4

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/

Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple website, but it still says apple[dot]com in my web browser...

References:

https://www.xudongz.com/blog/2017/idn-phishing/

https://thehackernews.com/2017/04/unicode-Punycode-phishing-attack.html

https://en.wikipedia.org/wiki/IDN_homograph_attack

Improve this question
7
  • 1
    It's simply a trade-off between security and usability. We have already discussed how browsers try to prevent these attacks and possible defense measures here: security.stackexchange.com/questions/182680/…
    – Arminius
    Commented Apr 14, 2018 at 0:22
  • If I recall, Chrome/Chromium has some resistance, and Firefox is still vulnerable.
    – forest
    Commented Apr 14, 2018 at 0:31
  • 2
    In Chrome, that URL appears as https://www.xn--80ak6aa92e.com/ both when I mouse over it and in the URL bar when I go to it.
    – Neil Smithline
    Commented Apr 14, 2018 at 0:45
  • In Firefox, it only does that if you set network.IDN_show_punycode to true.
    – forest
    Commented Apr 14, 2018 at 1:03
  • 1
    @AndrolGenhald If I recall, a web page can spoof the bottom left mouseover bar, as Google for example does. It cannot be relied upon. See for example this answer.
    – forest
    Commented Apr 14, 2018 at 2:31

1 Answer 1

Reset to default
1

No, Humans are vulnerable to the homograph attack, browsers are unaffected.

Chrome has a partial work-around that offers a false sense of security to those who buy the hype.

In the general case of the attack both domain names are IDN and the user can't be expected to differentiate between two different random-looking strings of ASCII characters.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .