Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Forget google. Can you do this in domain names?



No, you're mistaken. It is actually a very big problem. Earlier on the same page you linked to, it explain that "ICANN approved the Internationalized domain name system, which maps Unicode strings used in application user interfaces"[1].

As a concrete example, the following are fake links to Wikipedia (and entirely equivalent):

http://xn--wkd-8cdx9d7hbd.org (FAKE, same as below)

http://www.wіkіреdіа.org (FAKE, same as above)

It is true that network protocols encode these internationalized domain names in a subset of ASCII, but the user sees Unicode in his browser address bar or email. There is no restriction on how applications (like browsers) display domain names[2]; they can use Unicode if they want. This lead to all sorts of devious attacks[3].

[1] https://en.wikipedia.org/wiki/Domain_name#Internationalized_...

[2] https://en.wikipedia.org/wiki/Internationalized_domain_name#...

[3] https://en.wikipedia.org/wiki/IDN_homograph_attack




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: