Hacker News Reader

Comment by pvinis | Hacker News Reader

off-topic, but are we ever going to get to a place where urls like that one appear not as xn—* but as the actual unicode?

View on HN

I'd prefer that we didn't make phishing even easier.

Fishing with punycode is a mostly solved problem: Show the Unicode characters only if there are no homoglyphs in it. That's why browsers can show them. See "client side mitigations" on https://en.m.wikipedia.org/wiki/IDN_homograph_attack

Tell me more about how homoglyphs are a solved problem.

What software libraries (or algorithm) exist to tell that 2 UTF-8 strings don't have homoglyphs?

The Unicode Consortium itself maintains a list of "confusables" https://util.unicode.org/UnicodeJsps/confusables.jsp

It will show in browsers correctly now, except in cases where there's mixed character sets. This is to avoid phishing attacks abusing unicode with look-alike characters.

firefox on macos shows the unicode in the address bar properly.

I do kind of like that HN retains the xn-whatever as it's actually formatted in an authoritative DNS zonefile, because this is hacker news. As I do not read the language in question the unicode original and the xn-whatever are equally incomprehensible to me.

That should be the default: https://datatracker.ietf.org/doc/html/rfc5894#section-4.2

If course we will. Why would that be in doubt?

When I open the link in iOS Safari I see the unicode characters.

Same in Firefox on Android.

Just a datapoint: Firefox on iOS, I see the xn— variant in address bar.

Interesting. Mac OS Chrome, Edge, Firefox, and Safari all display マリウス.com.

I think the point was we don't on HN

Reply on news.ycombinator.com