News for hackers. Stuff that matters.

A comment on How can you be fooled by the U+202E trick? (2013). Parent comment

Re:How can you be fooled by the U+202E trick? (2013) by BoorishBears on Wednesday February 16, 2022 @04:42AM (#30357992)
you shouldn't get away with an IDN Homograph attack in any modern browser

They just turn your url into punycode, and more recently display that instead of the raw url: https://en.m.wikipedia.org/wiki/Punycode

[ Parent | on HN ]
Re:How can you be fooled by the U+202E trick? (2013) by account42 on Wednesday February 16, 2022 @09:47AM (#30360605)
> and more recently display that instead of the raw url

Technically, punicode is the raw URL and old enough browsers will display all non-ASCII domains as punycode. It was only for a short while that browsers naively decoded punicode without restrictions.

[ Parent | on HN ]