Live data from Hacker News

Watch out: ɢoogle.com isn’t the same as Google.com

thenextweb.com

41–50 of 136 posts

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#41
post #11

Web browsers should have an option to show non-ascii chars in urls in red.

This would be a great solution. Allowing unicode characters in domain names is just inviting trouble. I understand that people with non-Latin scripts want domain names in their own language and alphabet, but there are way too many unicode characters that will confuse people about legitimate-looking domain names. Showing non-ascii in red would be an easy solution for everybody.

Everybody who isn't colorblind anyway.

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#42

Earlier quoted context omitted.

Why is everyone thinking so small? What about https://www.goоgle.com ? Or how about the word "gullible" isn't in the dictionary? http://www.dictionary.com/browse/gulliblе

I think, it's impossible to register this domain.

Considering it's already registered, I'd say it's possible:

https://whois.domaintools.com/xn--gogle-kye.com

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#43

I believe now that browsers have support for non-ascii URLs, each of them have schemes for anti-phishing. See https://www.w3.org/International/articles/idn-and-iri/ and https://wiki.mozilla.org/IDN_Display_Algorithm plus http://www.chromium.org/developers/design-documents/idn-in-g...

Browsers have supported this for almost a decade.

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#44

Earlier quoted context omitted.

Why is everyone thinking so small? What about https://www.goоgle.com ? Or how about the word "gullible" isn't in the dictionary? http://www.dictionary.com/browse/gulliblе

Not sure why you're getting downvited, people seem to have missed your clever use of the Cyrillic "o".

Why is the Cyrillic "o" even a separate glyph/charcode, even though it looks like a regular "o"?

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#45
post #27

Some time ago I registered http://www.goolge.io/ . Still haven't done anything with it, I guess at some point I'll just redirect it to duckduckgo. [EDIT: now it's redirected to duckduckgo.] This can of course be used in a malicious way. I thought about rebuilding the homepage of the bank Credit Suisse on www.credit-siusse.ch, but that's probably illegal.

Most browsers should forcibly transcribe this to Punycode[1]: https://www.𝙿𝙰𝚈𝙿𝙰𝙻.com/ And yet when I paste this into the latest Firefox it redirects to https://www.paypal.com/ No 301 redirects or anything, the browser just treats it like ASCII, which it is clearly not, it actually happens to be Fullwidth: https://en.wikipedia.org/wiki/Fullwidth_form Serious phishing opportunity if you ask me! [1] https://en.wik…

Nope. The browser is behaving sensibly, since you can't register that domain. It's applying the same rules that the registrars do.

ICANN require that registries follow RFC3491 and related RFCs for name prep before allowing a name to be registered https://www.icann.org/resources/unthemed-pages/idn-guideline... . What that one does is (among other things) NFKC normalization and case-folding:

    irb(main):016:0> "\ufeff\uff30\uff21\uff39\uff30\uff21\uff2c"
    => "PAYPAL"
    irb(main):017:0> "\ufeff\uff30\uff21\uff39\uff30\uff21\uff2c".unicode_normalize(:nfkc).downcase
    => "paypal"

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#47
post #11

Earlier quoted context omitted.

This would be a great solution. Allowing unicode characters in domain names is just inviting trouble. I understand that people with non-Latin scripts want domain names in their own language and alphabet, but there are way too many unicode characters that will confuse people about legitimate-looking domain names. Showing non-ascii in red would be an easy solution for everybody.

Everybody who isn't colorblind anyway.

Use blue, the most common types of color blindness are red-green issues(there's a really tiny percentage that doesn't perceive colors at all but really really tiny. And other than those, nobody has trouble with blue)

Source: I'm colorblind(protanope) and red would definitely be an issue. Android studio, for example, is really annoying for me because the particular red they use for errors is very hard to distinguish from black

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#48
post #44

Earlier quoted context omitted.

Not sure why you're getting downvited, people seem to have missed your clever use of the Cyrillic "o".

Why is the Cyrillic "o" even a separate glyph/charcode, even though it looks like a regular "o"?

Probably because it is rotated 360°.

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#49
This is something that's been bugging me for years.

Why are there multiple representations of alphabet characters in Unicode? It seems reasonable to include accent marks, but what's the benefit in having a Cyrillic 'o' alongside a standard 'o' or the 2 or 3 other ASCII-lookalike sets of characters?

Re: Watch out: ɢoogle.com isn’t the same as Google.com

#50
post #49

This is something that's been bugging me for years. Why are there multiple representations of alphabet characters in Unicode? It seems reasonable to include accent marks, but what's the benefit in having a Cyrillic 'o' alongside a standard 'o' or the 2 or 3 other ASCII-lookalike sets of characters?

the font metrics and hinting/kerning are likely language or dialect-specific
Post reply on HN