IDN spoofing homograph attacks with U+0105 Latin Small Letter A with Ogonek
Categories
(Firefox :: Address Bar, defect)
Tracking
()
People
(Reporter: houjingyi647, Unassigned)
Details
(Keywords: reporter-external, Whiteboard: [reporter-external] [client-bounty-form] [verif?])
Attachments
(1 file)
|
269.96 KB,
application/x-zip-compressed
|
Details |
Steps to reproduce:
Click on link with Unicode: ą(U+0105) instead of latin a.
Go to https://www.pąypal.com for example.
Actual results:
Address bar shows this like unicode (https://www.pąypal.com)
Expected results:
Address bar should show this in punycode (www.xn--pypal-3wa.com)
Tested on windows10, both firefox 76.0.1 and firefox 77.0b5.
I do not think it is very easy for normal people to notice the difference. Also, I tested chrome and address bar show in punycode.
|
||
Updated•5 years ago
|
|
||
Comment 2•5 years ago
|
||
FWIW, Safari doesn't convert this to punycode either. (And I don't think we should, as a general rule.) Accented Latin letters are perfectly legitimate in domain names. Vowels with ogonek are used (for example) in Polish, and Polish people should be able to have Polish domain names without them being displayed as punycode gibberish.
|
||
Comment 3•5 years ago
|
||
As this is a known issue, it does not qualify for a bounty.
|
||
Updated•1 year ago
|
Description
•