Top all-time · #5344
Xudong Zheng
Personal blog · xudongz.com/blog · on HN as xudongzhardwaresecurity
Xudong Zheng's personal blog at xudongz.com covers hardware and security. Since 2017, 15 different Hacker News readers have linked it 19 times, most often “Phishing with Unicode Domains”. The last post was in 2017, but the archive is still widely read.
Too few sampled comments (10) to say how often HN recommends it.?
Why HN links it
HN readers link this blog's 2017 post on IDN homograph phishing, where Unicode look-alike domains imitate sites such as Apple's. Commenters cite it when discussing browser punycode display and phishing defences.
Summarised by Claude from a sample of 10 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Phishing with Unicode Domains15 people · 15 mentions · first linked 2017-04-14
What Hacker News says?
This seems ripe for phishing, similar to @аррӏе.com (which isn't @apple.com -- go ahead and check) and someone actually did this once. [0] There are lots of emojis that are hard to tell apart from each other. [0] https://www.xudongz.com/blog/2017/idn-phishing/
Comment linking /blog/2017/idn-phishing/
on “I bought 300 emoji domain names from Kazakhstan and built an email service”Submitted Phishing with Unicode Domains as a story · 129 points
HN discussionThe attacker doesn’t need to spoof anything, this is known as a homograph attack: https://en.m.wikipedia.org/wiki/IDN_homograph_attack https://www.xudongz.com/blog/2017/idn-phishing/
Comment linking /blog/2017/idn-phishing/
on “Scammed out of $130K via fake Google call, spoofed Google email and auth sync”Submitted Phishing with Unicode Domains as a story · 8 points
HN discussionhttps://www.xudongz.com/blog/2020/ergoblue/firmware/ has a lot more information about the controller (with photos). In summary: - The dongle is reasonably small. If you're traveling with it, you can toss it in your bag with a battery pack and it acts as a Bluetooth keyboard (for your phone/tablet/laptop/etc). You can plug it into your desktop, in which case it acts as a USB keyboard in addition to Bluetooth for othe…
Comment linking /blog/2020/ergoblue/firmware/
on “Split keyboards and how to build them”Submitted I built a solar powered, wireless mechanical keyboard as a story · 2 points
HN discussionI've been working on a aluminum and wireless version of the ErgoDox and the group buy will start this weekend. It will be around $350 excluding switches and keycaps. With DSA keycaps (the shortest possible one) the total height is 29mm (including rubber feet). You can see the details of the earlier laser cut prototype here (and subscribe to the mailing list for updates): https://www.xudongz.com/blog/2020/ergoblue/ .…
Comment linking /blog/2020/ergoblue/
on “Split keyboards and how to build them”Submitted Phishing with Unicode Domains as a story · 2 points
HN discussionThis was posted the other day, checking its green isn't enough. https://www.xudongz.com/blog/2017/idn-phishing/ Edited: you're right I thought you meant just check its https.
Comment linking /blog/2017/idn-phishing/
on “You think you can't be phished?”Submitted Phishing with Unicode Domains as a story · 2 points
HN discussionI think this is something worth showing in your class https://www.xudongz.com/blog/2017/idn-phishing/
Comment linking /blog/2017/idn-phishing/
on “UCLA CS88S: Safety in the Cloud – Introduction to Cybersecurity”Submitted Punycode phishing still works in Firefox – grr as a story · 1 points
HN discussionThat wasn't quite what they were talking about. They were talking about IDN Phishing [0] and not http-->https redirection (which is what HSTS is directed towards). But since we're talking about DNS redirection the http:// handshake against the legitimate server never happens, you're only ever visiting a malicious website (which the certificate checks would all fail - except visually in the case of IDN phishing which…
Comment linking /blog/2017/idn-phishing/
on “Why No HTTPS?”Yeah its a problem for domain names too: https://www.xudongz.com/blog/2017/idn-phishing/
Comment linking /blog/2017/idn-phishing/
on “37k Chrome users downloaded a fake Adblock Plus extension”Somewhat off-topic, but the explosion Unicode glyphs can lead to problems more serious than aesthetics: Punycode exploit: https://www.xudongz.com/blog/2017/idn-phishing/ Greek question mark: https://stackoverflow.com/questions/26965331/javascript-pran... Shameless plug: https://github.com/BourgeoisBear/A-E-S-T-H-E-T-I-C
Comment linking /blog/2017/idn-phishing/
on “Ligatures in programming fonts”Firefox users: be sure to set "network.IDN_show_punycode" to "true" in about:config. Test with the fake Apple domain https://www.xn--80ak6aa92e.com/ . See "Phishing with Unicode Domains" for more information: https://www.xudongz.com/blog/2017/idn-phishing/ .
Comment linking /blog/2017/idn-phishing/
on “Attackers Used Look-Alike Domains to Steal $1M from a Chinese VC”This past year I designed the ErgoBlue ( https://www.xudongz.com/blog/2020/ergoblue/ ), a split ErgoDox keyboard that is wireless and solar powered. I'm obviously biased but I think it's a pretty unique build. The interest check ran a few weeks ago and the group buy will run in a few weeks (group buys are essentially preorders where a certain number of quantity is required in order to achieve some economies of scale…
Comment linking /blog/2020/ergoblue/
on “Coolest custom mechanical keyboards”It's a bit disingenuous ars technica ledes with a screenshot of a homograph attack that Chrome mitigated in March 2017, and really doesn't relate to the article. https://www.xudongz.com/blog/2017/idn-phishing/
Comment linking /blog/2017/idn-phishing/
on “Google wants to get rid of URLs but doesn’t know what to use instead”But as the title of the post says, browsers already solved this problem. https://www.xudongz.com/blog/2017/idn-phishing/ It does make running commands from an untrusted website a little safer, which is nice. I imagine it's not uncommon to copy installation scripts from random StackOverflow comments or blog posts, for example. But that's still not safe even with this tool. Homograph attacks aside, how can you tell if…
Comment linking /blog/2017/idn-phishing/
on “The browser catches homograph attacks. Your terminal doesn't”