I saw a thing recently where a unicode encoding trick was used in an oauth phishing scam -- using unicode characters, a scammer was able to make an oauth connec

I saw a thing recently where a unicode encoding trick was used in an oauth phishing scam -- using unicode characters, a scammer was able to make an oauth connector that looked like the real company but passed through the company's "if (oauthConnector.name.toLowercase().contains('our name')) { throw new DenyError();}" check. The user though the oauth app was legit because it was the "same" as the company name, accepted the connection, and promptly had their account emptied: https://www.reddit.com/r/Bitcoin/comments/2lt76n/warning_coinbase_oauth_phishing_attack_allows/ https://www.reddit.com/r/Bitcoin/comments/2lt76n/warning_coi... Now, it's up for debate whether any (psuedo?) financial institution should offer full oauth access (at least without having a human review possible oauth connectors), but the point is, decorative hackernews submissions are the least malicious use of this trick.