Hacker News Reader

Comment by Adverblessly | Hacker News Reader

I always hover over links before I click them to see where they actually lead in the status bar. It is less safe than your suggestion (since if I'm not careful I can fall for "googel.com" or "goog1e.com"), but is still often useful (even just to avoid going somewhere I'm not interested in going, not specifically against phishing).

View on HN

I think you skipped reading the article.

The article is about punycode. Using it, you can have a site name like 'apple.com' even though really the domain is made up of various unicode characters.

So even if you were exceedingly careful and you made sure not to fail for googel.com and goog1e.com, you would still fall for the visually correct google.com.

The status bar is completely worthless and unreliable from a security standpoint unless you disable javascript. javascript can intercept your click and navigate you anywhere it wants.

This does not work if the link is in a browser translating punycode, i.e. if the URL is in gmail or as in this example in a web article, hovering over the link shows the translated punycode, i.e. apple.com.

If you're in Firefox, about:config, search puny, change that from false to true, NOW when you hover over this URL you'll see the untranslated punycode which is the real URL.

In mobile chrome at least, the xn-- URL showed up when long pressing instead of the apple one. Once clicked, it rendered as apple

Reply on news.ycombinator.com