Hacker News Reader

Well the back of my Chase card says chase.com.

If you tend to use search engines to find websites, you are trusting the search engine to give you the website for Chase Bank.

View on HN

I feel like google is less likely to give me something fraudulent than e.g. the risk of me misspelling chase or the like

an attacker could purchase google ads for "chɑse.com" (note the unicode "s" instead of "s"

Isn't the homoglyph the IPA "ɑ" character used in place of Basic Latin "a"? The homoglyph URL attack also has some downsides because Unicode is only supported for domains through an extension system, most browsers will convert the above to "xn--chse-r5b.com" after you visit the link.

Seems unlikely google would let scammers with fake domains purchase ads, though maybe they have in the past.

Reply on news.ycombinator.com