I'm not quite sure if I understand your second suggestion. Isn't that what the article claims to circumvent? I read that as 'Firefox/Chrome already do not render these characters, unless they're all from the same subset' - and the 'apple.com' is presented as completely cyrillic (I don't know/understand that alphabet and might've missed either your point or misread the article).
Re:Phishing with Unicode Domains
by Dylan16807 on Thursday April 20, 2017 @09:14AM
(#14156316)
As far as I understand it the actual solution is that registries aren't supposed to let you buy a domain that looks like an existing domain. But that's broken?
And this domain isn't made of mixed characters.
Update your Chrome
There are no updates to Chrome for iPad in the App Store, and it looks like this: http://i.imgur.com/JjR5evp.jpg
Three possible solutions, not mutually incompatible:
* Make the browsers catch it - Chrome just shows characters that look like apple.com here, and shouldn’t.
* Whitelist character sets that are allowed to be mixed, at the registry level - it should only be possible to mix cyrillic-latin homoglyphs with cyrillic non-homoglyphs.
* Don’t allow IDNs on gTLDs - if you want “écriture”, get écriture.fr, not .com
Obviously, the registries have a conflict of interest here, and won’t let 2 and 3 happen on .com because it would cut into Verisign's revenue.
See also https://en.wikipedia.org/wiki/IDN_homograph_attack