Re: Unicode domain names issue (Encrypting a "fake" domain name)

Kai Engert <[email protected]> Tue, 18 Apr 2017 23:32:44 +0200
Newsgroups gmane.comp.mozilla.security
Message-ID <[email protected]>

On 18 April 2017 23:00:24 GMT+02:00, Boris Zbarsky <[email protected]> wrote:
>Here's a question that I think any proposal here should be able to 
>address:  Given two strings of glyphs, both non-ASCII, which are 
>homographs of each other, does the proposed solution help?
>
>I think showing two different blobs of "xn--****" noise does not help 
>distinguish cases like that, unless someone is doing a careful 
>side-by-side comparison.

IIUC, Dan said, mixed scripts are always shown as xn--, never rendered.

I think that means, if thete are two different domains, that are rendered similarly, must originate from two different scripts.

If correct, then displaying the name of the script next to the rendering (cyrillic: epic.com) could be sufficient to allow them to be distinguished, without requiring comparison of the xn-- strings?

Kai