5 ms·

The root cause is alphabets/fonts with lookalike characters being permitted in security-critical contexts. Tracing further, it's the mindset that this is a valu

The root cause is alphabets/fonts with lookalike characters being permitted in security-critical contexts. Tracing further, it's the mindset that this is a valuable feature, and not a reckless risk, that is to blame. Browser designers should have been feverishly working to further disambiguate Il1O0, not add more risk by allowing a multitude of whole new alphabets!

hexmiles 3y ago
But we need these alphabets to allow people of various culture to be able to have url in their native language, and I'm not sure how browser could help disambiguate all the possible Unicode symbol, afaik while there are some font to make each symbol as distinct as possible (I think they are used in licence plate), none of them support all of Unicode. Also, while I can agree that url are "security-critical", the same applies to email or even just names, and we definitely need Unicode for those.
- josephcsible 3y ago
  > But we need these alphabets to allow people of various culture to be able to have url in their native language Those of them who want to accept the security risk that comes with that should have the option to turn it on, but it shouldn't be on by default for the rest of us.
  - hexmiles 3y ago
    sure, it can be done, but is not a solution to the problem as it will still leave a lot of people vulnerable. We, probably, need to rethink how we handle identity on the web but is a hard problem to solve
jowea 3y ago
It sucks but doing that would be unfair to the majority of the world not using the Latin alphabet. Maybe restricting those characters to the relevant top level domains? At least you'd notice you're on ķeepass[.]lv
- SenAnder 3y ago
  > that would be unfair They can install a browser plugin to convert punycode to their alphabet if they care so much for using it in URLs. There is no need to inflict this on peoples with safe alphabets. Alternately, highlight non-safe-ASCII-subset characters in a different color, as VS Code does.
  - jowea 3y ago
    Firefox (and maybe others) seem to use punycode instead of the rendered ASCII at least in this case.
yorwba 3y ago
When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost. Character substitutions like ķeepass or ƙeepass or keypass are at least possible to spot if you know the name of the product, but not the full URL. But there are many ways to create lookalike domains that don't change the product name: https://keepass.org https://keepass.org https://keepass.net https://keepass.net https://keepass.info https://keepass.info https://keepass.cx https://keepass.cx https://keepassxc.org https://keepassxc.org https://keepass-info.net https://keepass-info.net https://keepass-manager.com https://keepass-manager.com Which of these is the correct one? (It's https://keepassxc.org https://keepassxc.org of course, but just looking at the URL won't tell you that.) The root cause is downloading software you see advertised on Google even though that does not in any way establish trustworthiness.
- SenAnder 3y ago
  > When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost. This obscures how dramatically worse the situation is if you can't even trust display names. Does the ubuntu.com link on wikipedia lead to an ubuntu.com, or something entirely unrelated? Does a script you're reviewing actually pull images from debian.org, or somewhere else? At some point you have no choice but to trust what they pixels on your screen are telling you.

hexmiles 3y ago

But we need these alphabets to allow people of various culture to be able to have url in their native language, and I'm not sure how browser could help disambiguate all the possible Unicode symbol, afaik while there are some font to make each symbol as distinct as possible (I think they are used in licence plate), none of them support all of Unicode. Also, while I can agree that url are "security-critical", the same applies to email or even just names, and we definitely need Unicode for those.

josephcsible 3y ago
> But we need these alphabets to allow people of various culture to be able to have url in their native language Those of them who want to accept the security risk that comes with that should have the option to turn it on, but it shouldn't be on by default for the rest of us.
- hexmiles 3y ago
  sure, it can be done, but is not a solution to the problem as it will still leave a lot of people vulnerable. We, probably, need to rethink how we handle identity on the web but is a hard problem to solve

jowea 3y ago

It sucks but doing that would be unfair to the majority of the world not using the Latin alphabet. Maybe restricting those characters to the relevant top level domains? At least you'd notice you're on ķeepass[.]lv

SenAnder 3y ago
> that would be unfair They can install a browser plugin to convert punycode to their alphabet if they care so much for using it in URLs. There is no need to inflict this on peoples with safe alphabets. Alternately, highlight non-safe-ASCII-subset characters in a different color, as VS Code does.
- jowea 3y ago
  Firefox (and maybe others) seem to use punycode instead of the rendered ASCII at least in this case.

yorwba 3y ago

When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost. Character substitutions like ķeepass or ƙeepass or keypass are at least possible to spot if you know the name of the product, but not the full URL. But there are many ways to create lookalike domains that don't change the product name: https://keepass.org https://keepass.org https://keepass.net https://keepass.net https://keepass.info https://keepass.info https://keepass.cx https://keepass.cx https://keepassxc.org https://keepassxc.org https://keepass-info.net https://keepass-info.net https://keepass-manager.com https://keepass-manager.com Which of these is the correct one? (It's https://keepassxc.org https://keepassxc.org of course, but just looking at the URL won't tell you that.) The root cause is downloading software you see advertised on Google even though that does not in any way establish trustworthiness.

SenAnder 3y ago
> When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost. This obscures how dramatically worse the situation is if you can't even trust display names. Does the ubuntu.com link on wikipedia lead to an ubuntu.com, or something entirely unrelated? Does a script you're reviewing actually pull images from debian.org, or somewhere else? At some point you have no choice but to trust what they pixels on your screen are telling you.