News for hackers. Stuff that matters.
Re:Phishing attack uses Unicode characters in domains to clo... by userbinator on Saturday April 15, 2017 @09:35AM (#14120655)
One only has to look at things like passports, where internationally-significant naming is important, to see that English (and thus transliterated names) is the norm:

https://en.wikipedia.org/wiki/Passport#Languages

Simple sanity checks for mixed character urls by the browser easily remedies this.

Except this particular example, the name 'epic' is written entirely with Cyrillic characters. One could argue whether a Russian company has the right to use such a name (with all-Cyrillic characters), or how it would be input --- and if you want it to be easy to input for those who don't completely have IDN support and matching ways to input those characters, you'd have to also display the punycoded version, at which point a transliterated name would be better anyway.

Re:Phishing attack uses Unicode characters in domains to clo... by csydas on Saturday April 15, 2017 @10:59AM (#14120989)
I'm not sure that there really are that many full word collisions across two different alphabets. Epic versus Ерис is certainly a nice example, but how many others are there? (Also, I know there is a character that can be used to look like the latin Ii, but every time I see the и character or sound, it's always Ии, but that's not really what this is about) And honestly, I do think that Ерис.com has every right to be a site as Eric.com - it would be trivial for a browser to know whether the url was provided in latin characters or cyrillic.

My point/question is more "is the issue actually words in two different character sets creating a collision or mixed alphabet collisions?" If it's the former, I'd like to see more examples to show this is a prevalent issue that wouldn't be caught by a sanity check that catches URLs with mixed character sets. (That is, how many unique words across languages are there that actually get a hit this way, in the same way Epic/Ерис do?)

As for passports, I understand your point on the universal nature of English, but International passports serve a completely different purpose than a domain name. So much of the web is non-english, save the domain name for some of them, and I'm not sure why it has to be this way. If the owners want it that way, great. If they want a domain in the local language, I'm not sure why they shouldn't be allowed to. A passport is meant for a very specific set of people (border guards, law enforcement, airline and other travel employees) to be able to verify your identity. A domain name just needs to resonate with its audience.

I just don't see why every business across the planet needs to compete for the same flowers.com address, or petstore.com, or cars.com. There are plenty of unique words and ways to communicate the same idea, I'm not certain why we need to restrict ourselves to English here. It just makes already expensive domain names even more expensive. If I have a club in San Francisco that I wanna call White Nights, there's no reason that a club in St. Petersburg should have to compete with me for the same name when they have their own term for White Nights, especially when the issue seems to not be about foreign character sets, but mixing character sets in the domain name. All ascii does work, but it's a grenade for an anthill.

Edit: an aside, I didn't realize that Safari translates to punycode. Very cool.