I failed to make LinkedIn fix their broken international domain URL parser
1–10 of 94 posts
Re: I failed to make LinkedIn fix their broken international domain URL parser
#2As a funny side note, I cannot load https://xn--coronaprver-ngb.dk/ in Brave, which also seems to be confused by Internationalised domain names.
This is what I see:
> This server could not prove that it is xn--coronaprver-ngb.dk; its security certificate is from *.coronaprover.dk. This may be caused by a misconfiguration or an attacker intercepting your connection.
Edit: Hah! And HN is also guilty of being confused by this. My comment now says "xn-coronoprver-ngb" when viewed from the outside, but my comment field correctly says "coronaprøver" when editing the comment...
Re: I failed to make LinkedIn fix their broken international domain URL parser
#3I'm not surprised the author can't convince LinkedIn to change anything. Had a similar experience with Tinder where Paying in their web application using a danish credit card failed because their cc service returned "visadankort", which had to be changed to "visa" through the developer console for the payment to go through. Got tired of that and filed a bug. Oh the battle it took to actually convince them that an entire country is unable to pay in the web app using their de facto credit card.
Re: I failed to make LinkedIn fix their broken international domain URL parser
#4> tried e-mailing their security e-mail (no reply)
No wonder, it's not a security issue. At least not yet, have you tried injecting new-lines?
Re: I failed to make LinkedIn fix their broken international domain URL parser
#5+1 for leading me to https://en.wikipedia.org/wiki/Punycode, I had no idea this monstrosity exists :)
Re: I failed to make LinkedIn fix their broken international domain URL parser
#6As a funny side note, I cannot load https://xn--coronaprver-ngb.dk/ in Brave, which also seems to be confused by Internationalised domain names. This is what I see: > This server could not prove that it is xn--coronaprver-ngb.dk; its security certificate is from *.coronaprover.dk. This may be caused by a misconfiguration or an attacker intercepting your connection. Edit: Hah! And HN is also guilty of being confused b…
What’s the problem? That certificate is only valid for coronaprover.dk, not coronaprøver.dk or xn--coronaprver-ngb.dk.
Re: I failed to make LinkedIn fix their broken international domain URL parser
#7This is actually one of the lazy ways to deal with https://en.wikipedia.org/wiki/IDN_homograph_attack
The better way would probably be to use chromes list of when to allow IDN and when to convert to punycode: https://chromium.googlesource.com/chromium/src/+/master/docs...
Re: I failed to make LinkedIn fix their broken international domain URL parser
#8This is the problem I had in mind when building https://chota.link. I have seen too many broken previews. This little app lets you create short link and specify metatags. Try this short link on LinkedIn: https://chota.link/jVZ2Hd. I tested it and seems to be working.
Re: I failed to make LinkedIn fix their broken international domain URL parser
#9There are also issues with their preview image cache, it's been broken for at least three years already but they still haven't fixed it... Once your url has the wrong image, good luck updating it, you might as well redirect everybody to a new url.
Re: I failed to make LinkedIn fix their broken international domain URL parser
#10As a funny side note, I cannot load https://xn--coronaprver-ngb.dk/ in Brave, which also seems to be confused by Internationalised domain names. This is what I see: > This server could not prove that it is xn--coronaprver-ngb.dk; its security certificate is from *.coronaprover.dk. This may be caused by a misconfiguration or an attacker intercepting your connection. Edit: Hah! And HN is also guilty of being confused b…
What’s the problem? That certificate is only valid for coronaprover.dk, not coronaprøver.dk or xn--coronaprver-ngb.dk.
The problem is that Brave fails when you navigate to "coronaprøver.dk" while both Chrome and Firefox works when you go there. Although Firefox and Chrome redirects to two different sites, they don't present a certificate error, while Brave does.