Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand that IDN's are basically a GUI display change for domains that have a prefix of "xn--".

What should I advise companies do in regards to these domains?

For example, should companies actively seek out and register domains in alternative (similar looking) character sets? What tools, or logic should be followed?

Are there any known certificate validation issues?

share|improve this question
up vote 4 down vote accepted

The most risky are so called IDN-spoofing attacks that are possible due to visually similar symbols. That is some side-effect when trying to introduce Unicode.

Regarding this topic I can recommend official Unicode consortium technical report:, titled Unicode Security Considerations and article on Wikipedia:, and some more interesting reading:

Also, as addendum - FireFox extension to protect yourself:

share|improve this answer

I wrote a small series explaining more about this a few years ago at

To answer your question, I would not suggest you advise companies to register all the confusable versions of their domains - it's not practical or possible. The ones who bear the responsibility here are the user-agents (Web browsers and email clients) and the registrars and registries who could work together to mitigate this problem more - but still not fully. I've put together a proposal for this and had my company build a library to assist user-agents or other software vendors in identifying confusables and IDN visual spoofing.

You can find a description of this 'confusable string detection' API at our site and you may enjoy the related white paper which goes into some visual detail about the issue.

And as Ams points out the Unicode Technical Report 36 describes the issue as well.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.