3

The example in the title is just one of the many examples of certain domains which should be allowable by IDNA2008 and https://www.verisign.com/assets/allowedcode/idn-allowed-code-points.html (look for "TAI LE LETTER KA" in that list) but firefox/chrome do not play nicely with.

What is going on here?

I am trying to understand why some valid IDN characters are shown in domain names and others are only displayed in their punycode equivalent?

1 Answer 1

5

I am trying to understand why some valid IDN characters are shown in domain names and others are only displayed in their punycode equivalent?

This is a per browser policy, and is done to try to mitigate some attacks.

IDN support is complicated. There are 2 versions of it, it depends on TLDs, and the rules vary a lot about which characters are allowed or not.

For Firefox, it is explained here: https://wiki.mozilla.org/IDN_Display_Algorithm

Operations are governed by various configuration flags, you can search for network.IDN. You will discover that com is NOT in the "whitelist".

For Chrome the policy is at https://chromium.googlesource.com/chromium/src/+/refs/heads/main/docs/idn.md

You can see that "Thai" (the script of the characters in your name) is listed in the WholeScriptConfusableData structure, see https://source.chromium.org/chromium/chromium/src/+/master:components/url_formatter/spoof_checks/idn_spoof_checker.cc;l=286?q=kWholeScriptConfusables&ss=chromium

It has even this extended comment:

  // Some of the Thai characters are only confusable on Linux, so the Linux
  // set is larger than other platforms. Ideally we don't want to have any
  // differences between platforms, but doing so is unavoidable here as
  // these characters look significantly different between Linux and other
  // platforms.
  // The ideal fix would be to change the omnibox font used for Thai. In
  // that case, the Linux-only list should be revisited and potentially
  // removed.

So it is just a matter of avoiding "confusable" display.

If you want far more details on the problem regarding IDNs and "confusable" characters you can look at my extended reply for another question at Punycode and similar characters, specially the section "IDN Homographic Attacks" (which is what browsers are trying to protect against by going back to the Punycode version in some cases).

PS: I am aware the above just give pointers to where to look, not a full explanation of why THIS specific name is displayed encoded and not in native characters. In theory the above policies should explain why for this particular name, but by looking only quickly I don't find the explanation, so would need to study more their policies. The important point remains though that it is a local (browser) decision, so things can change between them, versions, and even OS it seems. If I find time to study more this specific name, I will try to edit my answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.