Re:Stop Validating Email Addresses with Regex (2012)
by chrismorgan on Friday April 22, 2022 @02:36AM
(#31118894)
I erred slightly in what I wrote there; I said IDN form for user display, but should have said IDNA form, which is the set of restrictions to mitigate those hazards. That will allow things like उदाहरण.example, while leaving emoji as xn--n3h.example since they’re not valid in IDNA. See also https://en.wikipedia.org/wiki/Internationalized_domain_name and https://en.wikipedia.org/wiki/Emoji_domain.
[ Parent
| on HN ]
Re:Stop Validating Email Addresses with Regex (2012)
by chrismorgan on Friday April 22, 2022 @09:07AM
(#31121129)
Actually, I’ve got to add another note because my memory and experience was insufficient here: see also https://en.wikipedia.org/wiki/IDN_homograph_attack#Client-si... for descriptions of what further restrictions browsers do, with the most notable additional filter being disallowing mixing scripts. This is something that would be nice to formalise in some way, though I don’t know of any venue suitable for the task.