Hacker News Reader

Comment by Zuider | Hacker News Reader

Windows users have a problem. The suggested solution of copying the URL into Notepad to reveal the true 'punycode' address does not work. Both Notepad and Wordpad render the 'punycode' as it appears in the address bar. Similarly for copying and pasting the URL in place, at least on firefox. A Chrome user commented that it did reveal the fake address.

The Scite text editor did reveal the difference: http://www.ebswift.com/scite-text-editor-installer.html

Does it work on any others?

Edit: I am incorrect. Windows and notepad are not the problem. It seems to be a peculiarity of the particular browser I am using, Cyberfox 52.0.4, which is converting the punycode as it is copied.

Edit: It looks like my Anti-virus, Avast is doing the conversion. I tested this on browsers with and without the Avast plugin, and the conversion only occurs on the browsers with the plugin.

View on HN

Neither Notepad nor Wordpad have any mechanism for converting punycode on the fly -- the copy and paste executes correctly on my box and displays as https://xn--e1awd7f.com/ in both Notepad and Wordpad. You must be somehow copypasting the post-converted url.

I tried it again with the same result. From the same Copy/Paste, Notepad showed https://www.epic.com but Scite showed https://www.????.com/. This demonstrates that I have not copypasted the post-converted URL. Interestingly, pasting the fake address into HN comment box showed https://www.xn--e1awd7f.com/

Could it be that notepad now delegates the handling of Unicode to the OS. I tested the above on the latest official release, Windows 10 Creators Update.

I also have the latest update. Not really sure what to make of this. If you manually type the punycode URL (https://www.xn--e1awd7f.com) into your Notepad or Wordpad and then copy THAT and paste it back on the following line, does it convert?

Manually typing the URL does not result in 'on the fly' conversion. Copying/Pasting from the manually typed URL does not result in a conversion. Copying from the link in your comment above does result in a converted URL. So, you are correct. Notepad is not the culprit.

This suggests that the browser is converting the URL before it can be copied, indicating that it converts the punycode rather than rendering it, but refreshing the page does not lead to the real site, so this only happens when copying from the address bar. I am using Cyberfox 52.0.4.

I agree with your comment below mentioning Cyberfox -- the browser appears to be to blame, not Windows per se. The only question is why your browser is doing that. On both Firefox and Chrome, I am not getting the Unicode inserted into my clipboard, only the actual punycode. In fact, if I attempt to copy the Unicode from the address bar in either browser, it pastes as https://www.xn--e1awd7f.com/ in the text editor, not as "epic.com." Edge seems to be completely immune to this exploit; it renders the punycode as punycode in the URL (I suppose it just doesn't "understand" punycode is all.)

I suspect that my antivirus software, Avast is converting the URL to unicode when it is copied.

I tried the Copy/Paste of the fake URL with standard Firefox, Brave (Chrome), and Avast Safezone (Chrome). Only in Brave did the fake address copy correctly as punycode. The other two browsers have the Avast plugin as a common factor, but Brave does not.

When I clicked on the padlock icon of the example site https://www.xn--e1awd7f.com/ in Android Chrome, the immediate dialog box showed the real site URL. When I clicked on Details, it showed the certificate as issued to epic.com instead. Wild stuff.

Using Cyberfox on windows 10, clicking on the padlock --> more information --> view certificate showed the certificate was issued to www.xn--e1awd7f.com

Notepad++ with ASCII text will help.

Reply on news.ycombinator.com