Looks like HN broke the URL after submitting. Let's try again:<p><pre><code> https://βα΅.β/
</code></pre>
Here is the backup link:<p><a href="https://shkspr.mobi/blog/2018/11/domain-hacks-with-unusual-unicode-characters/" rel="nofollow">https://shkspr.mobi/blog/2018/11/domain-hacks-with-unusual-u...</a>
Not sure why so many things use the compatibility form of normalisation.<p>Some older RFCs even recommended using it for passwords, which needlessly reduces entropy (yes we need to normalise passwords because of combining characters, but we donβt need to collapse symbols that a user can choose from, like ΕΏ and s).<p>In my opinion, the compatibility form makes mostly sense for searching text, and even then itβs sometimes annoying (I want to search exactly for ss and not Γ, browser). If you know of other good use cases let me know.<p>It also OK to disallow registering two identifiers with the same compatibility normalisation form (edit: this does not prevent all homoglyph attacks BTW, that is another can of worms), but I donβt see the need to normalise the identifier when itβs used.
Tangentially related - 20+ years ago I managed to register a Ο domain under one of the primary TLDs.<p>As in, the registration form was accepted and the fee was charged.<p>Then, few days after they emailed to say that "due to technical difficulties" the registration can be registered and they have no choice but to unregister it.<p>I was so close, damn amateurs.
My brother had a friend who tried to register fuck.com in the early days of the Internet, around 1994, and the registrar was confused and wanted to know why he wanted to register it. This was when the Internet was mostly universities and a .com cost $100 to register.
Was that friend Justin Hall of Wired?<p>There was a story about Jon Postel (pre-ICANN) and fuck.com, this might be it:<p><a href="https://www.links.net/webpub/fuck.com.html" rel="nofollow">https://www.links.net/webpub/fuck.com.html</a>
What was his response? Did they refuse to allow it?
I managed to register a one letter domain below a CC-tld, despite that country having a rule against it. Their signup form had two stages and the check was only on the first page... so all it took was changing a hidden form field.<p>I had it for a while until they started charging a lot for it (it was Turkmenistan).
My favorite unicode character is zero width space. One of its funniest properties is that it's not a whitespace.<p>Also, some programming languages treat it as a valid identifier.
> My favorite unicode character is zero width space. One of its funniest properties is that it's not a whitespace.<p>My editor is configured to never show any character (except the one and proper newline) at less than the full-width of a regular character (in the monospace font I'm using ofc).<p>And if it's not a visible ASCII char, not only it's always shown at least at full-width, it's also shown as bold magenta on a black background. As the non visibe zero-width is empty, it shows as full-width on a black background.<p>Sticks out like a sore thumb.
Firefox doesn't even let me open the link, wow.
Same here on Firefox mobile, link is not clickable.
Same, can't open on Firefox
On Firefox, hover-over of the link doesn't show the URL in the bottom left of the browser.
Is it too late to say most Unicode characters should not be permitted in domains?
Looks like that it could be exploited by some means for nefarious purpose.
I wonder why it's even implemented in the first place.
Oh, it can. In fact there's an entire official tome of documentation describing how to carefully do Unicode-in-URLs to reduce the risk[0]. Browsers also have some mitigations to avoid the most common issues like homoglyph attacks where they show the domain in punycode if it doesn't match some local heuristic (like if you're in en-US, it's unlikely you're actually trying to visit a site with Cyrillic letter "a" instead of ASCII "a").<p>It's implemented because we have thousands of writing systems and we decided, for better or worse, we want to reflect those in URLs. Solving the subsequent security issues is likely easier than getting everyone to agree to read and write the same language.<p>[0]: <a href="https://www.unicode.org/reports/tr36/tr36-10.html" rel="nofollow">https://www.unicode.org/reports/tr36/tr36-10.html</a>
This has given me a lot of trouble with emails.<p>I have a domain that contains Nordic characters and it is a crapshoot if the email client will accept and send.<p>Meanwhile I have not encountered problems with http access.
There have been some additions since 2018 when this article was written; here is the current list, from what I can tell:<p><pre><code> γ³ β 003373 β SQUARE AU β AU β Australia
γ΄ β 003374 β SQUARE BAR β BAR β Bar, Punto 2012 Sociedad Anonima Promotora de Inversion de Capital Variable
γ β 003388 β SQUARE CAL β CAL β Google
γ β 0033CE β SQUARE KM β CAPITAL β KM Comoros
γ β 0033C4 β SQUARE CC β CC β Cocos (Keeling) Islands
γ
β 0033C5 β SQUARE CD β CD β The Democratic Republic of the Congo
οΏ½ β 01F12D β CIRCLED CD β CD β The Democratic Republic of the Congo
γ β 00339D β SQUARE CM β CM β Cameroon
οΏ½ β 01F190 β SQUARE DJ β DJ β Djibouti
γ· β 003377 β SQUARE DM β DM β Dominica
Η± β 0001F1 β LATIN CAPITAL LETTER DZ β DZ β Algeria
Η³ β 0001F3 β LATIN SMALL LETTER DZ β DZ β Algeria
Η² β 0001F2 β LATIN CAPITAL LETTER D WITH SMALL LETTER Z β DZ β Algeria
ο¬ β 00FB01 β LATIN SMALL LIGATURE FI β FI β The Republic of Finland
γ β 003399 β SQUARE FM β FM β Federated States of Micronesia
γΏ β 0033FF β SQUARE GAL β GAL β Galicia, Spain
γ β 003387 β SQUARE GB β GB β United Kingdom
γ β 0033C9 β SQUARE GY β GY β Guyana
γ β 0033CC β SQUARE IN β IN β The Republic of India
γ β 00338F β SQUARE KG β KG β Kyrgyzstan
γ β 00339E β SQUARE KM β KM β Comoros
γΎ β 0033BE β SQUARE KW β KW β Kuwait
γ β 0032CF β LIMITED LIABILITY SIGN β LTD β Binky Moon, LLC
γ β 003383 β SQUARE MA β MA β Morocco
οΏ½ β 01F16A β RAISED MC SIGN β MC β Monaco
οΏ½ β 01F16B β RAISED MD SIGN β MD β The Republic of Moldova
γ β 00338E β SQUARE MG β MG β Madagascar
γ β 0033D5 β SQUARE MIL β MIL β United States Military
γ β 00339C β SQUARE MM β MM β Myanmar
οΏ½ β 01F16C β RAISED MR SIGN β MR β Mauritania
γ³ β 0033B3 β SQUARE MS β MS β Montserrat
γ· β 0033B7 β SQUARE MV β MV β Maldives
γΉ β 0033B9 β SQUARE MV MEGA β MV β Maldives
οΏ½ β 01F14B β SQUARED MV β MV β Maldives
γ½ β 0033BD β SQUARE MW β MW β Malawi
γΏ β 0033BF β SQUARE MW MEGA β MW β Malawi
γ β 003381 β SQUARE NA β NA β Namibia
γ β 00338B β SQUARE NF β NF β Norfolk Island
β β 002116 β NUMERO SIGN β NO β The Kingdom of Norway
γ β 003380 β SQUARE PA AMPS β PA β Panama
γ© β 0033A9 β SQUARE PA β PA β Panama
γ β 00338A β SQUARE PF β PF β French Polynesia
γ β 0033D7 β SQUARE PH β PH β The Republic of the Philippines
γ β 0033DA β SQUARE PR β PR β Puerto Rico (U.S.)
γ° β 0033B0 β SQUARE PS β PS β Palestinian Territory, Occupied
γΊ β 0033BA β SQUARE PW β PW β Palau
β¨ β 0020A8 β RUPEE SIGN β RS β Serbia
οΏ½ β 01F14C β SQUARED SD β SD β Sudan
β β 002120 β SERVICE MARK β SM β San Marino
γ β 0033DB β SQUARE SR β SR β Suriname
01F14D β SQUARED β SS β SS β South Sudan
ο¬ β 00FB06 β LATIN SMALL LIGATURE ST β ST β Sao Tome and Principe
γ β 0033DC β SQUARE SV β SV β El Salvador
β‘ β 002121 β TELEPHONE SIGN β TEL β Contact data
β’ β 002122 β TRADE MARK SIGN β TM β Turkmenistan
β
₯ β 002165 β ROMAN NUMERAL SIX β VI β Virgin Islands, U.S.
β
΅ β 002175 β SMALL ROMAN NUMERAL SIX β VI β Virgin Islands, U.S.
γ½ β 00333D β SQUARE POINTO β γγ€γ³γ β Amazon Registry Services, Inc.</code></pre>
Here is the URL encoded in base64 so HN does not break it:<p>aHR0cHM6Ly/wn4WC8J2WjfCdkKTigpvhtZbwnZKTLuKTnPCdlaDwnZKD8J2Tsi/wn4aG8J+Gg/CfhbU=
I click on the link on Android Firefox and nothing happens.
My browser refuses to open this link. It couldnβt find the server.
Which of course Bruce Schneier predicted in 2000:<p><a href="https://www.schneier.com/crypto-gram/archives/2000/0715.html#9" rel="nofollow">https://www.schneier.com/crypto-gram/archives/2000/0715.html...</a><p><i>"Unicode is just too complex to eve be secure"</i><p>As to me I'm running my own DNS resolver (I use <i>unbound</i>) and everything goes through port 53 UDP (and AIUI technically 53 TCP should be allowed, but nothing will happen if you just block it), unencrypted. What then unbound does on the Internet, that's up to you: you can encrypt those requests...<p>The nice thing with everything being in the clear, is that you can null route / NX DOMAIN every single domain that uses Unicode (punnycode) characters and you can even do that at the firewall level, by inspecting UDP packets.<p>Of course you gotta be sure to really block DoH / DoT internally but it's all doable.<p>I set that up years ago and I've been running like that since then without any issue.<p>Just as entire countries's IP blocks do not exist in my world, domains using Unicode characters do not exist. And I really don't care about your feelings about it: I'm just explaining that technically it can be done to block them all and that the Internet keeps working just fine.<p>Unicode <i>really</i> is just too complex to ever be secure. And those who don't understand that are part of the problem.
Now, please present a list of these to your grandmother, and ask her which ones are phishing, and which are legitimately from the government.<p>Now, present the same list to an I.T. professional with the same questions. Perhaps make sure they are not carrying any weapons before you try.<p>This is just one reason why visual inspection of URLs and "hover over this link" haven't been useful defenses for a long time.
[flagged]