Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

paultendo.github.io

Post reply on HN
Print view View original

31–40 of 60 posts

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#31

Post by jeroenhd »

An interesting attempt, Claude. However, your promot is missing an important step to measure effectiveness against humans: wait 40-60 years for your vision to degrade naturally, and check the confusables again, preferably on a small phone screen. Bonus points if you can find someone with visual disabilities from birth. Obviously most attacks aren't pixel-perfect, but that's not the point, all you need to confuse are human eyes.

Things like the Fraktur characters are obvious mismatches in any font I know, I do do wonder why they're on the list.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#32

Post by leoedin »

Grom_PE wrote: post #21

0 and O, and l and I that look the same in a single font is a crime of modern typography. Also, I remember 8x16 VGA font that came with KeyRus had some slight differences between Cyrillic and Latin lookalikes, that brought some strange sense of comfort when reading, and especially typing the letter c, because its Cyrillic lookalike is located on the same key.

The font the arduino editor uses renders l and 1 exactly the same. Utter madness in a beginner programming context.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#33

Post by bojan »

chii wrote: post #12

> A domain using only Cyrillic characters that happen to spell a Latin word (like “аpple” in all-Cyrillic) may still render in the address bar’s font and look identical. that is very interesting. I imagine the browser could take some context clues and switch rendering to puny code if the locale of the user is nowhere near a cyrillic region. But that is only going to patch some edge cases and miss others. Ideally, the…

> I imagine the browser could take some context clues and switch rendering to puny code if the locale of the user is nowhere near a cyrillic region.

Anyone reading this - please, please, please do not make any assumptions based on the end-user's geography.

Signed, someone who can cross 3 national and 4 language borders within a few hours of driving.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#35

Post by wongarsu »

rob74 wrote: post #30
vivid242 wrote: post #23

Thanks for the effort! I'm always intrigued by the German FE-Schrift ("fälschungserschwerende Schrift", "more-difficult-to-forge font") chooses shapes for characters that makes it hard for them to be turned into one another (like a 3 into an 8 or so): https://en.wikipedia.org/wiki/FE-Schrift

What I have always wondered about with FE-Schrift: they painstakingly made all glyphs distinguishable, but completely f'ed it up with V and Y: the "stalk" of the Y is vertical and so short that they're very easy to confuse. They could have made the "stalk" slanted, or even curved like in lowercase "g", and most people would have still recognized it as a "Y"...

A slanted stalk might have made it too close to an X with a removed lower left arm. But a curved stalk does seem like it would have been an easy improvement

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#36

Post by rithdmc »

hinkley wrote: post #4
apothegm wrote: post #2

Maybe not at super large font sizes. But even lowercase i and l are easy enough to confuse at a glance mid-word in most sans-serif fonts, not to mention uppercase I and lowercase l. You don’t even need “confusable” glyphs to create a domain name that will stand up to a casual visual confirmation from a busy user in a phishing context.

Every Albert, Alfred, or Alphonso who goes by “Al” getting confused with bots right now…

I often ask my friend Alan to review what I've created, so I can tell people it has been enhanced with Al.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#37

Post by olsondv »

jdranczewski wrote: post #28
chii wrote: post #12

> A domain using only Cyrillic characters that happen to spell a Latin word (like “аpple” in all-Cyrillic) may still render in the address bar’s font and look identical. that is very interesting. I imagine the browser could take some context clues and switch rendering to puny code if the locale of the user is nowhere near a cyrillic region. But that is only going to patch some edge cases and miss others. Ideally, the…

The article mentions this only briefly, but browsers already do this kind of heuristic protection! See https://en.wikipedia.org/wiki/IDN_homograph_attack#Defending... or https://chromium.googlesource.com/chromium/src/+/main/docs/i... for a Chrome-specific blog post. I think the lack of exploration of the context around the problem and current mitigations is an issue with the article - it spends a lot of time talking…

Not to mention it would only apply to clicking spoofed links. Unless the keyboard mapping was compromised, those letters won’t be typed.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#38

Post by Sharlin »

ordu wrote: post #18

But what about 'Ы'? It looks like 'bl', doen't it? 'Ы' is one codepoint and one glyph, though 'bl' is a sequence of two letters. I believe that the method described will miss such things. Cyrillic also has 'Ю', I suppose it is possible to design a font that make it look like 'lO'? Are there any fonts like this in a wild?

Yes, it's one of the things listed in the limitations section.

Re: I rendered 1,418 confusables over 230 fonts. Most aren't confusable to the eye

#40

Post by Sharlin »

recursivecaveat wrote: post #16

This seems misguided. The fact that 'ρ' isn't a pixel for pixel match for 'p' doesn't mean they're not confusable. The threat model is not being unable to solve a spot-the-difference puzzle. Unless you are familiar with every pixel of your system fonts, and carefully scrutinize every character on your screen, the lack of an exact match in jρmorgan[.]com in a URL is going to do very little for you. There are many engl…

To be fair, the correlation threshold they used was 0.7 for confusable, and 0.3-0.7 for contextually confusable. But I definitely would have liked to see some examples of glyph pairs at around 0.5 correlation. And at small font sizes realistic in actual threat scenarios.
Post reply on HN