Hacker News Reader

Comment by walrus | Hacker News Reader

Firefox: open about:config, set network.IDN_show_punycode to true. Next time you open the page, the address bar will show https://www.xn--80ak6aa92e.com/ instead of https://www.apple.com/. Better yet, always type in or bookmark pages where you might enter sensitive information.

I was surprised this was still an issue, as I heard about IDN homograph attacks years ago.

View on HN

IDN homograph attacks are old, but - as the original article shows - people are still vulnerable to this when you manage to make a full name homograph entirely within one language in Unicode. The only fixes for it that come to my mind are dropping IDN altogether, disambiguating homographs on IDN level, or... disambiguating Unicode.

Ultimately the problem is related to Unicode. So let's disambiguate that.

This is strange. Maybe 7 years ago I tested this in all browsers and the only browser that didn't show the punycode was Internet Explorer.

Now I'm on Firefox and was fooled by the link. Thanks for the about:config.

Maybe the non-ascii characters could be coloured somehow, like with a different colour background.

That way we could still show the real characters and not the punycode.

But how would one mass-educate all the non-technical users on this? It'd be a dirty little inside secret.

I mentioned that in the last thread we had about this. You'd have to be careful with the palettes for the colorblind, and the blind would need screenreader updates, I guess.

Some kind of clear, visual indication does make sense to me, though.

If you color ASCII with one color and all the rest of characters with another, there still can be cross-charset spoofing. Just not if ASCII domain is the one being spoofed, but the whole point of IDN was to enable people to create non-ASCII domains, so the "solution" that does not work for all non-ASCII domains is not a solution that is compatible with IDN.

Why would Mozilla think that it would be a good idea to set the default to false... at least in the English language.

Reply on news.ycombinator.com