Hacker News Reader

Comment by burgerbrain | Hacker News Reader

I really can't wait until the phishers get their hands on this. It's going to be a gas.

Known problem: http://en.wikipedia.org/wiki/IDN_homograph_attack .

The solution to the known problem is more or less "don't use them" (ie, punycode them). It's still a pretty crap situation, it'd be nice to have but if we actually use them in a nice manner, it opens Pandora's Box.

They show up properly for some TLDs, those that have a policy of not allowing confusing/pointless characters. Far as I can tell though, you can't register names like the following (due to TLD restrictions). http://☁→❄→☃→☀→☺→☂→☹→✝.org/

Maybe browser vendors could agree to render non-ASCII characters in a different colour?

That way the characters are respected, but the user is alerted if a very similar (non-ASCII) code has been used to dupe a user.

That'd be fine for Americans (or other people using ASCII) faced with a Russian а, but how about a Russian faced with an ASCII a? You could hardly flag every use of ASCII, and creating a table of which characters go together seems a a lot of work (and it would be hard to do properly).

Would it really be a lot of work? I'd imagine the effort expended towards security in general exceeds what you're proposing.

EDIT: As I understand it, Cyrillic languages use code page 866 as an extension to ASCII http://en.wikipedia.org/wiki/Code_page_866. Is this correct?

I'm sure that something would be extremely painful. Some sort-of-independent tribe/people that uses one or two letters that are "really part" of another language. In short, politics.

To the best of my knowledge, Cyrillic languages don't use the Roman script (except where letters appear to be similar). The ASCII subset of codepage 866 is for "cd C:\", not for Cyrillic.

I agree - it could be tricky politically, but I'm not sure if the alternative of representing the characters via punycode conversion is more culturally supportive / sympathetic?

CP866 is a very old standard, it was used in pre-Windows times. There are at least 3 more standards to encode cyrillics in 8 bits. Today, most Cyrillic letters on the web are encoded in either UTF-8 or CP1251.

All of them define the whole alphabete, though, so even the letters that look similar to some latin letters are always encoded differently.

In Chrome, the domain name in question shows up as:

http://xn--55gaaaaaa281gfaqg86dja792anqa.ws/

This is to prevent phishing. Hardly ideal, but it works.

Reply on news.ycombinator.com