Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Humans Are Bad at URLs and Fonts Don’t Matter

troyhunt.com

Post reply on HN
Print view View original

11–20 of 109 posts

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#11

Post by eximius »

darkerside wrote: post #8
saagarjha wrote: post #5

The issue with solving this problem is the incentives are mostly "how can we get Google/Apple/Microsoft/Facebook users to not get phished" since they are the strongest voices in the room when this kind of thing happens, but then half the time we get solutions like "what if we pre-registered a list of 'popular' companies and flagged everything else" which of course hurts everyone that doesn't make the list. And the ot…

Just like in real life, I think the answer is not prevention but accountability. The only thing stopping a random person from bashing in my head on the sidewalk (besides moral decency) is their understanding of the consequences. They can do it, but they'll go to jail for a long, long time. Similarly, the answer on the net is not to stop bad actors from being bad. It's to punish and hold accountable those that do bad…

Hopefully the consequences are not the only thing.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#12

Post by saagarjha »

macNchz wrote: post #7
saagarjha wrote: post #3

Earlier quoted context omitted.

So this means you'll get a warning before going to anyone's blog for the first time?

Perhaps when submitting a password on a domain you've never been on before? I think that'd be super useful, actually.

For passwords, sure. For regular browsing, I don't think I would want such a thing.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#13

Post by hangonhn »

I wonder if one can create a browser plugin that judges the similarity of a domain to a set of well-known domains and warns the user when the URL they clicked on has a domain that is very similar but not the same? Maybe use levenshtein distance or some kind of visual similarity measurement? The downside is that it would obviously punish a legit website like googie.com but perhaps one can whitelist it if one explicitly enters the URL?

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#14

Post by Arnavion »

saagarjha wrote: post #9
Arnavion wrote: post #6

For firefox, you can disable IDN in the urlbar with: user_pref("network.IDN_show_punycode", true); in your user.js. Then all URLs will appear in their punycode form, eg apple.com with the cyrillic glyphs will show as: https://www.xn--80ak6aa92e.com/ Is this good enough? Probably not in general. - It relies on you to notice the URL bar after you've clicked a link. Worse, it relies on you to notice the URL bar after yo…

Sadly, this solution makes the situation worse for people who browse sites that aren't trying to run IDN spoofing because punycode URLs all look the same.

Yes. The second point I made.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#15

Post by jcranmer »

RcouF1uZ4gsC wrote: post #4

This is one of the reasons why I think it was a mistake for the web browsers to de-emphasize EV certificates. Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing. I fear that because of these kind of URL issues, and with the deemphasis of EV certificates which would have provided a somewhat decentralized solution, we will end up in a world where…

> Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing.

And the requirement for an EV certificate is that it has to be registered specifically in the corporate name, which isn't necessarily the well-known trade name. Furthermore, anyone could choose to register their company as, say, "Microsoft" if it's not in the same jurisdiction as the actual Microsoft, and you get this lovely verified checkmark saying that the phishing site is, indeed, Microsoft. (Just not the Microsoft they were expecting).

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#16

Post by gumby »

hangonhn wrote: post #13

I wonder if one can create a browser plugin that judges the similarity of a domain to a set of well-known domains and warns the user when the URL they clicked on has a domain that is very similar but not the same? Maybe use levenshtein distance or some kind of visual similarity measurement? The downside is that it would obviously punish a legit website like googie.com but perhaps one can whitelist it if one explicitl…

This would be a kind of augmented Soundex code that could be useful is many contexts.

The problem is your browser or DNS cache would basically have to have a copy of the root zones OR contact a special name resolver that would return...what? in the case of a collision.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#17

Post by [deleted] »

hangonhn wrote: post #13

I wonder if one can create a browser plugin that judges the similarity of a domain to a set of well-known domains and warns the user when the URL they clicked on has a domain that is very similar but not the same? Maybe use levenshtein distance or some kind of visual similarity measurement? The downside is that it would obviously punish a legit website like googie.com but perhaps one can whitelist it if one explicitl…

[deleted]

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#18

Post by dimnsionofsound »

eximius wrote: post #11
darkerside wrote: post #8

Earlier quoted context omitted.

Just like in real life, I think the answer is not prevention but accountability. The only thing stopping a random person from bashing in my head on the sidewalk (besides moral decency) is their understanding of the consequences. They can do it, but they'll go to jail for a long, long time. Similarly, the answer on the net is not to stop bad actors from being bad. It's to punish and hold accountable those that do bad…

Hopefully the consequences are not the only thing.

It seems like consequences are the only language that bad actors understand, unfortunately.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#19

Post by kbenson »

eximius wrote: post #11
darkerside wrote: post #8

Earlier quoted context omitted.

Just like in real life, I think the answer is not prevention but accountability. The only thing stopping a random person from bashing in my head on the sidewalk (besides moral decency) is their understanding of the consequences. They can do it, but they'll go to jail for a long, long time. Similarly, the answer on the net is not to stop bad actors from being bad. It's to punish and hold accountable those that do bad…

Hopefully the consequences are not the only thing.

I think you're supposed to read "a random person" as "any random malicious person".

What prevents the violent psychopath from killing the child they see to get their lollipop when they want something sweet? The fact that there are repercussions. What prevents those that have no qualms about stealing from a store from doing so most of the time (even those that steal don't do it every time they enter a store)? The same.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#20

Post by lilyball »

Arnavion wrote: post #6

For firefox, you can disable IDN in the urlbar with: user_pref("network.IDN_show_punycode", true); in your user.js. Then all URLs will appear in their punycode form, eg apple.com with the cyrillic glyphs will show as: https://www.xn--80ak6aa92e.com/ Is this good enough? Probably not in general. - It relies on you to notice the URL bar after you've clicked a link. Worse, it relies on you to notice the URL bar after yo…

I'm honestly surprised at Firefox's behavior here. I thought all of the browsers years ago identified homoglyph attacks and deployed defenses. For example, in Safari, this domain does render as https://www.xn--80ak6aa92e.com because Safari decided this was a homoglyph attack. My impression was all the browsers did this for any domain that used a homoglyph of a latin character, so why is Firefox failing?
Post reply on HN