How does Punycode solve (or plan to solve) the issue with identical characters?

In most browsers now Punycode is disabled unless you enable it in language preferences.

This works great except many alphabets like Cyrillic have an a that looks identical to the the a used in Latin scripts. You can't ignore the Latin script for backwards compatibility reasons which leads me to believe they must ignore the Cyrillic a.

list of homographs


Different clients have different mitigations, but the common thread is that they usually prevent an attacker from mixing homographs from different alphabets by falling back to punycode if more than one alphabet is used:

  • Google Chrome versions 51 and later use an algorithm similar to the one used by Firefox. Previous versions display an IDN only if all of its characters belong to one (and only one) of the user's preferred languages.

  • Safari's approach is to render problematic character sets as Punycode. This can be changed by altering the settings in Mac OS X's system files.

  • Mozilla Firefox versions 22 and later display IDNs if either the TLD prevents homograph attacks by restricting which characters can be used in domain names or labels do not mix scripts for different languages. Otherwise IDNs are displayed in Punycode.

IDN homograph attack - Wikipedia

To speak to your specific example of aa.com in Cyrillic script, here is Google Chrome's rule that detects that and displays punycode. Other browsers generally use similar rules:

  • If a hostname belongs to an non-IDN TLD(top-level-domain) such as 'com', 'net', or 'uk' and all the letters in a given label belong to a set of Cyrillic letters that look like Latin letters (e.g. Cyrillic Small Letter IE - е ), show punycode.

IDN in Google Chrome

  • So what about aa.com ? Is that supposed to be Latin or Cyrillic? – William Nov 30 '18 at 1:28
  • @William To the best of my knowledge a domain like that is considered "ambiguous" by these algorithms, and will fall back to punycode when the user is visiting a domain of a different language than their browser is set to. – Maximillian Laumeister Nov 30 '18 at 1:34
  • @William See my update for details on that specific example. – Maximillian Laumeister Nov 30 '18 at 1:39

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.