Hacker News Reader

Comment by SenAnder | Hacker News Reader

The root cause is alphabets/fonts with lookalike characters being permitted in security-critical contexts. Tracing further, it's the mindset that this is a valuable feature, and not a reckless risk, that is to blame. Browser designers should have been feverishly working to further disambiguate Il1O0, not add more risk by allowing a multitude of whole new alphabets!

View on HN

When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost.

Character substitutions like ķeepass or ƙeepass or keypass are at least possible to spot if you know the name of the product, but not the full URL.

But there are many ways to create lookalike domains that don't change the product name: https://keepass.org https://keepass.net https://keepass.info https://keepass.cx https://keepassxc.org https://keepass-info.net https://keepass-manager.com

Which of these is the correct one? (It's https://keepassxc.org of course, but just looking at the URL won't tell you that.)

The root cause is downloading software you see advertised on Google even though that does not in any way establish trustworthiness.

> When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost.

This obscures how dramatically worse the situation is if you can't even trust display names. Does the ubuntu.com link on wikipedia lead to an ubuntu.com, or something entirely unrelated? Does a script you're reviewing actually pull images from debian.org, or somewhere else?

At some point you have no choice but to trust what they pixels on your screen are telling you.

But we need these alphabets to allow people of various culture to be able to have url in their native language, and I'm not sure how browser could help disambiguate all the possible Unicode symbol, afaik while there are some font to make each symbol as distinct as possible (I think they are used in licence plate), none of them support all of Unicode.

Also, while I can agree that url are "security-critical", the same applies to email or even just names, and we definitely need Unicode for those.

> But we need these alphabets to allow people of various culture to be able to have url in their native language

Those of them who want to accept the security risk that comes with that should have the option to turn it on, but it shouldn't be on by default for the rest of us.

sure, it can be done, but is not a solution to the problem as it will still leave a lot of people vulnerable. We, probably, need to rethink how we handle identity on the web but is a hard problem to solve

It sucks but doing that would be unfair to the majority of the world not using the Latin alphabet.

Maybe restricting those characters to the relevant top level domains? At least you'd notice you're on ķeepass[.]lv

> that would be unfair

They can install a browser plugin to convert punycode to their alphabet if they care so much for using it in URLs. There is no need to inflict this on peoples with safe alphabets. Alternately, highlight non-safe-ASCII-subset characters in a different color, as VS Code does.

Firefox (and maybe others) seem to use punycode instead of the rendered ASCII at least in this case.

Reply on news.ycombinator.com