Android 118.2.0 with Privacy Badger and uBlock Origin.
- Semaphor 3y agoI just tried it and… it redirects me to the actual page https://keepass.info/ https://keepass.info/ That is weird. I don’t have mobile debugging set up, or I’d try and figure out what’s going on there.
- cengizIO 3y agoRight now, using curl, [ķ]eepass.info redirects to xn--eepass-vbb.info and consequently that redirects to official domain keepass.info.
- jan_Sate 3y agoThose questionable websites often do redirection to a legit site like Google unless certain condition is met. For example, it could detect and only lead the user to the fake site if the user is coming from the ad. It's a common technique for them to avoid getting caught.
- 369548684892826 3y agoFirefox about:config check your setting for the network.IDN_show_punycode flag. I've just set this to true myself to prevent this kind of spoofing.
- Semaphor 3y agoYou are correct, I have that set to the non-default true. Probably from some other time a punycode attack was in the news ;)