Comment by the_mitsuhiko | Hacker News Reader

Top New Best Ask Show Jobs

Comment by the_mitsuhiko | Hacker News Reader

Parent Full thread

the_mitsuhiko·

Is it actually Google or is there some unicode trickery going on?

From what I can tell, it's actually Google, but then they redirect you to a malicious URL after auth/approval

Seems like it's allowed in the oauth form: https://pbs.twimg.com/media/C-7NlIzXUAErblp.jpg:large

Doesn't look like a unicode trick on the app-strings I'm getting

Is there a database of homoglyphs for common fonts that one could use to write a visual string matching algorithm?

http://www.unicode.org/Public/security/8.0.0/confusables.txt

https://github.com/codebox/homoglyph

http://homoglyphs.net/

Reply on news.ycombinator.com