5 ms·
Cyrillic homographs[1] are your friend here :-) http://сuttlерhish.com/account/billing http://сuttlерhish.com/account/billing (PunyCode [2]: http://xn--uttlhi
by Intermernet 11y ago
Cyrillic homographs[1] are your friend here :-)
http://сuttlерhish.com/account/billing http://сuttlерhish.com/account/billing
(PunyCode [2]: http://xn--uttlhish-f8g4if.com/account/billing http://xn--uttlhish-f8g4if.com/account/billing )
Also, it seems that Firefox (v38.0.5 Windows) doesn't convert URL interpuncts (mid-dots) into punycode, so clicking on something like http://www.billing·cuttlephish.com/ http://www.billing·cuttlephish.com/ doesn't actually rewrite the URL in the address bar. Chrome converts it to http://www.xn--billingcuttlephish-c4a.com/ http://www.xn--billingcuttlephish-c4a.com/ .
[1]: https://en.wikipedia.org/wiki/IDN_homograph_attack https://en.wikipedia.org/wiki/IDN_homograph_attack
[2]: https://en.wikipedia.org/wiki/Punycode https://en.wikipedia.org/wiki/Punycode
- Manishearth 11y agoFiled https://bugzilla.mozilla.org/show_bug.cgi?id=1178095 https://bugzilla.mozilla.org/show_bug.cgi?id=1178095, thanks!
- Intermernet 11y agoNo problem. Out of interest, do the Firefox team and the Chromium team compare notes on decisions like this? Purely in this one area (IDN homograph attacks), it might be an idea to look at the Chromium Unicode vetting rules (Which characters and combos get "punycoded") as they seem to be more conservative from a "Latin" perspective. I'm not sure if a "blacklist" (mentioned in the bug report) is the best way of handling this. Perhaps only direct-encoding the "exemplar characters" for the language setting, and punycoding everything else? I'm pretty sure it would have eliminated the mid-dot issue, but perhaps this "whitelist" is too prohibitive.