-- disclaimer: this is old info and I never got too deep into it, so take it with a (big) grain of salt :) and please, correct me if I'm wrong somewhere! From

-- disclaimer: this is old info and I never got too deep into it, so take it with a (big) grain of salt :) and please, correct me if I'm wrong somewhere! From what I can remember of some of Chrome's and Firefox's battles with this, one of the end-states was something like this, using punycode (example here[1] seems more useful than the wikipedia page[2]): If system language matches domain name's language, display in localized characters. Otherwise, display punycode, to prevent homoglyph attacks. "domain name's language" is of course a very vague definition. A better one might be "same UTF section". And it's all hairy and a bit problematic and I don't recall any conclusive, ideal solutions, and somewhat doubt it's possible. But handling the vast majority of legitimate uses in the best-possible way while preventing homoglyph attacks is pretty darned good. And yeah, there will be sin/cosine/theta/pi.com attempts. But having an un-typable name is a choice made by the domain owner, just like any other. There's nothing preventing me from buying fdaocclasuro--ieja83q92e-jfksdl7a.com, which is at least as obtuse as any punycode URL, but that hasn't been a complaint in the past. [1] http://mothereff.in/punycode http://mothereff.in/punycode [2] http://en.wikipedia.org/wiki/Punycode http://en.wikipedia.org/wiki/Punycode