Hacker News Reader

Comment by krallja | Hacker News Reader

@edent did you submit this to HN as https://xn--69f31l4t57c0mag4b613h.xn--7uh4898msjaso/🆆🆃🅵/ or the ASCII variant?

edit: whoa, HN autoconverted it to Punycode. 🅂𝖍𝐤ₛᵖ𝒓.ⓜ𝕠𝒃𝓲/🆆🆃🅵/

It’s a little sad that we ended up with punycode, given that utf8 is so elegant as a forward compatible character set with ascii.

DNS’ concern over backward compatibility is a bit of a pain sometimes. And now we even have two competing standards, where multicast DNS, mDNS, allows utf8, but “standard” DNS does not.

An important benefit of punycode is that it provides some protection against homograph attacks [0]. There are so many similar-looking characters in Unicode that it seems reasonable to trim the allowed characters to a subset. Of course it's a compromise and ASCII's not perfect, but it's a lot easier to spot g00gle.com compared to gооgle.com.

[0] https://en.wikipedia.org/wiki/IDN_homograph_attack

At the same time there's sites like flüge.de which is not reachable under any domain except the unicode domain, and while ü could be written as ue, fluege.de is already owned by a competitor.

Over time, punycode is going to cause more phishing problems in non-ascii countries than it's going to solve, because users aren't going to see a difference between xn-blabla.de and xn-blablu.de if all domains are unreadable to them.

I feel like this is a browser UX problem, right? A browser designed to prevent phishing of readers of both ASCII and non-ASCII languages might display both the punycode and unicode versions of a website, and if a heuristic is detected that a homograph is used that would otherwise result in an Alexa Top 100k site, display a dialog to warn against a phishing attack. (Your flüge.de example shouldn't trigger that warning, for instance.)

https://github.com/phishai/phish-protect is an attempt to do this, but I think there's a better middle ground for international users that doesn't simply block-by-default all punycode domains.

Punycode has its benefits, when people try to phish with phony domains that look like legitimate ones.

It’s so you can’t use punycode to create similarly looking but different domains. Sure there are some defenses but they are weak.

I've found it interesting which things do this vs don't.

Slack doesn't convert unicode urls, discord does for example.

The ASCII one. There appears to be a bug in some URL parsers that converts things to punycode incorrectly.

that's interesting

Reply on news.ycombinator.com