Re: Unicode domain names issue (Encrypting a "fake" domain name)
Justin Dolske <[email protected]> Thu, 20 Apr 2017 16:59:45 -0700
| Newsgroups | gmane.comp.mozilla.security |
|---|---|
| Organization | Mozilla Corporation |
| Message-ID | <[email protected]> |
On 4/20/17 2:54 AM, Gervase Markham wrote: > On 20/04/17 02:56, Boris Zbarsky wrote: >> On 4/19/17 8:40 PM, Justin Dolske wrote: >>> When visiting a page, compute the normalized version domain >> >> Normalized in what sense? > > Presumably, in a "fold it to a canonical form using (the subset used in > IDN of) ftp://ftp.unicode.org/Public/security/latest/confusables.txt" sense. Correct. To be more concrete, with the simple case of apple.com (real) vs аррӏе.com (spoof): both "normalize" to apple.com (plain ascii). If that's in the user's history, the spoofed domain would be displayed as xn--80ak6aa92e.com. Justin _______________________________________________ dev-security mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security