Re: Unicode domain names issue (Encrypting a "fake" domain name)

On 4/20/17 3:54 PM, Eli the Bearded wrote:
> In mozilla.dev.security, Justin Dolske  <[email protected]> wrote:
>> [As much as I hate to wade into this...]
>>
>> Hmm. One thing browsers do have is the user's browsing history.
>
> Objection. Configuration to not record history is trivial, and even
> if not configured such, some confusables could easily be sites that
> the user doesn't visit often enough to have in history.

Yep.

I don't think "browsing history disabled" is necessarily common enough 
to worry about (for an imperfect mitigation), but in any case 
not-yet-visited is certainly an issue. Hence, again, "imperfect 
mitigation". :-)

> More baked: Using the confusables list from Unicode, if a domain label
> consists entirely of letters in one script that are "confusable" to
> another (single) script, start raising red flags.

Sure, but the angle I found interesting here was to make a guess as to 
which one is the legitimate site for the user, based solely on local 
user data and avoiding favoring a particular script.

Justin