I still think that supporting Unicode in domain names is asking for trouble. Don't believe me? Just wait until a few thousand people get suckered into giving their credit card information to "amazοn.com". That's amazοn with a lower-case omicron, not an O. A workaround for this, used by Safari and probably others, is for the browser to only display the ASCII-encoded versions of the URLs -- in this case, "xn--amazn-uce.com" -- but that defeats the purpose of having Unicode in your DNS in the first place.

Browsers are already aware and defending against this: http://en.wikipedia.org/wiki/IDN_homograph_attack#Defending_...

I was going to say something precisely to this effect, but you already hit the nail on the head. Given enough time, the odds of something like that happen will approach 1; and, suspecting how people that create frauds work, this won't take long to happen, either.

Looks like it's going to become more important than ever to not only check for the " https:// " but also click on it to be sure it's from the source you trust. --- until Verisign is replaced with the unicode look-alike to itself.

If you you firefox and want to prevent the possibility of IDN spoofing, you can turn it off in about:config. Set network.enableIDN to false.

I shall await a spoofed google.com with cyrilic o's instead of unicode o's and cackle with glee when people visit it