News for hackers. Stuff that matters.

A comment on Phishing attack uses Unicode characters in domains to clone known safe sites. Parent comment

Re:Phishing attack uses Unicode characters in domains to clo... by Zuider on Saturday April 15, 2017 @05:06AM (#14120015)
>I suppose one solution would be, when IDN is detected, to show both the Unicode and Punycoded versions:

That looks like the best solution. The security certificate of the site shows the punycode version of the URL. If the address bar URL and the certificate URL are different, then, at least for addresses in English, that should raise an alarm.

[ Parent | on HN ]
Re:Phishing attack uses Unicode characters in domains to clo... by userbinator on Saturday April 15, 2017 @06:38AM (#14120197)
If the address bar URL and the certificate URL are different, then, at least for addresses in English, that should raise an alarm.

There's a mention below ( https://news.ycombinator.com/item?id=14119826 ) that some browsers will show the IDN in the certificate too, presumably because it would otherwise be equally confusing if they didn't match (they do match.) This isn't a problem that can be solved without showing both the IDN and punycode.

[ Parent | on HN ]
Re:Phishing attack uses Unicode characters in domains to clo... by beaconstudios on Saturday April 15, 2017 @06:38AM (#14120198)
no-one checks the certificate readout - it'd have to be inline for regular users to see any benefit.
[ Parent | on HN ]
Re:Phishing attack uses Unicode characters in domains to clo... by usrusr on Saturday April 15, 2017 @07:20AM (#14120305)
The least-impact visualisation could be using colors: group the characters in the domain name by script family, then use regular colors for the largest group (so that e.g. an all-Korean domain name would look just fine) and highlight those exotic relative to the rest.
[ Parent | on HN ]
Re:Phishing attack uses Unicode characters in domains to clo... by beaconstudios on Saturday April 15, 2017 @07:46AM (#14120380)
or maybe just disallow mixed-charset domains. After all there's not much use for a domain that's partially Cyrillic and partially Latin. Not that I'm aware of anyway - and the rule could be more granular if there are legit uses.
[ Parent | on HN ]
Re:Phishing attack uses Unicode characters in domains to clo... by krallja on Saturday April 15, 2017 @10:17AM (#14120788)
see https://news.ycombinator.com/item?id=14120372 - this example uses all-Cyrillic
[ Parent | on HN ]
Re:Phishing attack uses Unicode characters in domains to clo... by beaconstudios on Saturday April 15, 2017 @08:38PM (#14123700)
the point is that is reduces the number of potential variations. There would only be 1 or 2 possible visually-identical phishing domains for any latin domain, as opposed to potentially hundreds or thousands as it stands now.
[ Parent | on HN ]
Re:Phishing attack uses Unicode characters in domains to clo... by 01000001 on Saturday April 15, 2017 @08:54AM (#14120533)
this makes a lot of sense
[ Parent | on HN ]