Hacker News Reader

Comment by Semaphor | Hacker News Reader

Interesting, chrome indeed shows it in the url bar as ķeepass[.]info, but with FF I get xn--eepass-vbb[.]info, is this something I changed or a different default?

edit: As someone mentioned further down, it’s an about:config setting for network.IDN_show_punycode

View on HN

The TLD registries are supposed to each have defined rules for IDN which can prohibit abuses and to police the use of your service. If you operate the registry for say, Switzerland, it makes sense to allow what Swiss and maybe German people would want, then forbid everything else.

But if you operate .COM or .INFO or .FREE-MONEY or whatever, your goal isn't to help anybody it's to obtain the most money possible without anybody senior going to jail. Crooks want to pay you money to help them target victims? Yes please.

So in practice the browser vendors have to cook up heuristics to try to guess whether the IDN is a trick and in this case I'd guess Chrome's heuristic didn't consider this a problem whereas Mozilla's did. I believe Mozilla were so exasperated by the IDN abuses at these registries they may have just switched off IDN rendering for the entire registries affected which is thorough.

Ah, that is interesting, thank you.

Also apparently wrong.

https://kb.mozillazine.org/Network.IDN.whitelist.*

Disappointingly .info is whitelisted, if it wasn't (like .com) then Firefox would use Punycode here instead. Perhaps Mozilla should re-consider the decision for info, or, perhaps they have and they decided that .info is doing enough (though clearly not in this case) to say that on balance it's acceptable.

Firefox about:config check your setting for the network.IDN_show_punycode flag. I've just set this to true myself to prevent this kind of spoofing.

You are correct, I have that set to the non-default true. Probably from some other time a punycode attack was in the news ;)

FF Android changes it to the ķeepass[.]info form.

EDIT: FF Android 118.2.0 with Privacy Badger and uBlock Origin.

I just tried it and… it redirects me to the actual page https://keepass.info/

That is weird. I don’t have mobile debugging set up, or I’d try and figure out what’s going on there.

Right now, using curl, [ķ]eepass.info redirects to xn--eepass-vbb.info and consequently that redirects to official domain keepass.info.

So it might be triggering on certain UAs

It's sending me to a rickroll now (Youtube).

Those questionable websites often do redirection to a legit site like Google unless certain condition is met. For example, it could detect and only lead the user to the fake site if the user is coming from the ad. It's a common technique for them to avoid getting caught.

Reply on news.ycombinator.com