<story><title>Phishing attack uses Unicode characters in domains to clone known safe sites</title><url>https://www.wordfence.com/blog/2017/04/chrome-firefox-unicode-phishing</url></story><parent_chain><item><author>userbinator</author><text>For reference, the example is using:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    U+0435 CYRILLIC SMALL LETTER IE
    U+0440 CYRILLIC SMALL LETTER ER
    U+0456 CYRILLIC SMALL LETTER BYELORUSSIAN-UKRAINIAN I
    U+0441 CYRILLIC SMALL LETTER ES
&lt;/code&gt;&lt;/pre&gt;
...which are basically &lt;i&gt;indistinguishable&lt;/i&gt; from the corresponding ASCII (65 70 69 63) in most if not all fonts.&lt;p&gt;I don&amp;#x27;t see this as being an easy or even solvable problem in general --- after all, a Russian IDN registrar could rightly argue that it should be valid to use all Cyrillic characters in IDNs; but at least for those of us who are content with English-only domain names, we can just disable IDN.&lt;p&gt;I suppose one solution would be, when IDN is detected, to show both the Unicode and Punycoded versions:&lt;p&gt;[www.xn--e1awd7f.com]&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.epic.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.epic.com&amp;#x2F;&lt;/a&gt;&lt;p&gt;One could also argue that this is also a usability feature, for easy copying of IDNs by those who otherwise cannot write them.</text></item></parent_chain><comment><author>wodenokoto</author><text>Didn&amp;#x27;t Firefox show puny code in the url bar once?&lt;p&gt;The problem is quite old. [1] is a 12 year old bug report on this very problem in Mozilla.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;bugzilla.mozilla.org&amp;#x2F;show_bug.cgi?id=279099&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;bugzilla.mozilla.org&amp;#x2F;show_bug.cgi?id=279099&lt;/a&gt;</text></comment>
<story><title>Phishing attack uses Unicode characters in domains to clone known safe sites</title><url>https://www.wordfence.com/blog/2017/04/chrome-firefox-unicode-phishing</url></story><parent_chain><item><author>userbinator</author><text>For reference, the example is using:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    U+0435 CYRILLIC SMALL LETTER IE
    U+0440 CYRILLIC SMALL LETTER ER
    U+0456 CYRILLIC SMALL LETTER BYELORUSSIAN-UKRAINIAN I
    U+0441 CYRILLIC SMALL LETTER ES
&lt;/code&gt;&lt;/pre&gt;
...which are basically &lt;i&gt;indistinguishable&lt;/i&gt; from the corresponding ASCII (65 70 69 63) in most if not all fonts.&lt;p&gt;I don&amp;#x27;t see this as being an easy or even solvable problem in general --- after all, a Russian IDN registrar could rightly argue that it should be valid to use all Cyrillic characters in IDNs; but at least for those of us who are content with English-only domain names, we can just disable IDN.&lt;p&gt;I suppose one solution would be, when IDN is detected, to show both the Unicode and Punycoded versions:&lt;p&gt;[www.xn--e1awd7f.com]&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.epic.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.epic.com&amp;#x2F;&lt;/a&gt;&lt;p&gt;One could also argue that this is also a usability feature, for easy copying of IDNs by those who otherwise cannot write them.</text></item></parent_chain><comment><author>dolzenko</author><text>Isn&amp;#x27;t it possible to detect the mixture of cyrillic vs english and so on?</text></comment>