Re: Unicode domain names issue (Encrypting a "fake" domain name)

Kai Engert <[email protected]> Tue, 18 Apr 2017 22:39:40 +0200
Newsgroups gmane.comp.mozilla.security
Message-ID <[email protected]>
Another idea, inspired by the UI for sites having an extended validation (EV)
certificate:

If the URL isn't plain ASCII, but a better rendering is available, then display
the better rendering to the left of the URL bar, but display the URL itself in
plain xn-- style.

For an extended validation site that used non-ascii characters, the URL bar
could look like this:

[lock] [company name(country)] [cyrillic: epic.com] https://xn--e1awd7f.com/

non-EV:

[lock] [cyrillic: epic.com] https://xn--e1awd7f.com/

Highlighting could be used to make it likely that [cyrillic epic.com] is
properly noticed.

Maybe the extra term "cyrillic" isn't necessary, when this approach is used.

Given that the location to the left of the URL is already being used to display
browser determined/approved information, this could be seen as the appropriate
place to display pretty hostname renderings.

Given that the https:// location is a "technical" string, and given that the
underlying standards allow ascii characters here, only, maybe this could be an
acceptable compromise?

Kai