Re: Unicode domain names issue (Encrypting a "fake" domain name)

In mozilla.dev.security, Justin Dolske  <[email protected]> wrote:
> [As much as I hate to wade into this...]
> 
> Hmm. One thing browsers do have is the user's browsing history.

Objection. Configuration to not record history is trivial, and even
if not configured such, some confusables could easily be sites that
the user doesn't visit often enough to have in history.

> Half-baked thought for an imperfect mitigation:
> 
> When visiting a page, compute the normalized version domain, and see if 
> that exists as a history entry. If the entry exists, display the 
> punycode version of the domain. Otherwise, display the unicode version 
> of the domain.

More baked: Using the confusables list from Unicode, if a domain label
consists entirely of letters in one script that are "confusable" to
another (single) script, start raising red flags.

Probably special case things that can be confused with a FULL STOP for
attacks that attempt to just confuse part of the DNS name.

Elijah
------
has not checked to see what can be can be confused with a FULL STOP