Xudong Zhang writes about security and hardware projects, including Unicode domain phishing and a solar-powered wireless mechanical keyboard.
HN commenters mostly link his IDN phishing post as an explanation of homograph attacks and note that browsers have since mitigated them.
That wasn't quite what they were talking about. They were talking about IDN Phishing [0] and not http-->https redirection (which is what HSTS is directed towards). But since we're talking about DNS redirection the http:// handshake against the legitimate server never happens, you're only ever visiting a malicious website (which the certificate checks would all fail - except visually in the case of IDN phishing which only works against Firefox users).
[0] https://www.xudongz.com/blog/2017/idn-phishing/
[1] https://www.аррӏе.com/ (this will show the punycode domain on HN, visit it in Firefox it will look just like https://apple.com )
[2] The cert still shows punycode though most users wouldn't check the cert: https://kimiwo.aishitei.ru/i/MMFWtvE5ZgYdHWki.png
I've been working on a aluminum and wireless version of the ErgoDox and the group buy will start this weekend. It will be around $350 excluding switches and keycaps.
With DSA keycaps (the shortest possible one) the total height is 29mm (including rubber feet).
You can see the details of the earlier laser cut prototype here (and subscribe to the mailing list for updates): https://www.xudongz.com/blog/2020/ergoblue/. The details of the aluminum version will be announced when the group buy is officially announced.
You can find also my contact information on my homepage for questions and feedback.
But as the title of the post says, browsers already solved this problem.
https://www.xudongz.com/blog/2017/idn-phishing/
It does make running commands from an untrusted website a little safer, which is nice. I imagine it's not uncommon to copy installation scripts from random StackOverflow comments or blog posts, for example. But that's still not safe even with this tool. Homograph attacks aside, how can you tell if a URL you're pasting into your terminal is the official source for something? It's trivial to create fake GitHub accounts or organizations.
Somewhat off-topic, but the explosion Unicode glyphs can lead to problems more serious than aesthetics:
Punycode exploit: https://www.xudongz.com/blog/2017/idn-phishing/
Greek question mark: https://stackoverflow.com/questions/26965331/javascript-prank-joke
Shameless plug: https://github.com/BourgeoisBear/A-E-S-T-H-E-T-I-C
This seems ripe for phishing, similar to @аррӏе.com (which isn't @apple.com -- go ahead and check) and someone actually did this once. [0] There are lots of emojis that are hard to tell apart from each other.
[0] https://www.xudongz.com/blog/2017/idn-phishing/
Firefox users: be sure to set "network.IDN_show_punycode" to "true" in about:config.
Test with the fake Apple domain https://www.xn--80ak6aa92e.com/ .
See "Phishing with Unicode Domains" for more information: https://www.xudongz.com/blog/2017/idn-phishing/ .