Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Watch out: ɢoogle.com isn’t the same as Google.com

thenextweb.com

Post reply on HN
Print view View original

111–120 of 136 posts

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#111

Post by bazzargh »

ergot wrote: post #67
bazzargh wrote: post #45

Earlier quoted context omitted.

Nope. The browser is behaving sensibly, since you can't register that domain. It's applying the same rules that the registrars do. ICANN require that registries follow RFC3491 and related RFCs for name prep before allowing a name to be registered https://www.icann.org/resources/unthemed-pages/idn-guideline... . What that one does is (among other things) NFKC normalization and case-folding: irb(main):016:0> "\ufeff\uf…

So if I mix ASCII with obscure UTF8 characters like the domain in OP's post I can register it then? Something like www.ｐａｙpal.com --> www.n--pal-n76secrc.com

No. When you apply NFKC normalization to that string, you get just 'paypal', so Paypal have already registered the result. You can try that here: http://mct.verisign-grs.com/ - notice how the output is not the same as some online converters based on punycode.js, because that doesn't have nameprep support https://github.com/bestiejs/punycode.js/issues/40

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#113

Post by jahewson »

a3n wrote: post #91

This is strange to me. This is clearly meant, in unicode, to be 'G' that we all know and love. It has uselessly expanded "the alphabet" (to be western-centric) in a confusable way. Unicode maybe should have been three dimensional, with "concept of G" in the 2D space, and "ways of representing G" behind G, along the third axis. All ways of representing G, whether little capital, capital, lower case, would or at least…

That character is from the phonetic alphabet so it's not the "concept of G", it's the concept of a "voiced uvular stop", which happens to looks visually like G. So what Unicode is doing is separating two conceptually different ideas, exactly as intended.

The cases where Unicode has taken similar looking characters and combined them into one have not been successful, Han Unification for example was widely viewed as a misstep and has caused many problems, such as making it impossible to embed certain Japanese characters in Chinese text without higher-level markup.

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#114

Post by jahewson »

drewmate wrote: post #94
a3n wrote: post #91

This is strange to me. This is clearly meant, in unicode, to be 'G' that we all know and love. It has uselessly expanded "the alphabet" (to be western-centric) in a confusable way. Unicode maybe should have been three dimensional, with "concept of G" in the 2D space, and "ways of representing G" behind G, along the third axis. All ways of representing G, whether little capital, capital, lower case, would or at least…

That's a really interesting proposal, but I'm afraid it would be difficult to implement in practice. If this third dimension were actually encoded into the number that represents each character, you'd end up with a lot of wasted bits (since most characters probably wouldn't even need the 3rd dimension, or at least as much of it as the heaviest users.) Another option would be to supplement the metadata that already ac…

This already exists in Unicode, it's called "Variation Selectors" and they have their own block and are used to select emoji skin tones amongst other things.

But it would be wrong to use them in this case because an IPA G and the letter G are semantically different things and should not be unified into a single character just because they look similar.

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#115

Post by hackuser »

a3n wrote: post #91

This is strange to me. This is clearly meant, in unicode, to be 'G' that we all know and love. It has uselessly expanded "the alphabet" (to be western-centric) in a confusable way. Unicode maybe should have been three dimensional, with "concept of G" in the 2D space, and "ways of representing G" behind G, along the third axis. All ways of representing G, whether little capital, capital, lower case, would or at least…

> Unicode maybe should have been three dimensional, with "concept of G" in the 2D space, and "ways of representing G" behind G, along the third axis. All ways of representing G, whether little capital, capital, lower case, would or at least could equate to conceptual G in the 2D space.

It brings up interesting, long-standing problems. Which of these count as the same letters?

* Letters in two languages with the same appearance and making the same phonetic sound

* Letters in two languages with the same appearance but making slightly different phonetic sounds. E.g., R in English and French

* Letters in in two languages that are otherwise the same, but one has an accent. Is the accent part of the letter? Separate? Are they really the same letter?

* Letters in two languages with the same appearance but making completely different phonetic sounds.

* Similar (by any property) letters in two related languages; e.g., both Indo-European

* Similar (by any property) letters in two unrelated languages; e.g., French and Vietnamese.

* Letters with the same phonetic sound but different appearances.

* Letters with the same appearance, one is phonetic and one an ideograph

* Letters that are otherwise identical, but alphabetize differently in their respective languages

* EDIT: Forgot a key one; Letters that are otherwise identical, but follow different rules of how they combine with the letters around them (a common issue, though not familiar to English speakers).

* Letters that are in all ways identical but belong in different languages. In which languages code group does the letter belong? One? Both? What if the subset of Unicode supported by an application includes one language but not the other?

etc. etc.

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#117

Post by tinus_hn »

witty_username wrote: post #105
a3n wrote: post #89

Earlier quoted context omitted.

Don't even show the suspect URL, show "THIS MIGHT BE A SCAM", with some kind of hover over showing the URL, and some way to click to more information.

Why? Non-latin alphabet domain names do have legitimate uses, although they are very rarely used.

Except by a third of all people who live in China and India. Not everyone speaks a language that is representable in the latin alphabet. In fact, a very large percentage of people do not.

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#118

Post by Animats »

bazzargh wrote: post #45
ergot wrote: post #27

Earlier quoted context omitted.

Most browsers should forcibly transcribe this to Punycode[1]: https://www.𝙿𝙰𝚈𝙿𝙰𝙻.com/ And yet when I paste this into the latest Firefox it redirects to https://www.paypal.com/ No 301 redirects or anything, the browser just treats it like ASCII, which it is clearly not, it actually happens to be Fullwidth: https://en.wikipedia.org/wiki/Fullwidth_form Serious phishing opportunity if you ask me! [1] https://en.wik…

Nope. The browser is behaving sensibly, since you can't register that domain. It's applying the same rules that the registrars do. ICANN require that registries follow RFC3491 and related RFCs for name prep before allowing a name to be registered https://www.icann.org/resources/unthemed-pages/idn-guideline... . What that one does is (among other things) NFKC normalization and case-folding: irb(main):016:0> "\ufeff\uf…

The problem is that the RFCs aren't restrictive enough, partly because the IETF doesn't have much authority over registrars. The domain name rules really ought to be something like "one script, plus numbers, in a domain name part". But this runs into such things as the tendency in Japan to mix kanjii with English words. Then there's the whole right-to-left mark business, which has to coexist with left-to-right TLDs.

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#119

Post by saurik »

tinus_hn wrote: post #117
witty_username wrote: post #105

Earlier quoted context omitted.

Why? Non-latin alphabet domain names do have legitimate uses, although they are very rarely used.

Except by a third of all people who live in China and India. Not everyone speaks a language that is representable in the latin alphabet. In fact, a very large percentage of people do not.

And it is then worth noting that as it stands, the attitudes of western developers with respect to text input and name lookup has so horribly screwed the Chinese with respect to domain names that they started using numbers instead of letters for their major web properties.

https://newrepublic.com/article/117608/chinese-number-websit...

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#120

Post by jcranmer »

elihu wrote: post #101
mcv wrote: post #11

Earlier quoted context omitted.

This would be a great solution. Allowing unicode characters in domain names is just inviting trouble. I understand that people with non-Latin scripts want domain names in their own language and alphabet, but there are way too many unicode characters that will confuse people about legitimate-looking domain names. Showing non-ascii in red would be an easy solution for everybody.

It seems like a reasonable compromise would be to allow domain names in non-Latin languages as long as the entire name is in the character set of a specific language. So, if your name is in English, that's fine. If it's in, say, Cyrillic, that's fine too. But if you mix English and Cyrillic characters, that's not allowed. It wouldn't necessarily eliminate all name look-alikes, but it would get rid of most of them.

That's supposed to be one of the rules at the registrar level, but it's one that gets ignored in practice.

I have heard proposals that mixed-script IDNs get converted to punycode in URL display, but I don't know if any browser has fully implemented that yet.

Post reply on HN