Live data from Hacker News

Phishing with Unicode Domains

xn--80ak6aa92e.com

31–39 of 39 posts

Re: Phishing with Unicode Domains

#31
post #13

Earlier quoted context omitted.

> Do unicode URLs actually provide any real value? yes. Not everybody speaks english. >Every web user must be already used to typing Latin characters because so many major websites use them. s/web user/existing web user/ Unicode domains are one more piece required for the net to be as inclusive as possible.

On the other hand, unicode domains may lead to balkanization of the net. How would you even type in something like борщ.рф (and before you ask, you can easily translate its contents using Google Translate after entering the URL)? And everyone, just everyone in Russia is already capable of typing in stuff in ASCII. So the upside is small and diminishing (more people learn English over time and that's a beautiful thing…

Yes, knowing English is great. Everyone should learn English.

But declaring English the lingua franca means that people from other cultures will be at a perennial disadvantage vis-a-vis native speakers, or that their native language would be neglected.

There's an obvious benefit we get from everyone speaking English, but there's also a non-obvious cost to the homogenisation of cultures. Already, there are languages dying (and dead), and with every languages dies a potentially different and meaningful way to look at the world.

In any case, I'd leave such decisions to those actually affected by them. People tend to react in surprising ways to other cultures telling them what they're worth or not (c. f. "Balkanisation")

Re: Phishing with Unicode Domains

#32
post #4

Earlier quoted context omitted.

Except the fix seems to be simply to show the punycode URL. That's not a fix, that's a workaround. EDIT: This led me to read up on how various browsers handle non-ASCII letters which in turn helped me discover that apparently no browser supports the German sharp-s ("ß") which gets auto-expanded to "ss" although domains containing the sharp-s can be registered separately from "ss" domains -- effectively allowing peopl…

It was already fixed back when domain names had to be plain ASCII. It was West-centric, yes, but it allowed for a unique and legible ASCII identifiers. And encouraged non-ASCII languages to create a unique (or, mostly-unique) Latin representation of their scripts — which is, in general, a good thing. It encouraged unification, using ASCII as the common ground. Allowing for Unicode characters opened a new Pandora box,…

In what universe is ASCII "common ground"? And in what universe is a few scammers here and there "pandora's box"?

Some people in this threat seem almost eager to throw out any attempt at respecting cultures other than their own using the earliest convenient excuse.

Re: Phishing with Unicode Domains

#35
post #27
post #5

Gosh that’s old. The original paper was from 2001, the Shmoo group wrote about it in 2005 - https://blogs.oracle.com/yakshaving/entry/so_not_funny_shmoo... - and Joi Ito and I were able to register Veriѕign.com then, to highlight how their greedy mismanagement of .com made this possible. Three possible solutions, not mutually incompatible: * Make the browsers catch it - Chrome just shows characters that look like app…

Update your Chrome

There are no updates to Chrome for iPad in the App Store, and it looks like this: http://i.imgur.com/JjR5evp.jpg

Re: Phishing with Unicode Domains

#36

Do unicode URLs actually provide any real value? Every web user must be already used to typing Latin characters because so many major websites use them. So nobody would be excluded by that. Whereas, any non-Latin character is going to be nearly impossible for most of the world to enter. A particularly terrible language is Chinese where most old people can't type the characters even though they can type Latin letters.…

Yes. It's very odd to need to adjust your own language to fit into ASCII. I can easily continue replacing "þ" and "ð" with "th", continue removing diacritics, but it feels like being robbed of an aspect of your language.

Maybe just limit eg. Danish characters to .dk, Icelandic characters to .is, Chinese characters to .cn etc., and leave .com ASCII?

Re: Phishing with Unicode Domains

#37
post #36

Earlier quoted context omitted.

Yes. It's very odd to need to adjust your own language to fit into ASCII. I can easily continue replacing "þ" and "ð" with "th", continue removing diacritics, but it feels like being robbed of an aspect of your language.

Maybe just limit eg. Danish characters to .dk, Icelandic characters to .is, Chinese characters to .cn etc., and leave .com ASCII?

Google is going to do just that in Chrome. Of course doing this change means that some existing domains will now stop working correctly which may or may not be ok with their owners.

The other option would be to do this based on the browser's current language preference configuration. But that means that unless your domain is in ASCII, you can never be sure how it's going to be rendered on your customer's browsers which would make IDN domains second-class compared to ASCII domains.

Re: Phishing with Unicode Domains

#38
post #30

Safari just displays it as " https://www.xn--80ak6aa92e.com" whereas Chrome (Version 57.0.2987.133 (64-bit)) displays it as the author intended.

Same with pale moon just displays it with the puny code instead of the unicode characters. Firefox 52.0.2 here displays it as apple.com So updated Firefox (which failed until I reran it) and then.. Still displays it as apple.com (Firefox 53.0)

OK, I read the linked article now and apparently you have to change a setting in Firefox in order to see the URL in punycode as Mozilla decided it is "not a bug".

Eg. about:config and set the "network.IDN_show_punycode" to true to avoid this trap.

Re: Phishing with Unicode Domains

#39

Earlier quoted context omitted.

It was already fixed back when domain names had to be plain ASCII. It was West-centric, yes, but it allowed for a unique and legible ASCII identifiers. And encouraged non-ASCII languages to create a unique (or, mostly-unique) Latin representation of their scripts — which is, in general, a good thing. It encouraged unification, using ASCII as the common ground. Allowing for Unicode characters opened a new Pandora box,…

In what universe is ASCII "common ground"? And in what universe is a few scammers here and there "pandora's box"? Some people in this threat seem almost eager to throw out any attempt at respecting cultures other than their own using the earliest convenient excuse.

> In what universe is ASCII "common ground"?

Excluding EBCDIC, which has the same characters, can you name a major character set that doesn't start with a carbon copy of ASCII? Shift JIS starts with ASCII. Big5 starts with ASCII. Every code page starts with ASCII. Unicode, of course, starts with ASCII. Look at just about any (physical) keyboard for any language and it will support ASCII.

Post reply on HN