Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internationalized domain names in Linux

bogdan.nimblex.net

Post reply on HN
Print view View original

1–10 of 19 posts

Re: Internationalized domain names in Linux

#2

Post by michaelmrose »

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=279099 or this site that looks like apple.com

https://www.xn--80ak6aa92e.com/

regarding homographic or look alike character attacks. As an American only fluent in English I'm enormously more likely to encounter malicious content than content that is useful to me on internationalized domain names.

To make this less likely you can set

network.IDN_show_punycode true

in about:config for firefox or in your profile directory you can create a user.js file and add this line.

user_pref("network.IDN_show_punycode", true)

Re: Internationalized domain names in Linux

#3

Post by Sir_Cmpwn »

michaelmrose wrote: post #2

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=279099 or this site that looks like apple.com https://www.xn--80ak6aa92e.com/ regarding homographic or look alike character attacks. As an American only fluent in English I'm enormously more likely to encounter malicious content than content that is useful to me on internationalized domain names. To make this less likely you can set network.IDN_show_punycode tru…

Exactly this. Punycode is poorly supported because no one wants it, it just opens a huge front for phishing.

Re: Internationalized domain names in Linux

#5

Post by CaliforniaKarl »

It seems to me what libidn2 should be used instead. As per https://www.gnu.org/software/libidn/…

> Please be aware that GNU libidn2 is the successor of GNU libidn. It comes with IDNA 2008 and TR46 implementation and also provides a compatibility layer for GNU libidn.

Re: Internationalized domain names in Linux

#6

Post by CaliforniaKarl »

jwilk wrote: post #4

The author is confused. glibc does support IDN, but of course it's not enabled by default. The applications that want IDN have to opt in by specifying an appropriate flag. http://man7.org/linux/man-pages/man3/getaddrinfo.3.html (search for "Internationalized Domain Names")

It looks like getaddrinfo does have that ability, but I could not tell if gethostbyname supports it.

Re: Internationalized domain names in Linux

#7

Post by jwilk »

CaliforniaKarl wrote: post #6
jwilk wrote: post #4

The author is confused. glibc does support IDN, but of course it's not enabled by default. The applications that want IDN have to opt in by specifying an appropriate flag. http://man7.org/linux/man-pages/man3/getaddrinfo.3.html (search for "Internationalized Domain Names")

It looks like getaddrinfo does have that ability, but I could not tell if gethostbyname supports it.

gethostbyname() is obsolete. And no, it doesn't support IDN.

Re: Internationalized domain names in Linux

#8

Post by estebank »

Sir_Cmpwn wrote: post #3
michaelmrose wrote: post #2

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=279099 or this site that looks like apple.com https://www.xn--80ak6aa92e.com/ regarding homographic or look alike character attacks. As an American only fluent in English I'm enormously more likely to encounter malicious content than content that is useful to me on internationalized domain names. To make this less likely you can set network.IDN_show_punycode tru…

Exactly this. Punycode is poorly supported because no one wants it, it just opens a huge front for phishing.

This is a very anglocentric view of the internet.

Most of the problems with the full unicode set can be sidestepped by a combination of UAX #31[1], NFKC[2], ignoring ligatures and digraphs[3], and following UTR #39[4].

Cyrillic apple.com is one of the few cases where it is still problematic and extra UI feedback would be needed.

[1]: http://unicode.org/reports/tr31/

[2]: http://unicode.org/reports/tr15/

[3]: https://www.unicode.org/faq/ligature_digraph.html

[4]: http://unicode.org/reports/tr39/tr39-1.html

Re: Internationalized domain names in Linux

#9

Post by jwilk »

michaelmrose wrote: post #2

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=279099 or this site that looks like apple.com https://www.xn--80ak6aa92e.com/ regarding homographic or look alike character attacks. As an American only fluent in English I'm enormously more likely to encounter malicious content than content that is useful to me on internationalized domain names. To make this less likely you can set network.IDN_show_punycode tru…

IDN homograph attack discussed on HN:

https://news.ycombinator.com/item?id=14130241

Another "fun" thing about IDN is that there are two incompatible versions:

https://www.unicode.org/reports/tr46/

Re: Internationalized domain names in Linux

#10

Post by Sir_Cmpwn »

estebank wrote: post #8
Sir_Cmpwn wrote: post #3

Earlier quoted context omitted.

Exactly this. Punycode is poorly supported because no one wants it, it just opens a huge front for phishing.

This is a very anglocentric view of the internet. Most of the problems with the full unicode set can be sidestepped by a combination of UAX #31[1], NFKC[2], ignoring ligatures and digraphs[3], and following UTR #39[4]. Cyrillic apple.com is one of the few cases where it is still problematic and extra UI feedback would be needed. [1]: http://unicode.org/reports/tr31/ [2]: http://unicode.org/reports/tr15/ [3]: https://…

I'm no anglocentrist, I read and write in Japanese and I'm acutely aware of the technical and social problems and motivations for punycode.

>Cyrillic apple.com is one of the few cases where it is still problematic

One of the many, you mean. Punycode has actually been implemented in several places and rolled back because the problems are so severe.

Post reply on HN