Hacker News Reader

Comment by Animats | Hacker News Reader

The rules on homoglyph domain registration need to be tightened up and enforced.[1] As usual, ICANN is soft on making registrars obey rules. That's where the blame lies.

[1] https://en.wikipedia.org/wiki/IDN_homograph_attack

View on HN

It's a hard problem. There are valid use cases for mixing characters from different alphabets. They'd need to detect malicious mixing without creating a prohibitive amount of false positives.

IMO it'd be fine if there was an automated flagging mechanism that would require manual review for suspicious domains, though. But good luck getting registrars to do anything more involved than a simple blacklist check.

Seems like the kind of thing google safe browsing is there for - flagging URLs as malicious. Sure, they have to be discovered first but at least its a start

Homograph detection isn't about prohibiting mixed characters; it's about considering letters that look the same to be the same when checking for existing duplicates.

It's not that simple. A lot of different characters may or may not look the same depending on the typeface used.

Yeah, if I were doing it I'd probably tend to be pretty cautious - if I see any popularly-used typeface that would confuse the characters I'd mark them as homographs.

It would absolutely have to be a pretty labor-intensive, manually-maintained database.

And thus extremely error prone. I think introducing IDNs at all was a mistake given the (security) cost-benefit tradeoff, and the best solution would be to scrap them but I realize that is unlikely to happen. Domain name script is probably the last place where cultural imperialism needs to be fought, it's just empty PC posturing and a way to extract some more easy money from gullible domain owners.

Maybe the issue is that we need to trust a central authority.

With what?

With identifying and prohibiting homographs

Or at least, prohibit using strings of homeographs to spoof entire words. This solution has the advantages that it would not restrict the detection of spoofed domains to English only sites, and it should be robust to the use of diacritics and non-English alphabetical characters. This would not work if the spoofed site did not use homeographs to spoof the entire word.

Reply on news.ycombinator.com