News for hackers. Stuff that matters.

A comment on How can you be fooled by the U+202E trick? (2013). Parent comment

Re:How can you be fooled by the U+202E trick? (2013) by klabb3 on Wednesday February 16, 2022 @01:00AM (#30356828)
I think you're right about paths but aside from that we have website urls, usernames or similar identifiers.. People look at those and assume that they can compare them. If I see `google.com` I assume it consists of certain characters that represent a specific institution. Are we doomed to live with ascii for the forseeable future or is there some form of reduced set of unicode that we can use without these types of impersonation attacks?
[ Parent | on HN ]
Re:How can you be fooled by the U+202E trick? (2013) by BoorishBears on Wednesday February 16, 2022 @04:42AM (#30357992)
you shouldn't get away with an IDN Homograph attack in any modern browser

They just turn your url into punycode, and more recently display that instead of the raw url: https://en.m.wikipedia.org/wiki/Punycode

[ Parent | on HN ]
Re:How can you be fooled by the U+202E trick? (2013) by account42 on Wednesday February 16, 2022 @09:47AM (#30360605)
> and more recently display that instead of the raw url

Technically, punicode is the raw URL and old enough browsers will display all non-ASCII domains as punycode. It was only for a short while that browsers naively decoded punicode without restrictions.

[ Parent | on HN ]
Re:How can you be fooled by the U+202E trick? (2013) by staticassertion on Wednesday February 16, 2022 @01:10AM (#30356866)
That's basically why Google wants to get rid of urls. They're terrible at conveying trust.
[ Parent | on HN ]
Re:How can you be fooled by the U+202E trick? (2013) by toomanydoubts on Wednesday February 16, 2022 @01:26AM (#30356926)
>That's basically why Google wants to get rid of urls.

Wink-wink ;)

[ Parent | on HN ]
Re:How can you be fooled by the U+202E trick? (2013) by rightbyte on Wednesday February 16, 2022 @02:09AM (#30357151)
Google want you to search on Google to see ads and be spied upon, not use a direct url.
[ Parent | on HN ]