Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Phishing with Unicode Domains

xn--80ak6aa92e.com

Post reply on HN
Print view View original

11–20 of 39 posts

Re: Phishing with Unicode Domains

#11

Post by jerryszczerry »

pluma wrote: post #4
mirages wrote: post #3

Chrome 58 rolled out yesterday fix the issue

Except the fix seems to be simply to show the punycode URL. That's not a fix, that's a workaround. EDIT: This led me to read up on how various browsers handle non-ASCII letters which in turn helped me discover that apparently no browser supports the German sharp-s ("ß") which gets auto-expanded to "ss" although domains containing the sharp-s can be registered separately from "ss" domains -- effectively allowing peopl…

It was already fixed back when domain names had to be plain ASCII.

It was West-centric, yes, but it allowed for a unique and legible ASCII identifiers. And encouraged non-ASCII languages to create a unique (or, mostly-unique) Latin representation of their scripts — which is, in general, a good thing. It encouraged unification, using ASCII as the common ground.

Allowing for Unicode characters opened a new Pandora box, creating a situation that is unsolvable — either we keep the new names, making almost every string of characters potentially ambiguous, or we return to the state where ASCII-only names are the only ones usable.

Also, differentiating between ASCII and non-ASCII names doesn't solve the thing. Imagine what if the legitimate address is already in a non-ASCII script.

Re: Phishing with Unicode Domains

#12

Post by averagewall »

Do unicode URLs actually provide any real value? Every web user must be already used to typing Latin characters because so many major websites use them. So nobody would be excluded by that. Whereas, any non-Latin character is going to be nearly impossible for most of the world to enter.

A particularly terrible language is Chinese where most old people can't type the characters even though they can type Latin letters. That's because you have to deliberately invest time to sit down and learn an input method which is a non-trivial endeavor that takes weeks of effort and old people just aren't going to go back to school for that.

Re: Phishing with Unicode Domains

#13

Post by pilif »

averagewall wrote: post #12

Do unicode URLs actually provide any real value? Every web user must be already used to typing Latin characters because so many major websites use them. So nobody would be excluded by that. Whereas, any non-Latin character is going to be nearly impossible for most of the world to enter. A particularly terrible language is Chinese where most old people can't type the characters even though they can type Latin letters.…

> Do unicode URLs actually provide any real value?

yes. Not everybody speaks english.

>Every web user must be already used to typing Latin characters because so many major websites use them.

s/web user/existing web user/

Unicode domains are one more piece required for the net to be as inclusive as possible.

Re: Phishing with Unicode Domains

#14

Post by Geimfari »

averagewall wrote: post #12

Do unicode URLs actually provide any real value? Every web user must be already used to typing Latin characters because so many major websites use them. So nobody would be excluded by that. Whereas, any non-Latin character is going to be nearly impossible for most of the world to enter. A particularly terrible language is Chinese where most old people can't type the characters even though they can type Latin letters.…

Yes. It's very odd to need to adjust your own language to fit into ASCII.

I can easily continue replacing "þ" and "ð" with "th", continue removing diacritics, but it feels like being robbed of an aspect of your language.

Re: Phishing with Unicode Domains

#15

Post by en3rme »

averagewall wrote: post #12

Do unicode URLs actually provide any real value? Every web user must be already used to typing Latin characters because so many major websites use them. So nobody would be excluded by that. Whereas, any non-Latin character is going to be nearly impossible for most of the world to enter. A particularly terrible language is Chinese where most old people can't type the characters even though they can type Latin letters.…

>Do unicode URLs actually provide any real value?

No. They are very very rarely used even in countries that do not use the Latin alphabet. Given the risk that phishing poses I don't think it's worth the risk.

Re: Phishing with Unicode Domains

#16

Post by pluma »

jwilk wrote: post #10
pluma wrote: post #8

Earlier quoted context omitted.

Unless they did something ridiculously clever, they just made IDN domains unusable. That means legitimate IDN domains are as affected as malicious ones, punishing non-ASCII languages. A proper fix would keep the domain name human-readable but differentiate between the ASCII and homoglyph versions. How? Not my job to figure that out. If you want a random idea: the homoglyphs could be rendered differently (i.e. make th…

The fix is https://chromium.googlesource.com/chromium/src/+/08cb718ba7c... : > Block a label made entirely of Latin-look-alike Cyrillic letters when the TLD is not an IDN (i.e. this check is ON only for TLDs like 'com', 'net', 'uk', but not applied for IDN TLDs like рф. That's neither "ridiculously clever", nor it will make (non-nefarious) IDN domains ununsable.

Except that this assumes there are no legitimate IDN domains on non-IDN TLDs. Considering how few IDN TLDs there are, I would wager that most IDN domains don't live on these TLDs.

However it seems they don't flat out block all IDN domains but only those containing the homoglyphs. IUIC they also don't block domains containing Cyrillic homoglyphs alongside other Cyrillic characters.

This seems somewhat reasonable. I still think rendering Cyrillic in a way that makes alphabet mismatches more obvious would be a better and more future-proof solution.

Re: Phishing with Unicode Domains

#17

Post by Geimfari »

en3rme wrote: post #15
averagewall wrote: post #12

Do unicode URLs actually provide any real value? Every web user must be already used to typing Latin characters because so many major websites use them. So nobody would be excluded by that. Whereas, any non-Latin character is going to be nearly impossible for most of the world to enter. A particularly terrible language is Chinese where most old people can't type the characters even though they can type Latin letters.…

>Do unicode URLs actually provide any real value? No. They are very very rarely used even in countries that do not use the Latin alphabet. Given the risk that phishing poses I don't think it's worth the risk.

But they're very rarely used because support for them hasn't been good. Support is still unpredictable, I run into failing URL parsers constantly.

Re: Phishing with Unicode Domains

#18

Post by lambdadmitry »

pilif wrote: post #13
averagewall wrote: post #12

Do unicode URLs actually provide any real value? Every web user must be already used to typing Latin characters because so many major websites use them. So nobody would be excluded by that. Whereas, any non-Latin character is going to be nearly impossible for most of the world to enter. A particularly terrible language is Chinese where most old people can't type the characters even though they can type Latin letters.…

> Do unicode URLs actually provide any real value? yes. Not everybody speaks english. >Every web user must be already used to typing Latin characters because so many major websites use them. s/web user/existing web user/ Unicode domains are one more piece required for the net to be as inclusive as possible.

On the other hand, unicode domains may lead to balkanization of the net. How would you even type in something like борщ.рф (and before you ask, you can easily translate its contents using Google Translate after entering the URL)? And everyone, just everyone in Russia is already capable of typing in stuff in ASCII. So the upside is small and diminishing (more people learn English over time and that's a beautiful thing), and the downside is the reversal of the unification effect that Internet had. I'm pretty sure it's not an obvious choice.

I should also add that the general attitude of "not everybody speaks English so we should adapt our tech to reduce the need for English" seems to imply a privilege of already knowing English. It is true that not everyone speaks English at this moment, but the right solution would be to teach everyone English as it expands horizons immensely, not to balkanize the world. Languages are not equal and English is the single most useful one. One can argue that e.g. Russian is just as good as English, but it's just not true. The amount of information available in English is immeasurably higher than in any other national language, and one should have the privilege of knowing English for some time (or being a native speaker) to forget the fact.

Re: Phishing with Unicode Domains

#20

Post by petters »

jwilk wrote: post #10
pluma wrote: post #8

Earlier quoted context omitted.

Unless they did something ridiculously clever, they just made IDN domains unusable. That means legitimate IDN domains are as affected as malicious ones, punishing non-ASCII languages. A proper fix would keep the domain name human-readable but differentiate between the ASCII and homoglyph versions. How? Not my job to figure that out. If you want a random idea: the homoglyphs could be rendered differently (i.e. make th…

The fix is https://chromium.googlesource.com/chromium/src/+/08cb718ba7c... : > Block a label made entirely of Latin-look-alike Cyrillic letters when the TLD is not an IDN (i.e. this check is ON only for TLDs like 'com', 'net', 'uk', but not applied for IDN TLDs like рф. That's neither "ridiculously clever", nor it will make (non-nefarious) IDN domains ununsable.

That fix is an improvement, but in general I think it is better to whitelist stuff instead. Unicode is huge and complicated.
Post reply on HN