Slashdot Mirror
Google Chrome To Get Warnings For 'Lookalike URLs' (zdnet.com)
Google Chrome browser is set to add a feature that will warn users when accessing sites with domain names that look like authentic websites. From a report: The feature has been in the works for quite some time at Google and is a response to the practice of using typosquatted domains or IDN homograph attacks to lure users on websites they didn't intend to access. Since the release of Chrome Canary 70, Google engineers have been testing a new feature called "Navigation suggestions for lookalike URLs." In Chrome Canary distributions -- Google Chrome's testing ground for new features -- users can access the following URL to enable the feature: chrome://flags/#enable-lookalike-url-navigation-suggestions.
Oh, but that would mean ICANN would make less money.
approved ads will always be accepted.
Domestic spying is now "Benign Information Gathering"
This much better solution was Public Key Pinning. Works great, but is of course not loved by the advertisement industry who wants you to watch content from constantly changing crappy domains.
...in order to check if you're visiting a lookalike URL, they'll need to know what you're actually visiting.
Oh noes, privacy?
Well, they already check what sites you are visiting, so don't worry, your privacy is already gone anyway.
Firefox more privacy? You're naive.
Source: https://support.mozilla.org/en-US/kb/how-does-phishing-and-malware-protection-work?as=u&utm_source=inproduct#w_how-does-phishing-and-malware-protection-work-in-firefox
"Phishing and Malware Protection works by checking the sites that you visit against lists of [...]"
Ubuntu better? Hah, yeah.
Took them almost 4 years (October 2012-April 2016) to turn off the shopping lens that tracks user's queries.
Mint better? Sure, buddy.
Default search engine is a custom Yahoo search that tracks queries.
Oh, Firefox saving screenshots to their server.
Remember that recent article?
You know the list goes on and on.
For fun, look into "service workers".
This isn't so much a problem for English speakers. We see the URLs as the ASCII characters but eventually ICANN decided to approve punycode https://en.wikipedia.org/wiki/... so we could have URLs in other character sets. The problem is that there are hundreds of character sets and many of these have characters that are visually difficult to distinguish. So now I can have two URLs that might actually be displayed identically in my browser that are actually different. I'm not 100% sure how this could have been avoided. It sucks for the non-english world. It could however have been mitigated if CAs check for URLs that are visually similar to existing URLs and not sign the certs for the new requests. With Certificate Transparency their is no excuse to not have a list of all valid signed URLs.
At the unicode altar.
Soundex analysis is easy to do on modern CPU's but it's convenient for them to use it as an excuse to send all URL's to Google for 'analysis'.
On the other hand, I wonder in which direction it will steer if it finds two valid sites with competing viewpoints but with similar sounding names.
Custom electronics and digital signage for your business: www.evcircuits.com
When you type in download chrome on the IE it prompts, "Did you mean Edge Browser download? Please please pretty please with a bow on try the Edge. If you search using Bing we will give you money too. And please give Cortana a chance. A chance that is all we beg for. "
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Likewise leading xn--. It's as simple as that.
Does this mean the end of www.penisland.net ?
Isn't this just a simple matter of using the levenshtein distance algorithm (same one used in spell checkers)
See subject (great episode too) &: "In response to nuclear warhead placed in suborbit by other major power, United States today launching sub-orbital platform w/ MULTI-WARHEAD capacity - purpose: To maintain BALANCE OF POWER..." (in MY favor, lol & my warhead is my program for hosts that does MORE for FAR LESS vs. ANY single browser addon (easily detected & blocked by webmasters no less)) - StarTrek TOS "ASSIGNMENT EARTH"
* That MULTI-WARHEAD capable system? Hey, you know:
APK Hosts File Engine 2.0++ 64-bit for Linux h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p (remove spaces between chars & download)
APK Hosts File Engine 10++ SR-1 32/64-bit for Windows https://hosts-file.net/?s=Down... (DL link @ bottom)
Soon for MacOS too (I just got a NEW Mac-Mini to port it there too)
APK
P.S.=> Ah, yes - it is GOOD to be KING (The "Lord of Hosts" so-to-speak)... apk
Just as a hypothetical example: No, I don't want to go to "thesaxshop.com", I really am looking for porn and want to go to "thesexshop.com". That's going to be very irritating in a very short time. I really hope such absurdities can be disabled. It's bad enough putting up with that poxy "security" warning when I browse to an intranet site using http.
It's not much of a "warning".
They are basically reusing the UI where you type in, say "myserver", Chrome takes you to a Google search for "myserver" but then puts a little bar underneath which says "Did you really mean http://myserver?"
Avantslash - View Slashdot cleanly on your mobile phone.
tool, bitch human router
wet, wash, rinse, repeat
Why is this not Modded UP?
Or, as the title says, use a better font and not some shit font designed by a retard.
Any fonts with (exact!) similar looking letters are all retarded. Every single one of them. Doesn't matter if it was pre- or post-computing, all of them suck.
Doesn't matter of it is Latin fonts or Asian fonts. It holds universally.
They need to be wiped from society for the pieces of shit they are. They cause nothing but issues. Everywhere.
That goes for Os, os and 0s especially, some of the worst for similarity in fonts. In fact, you could even throw the degree symbol in there for some fonts! Disastrous!
Unicode abuses are a huge issue because the Unicode consortium are even more retarded. They've taken this to extremes.
Majority of the unique instances of glyphs are the exact same fucking thing with a different name. Exact same behaviours, same looks, different name because LOL reasons.
Fuck off. Worst thing to happen to fonts.
Here's a better solution, ban mixed fonts entirely unless there is an explicit container for them to separate them semantically. This can then be styled visually in programs, websites or whatever else.
Automatically prevents abuse when you see a HUGE visual indicator of different glyph sets being used.
CSS shouldn't be able to interfere with it by default unless a user (stupidly) disables it.
Any mixed font should be automatically very visible, especially if attempts are made to hide it in URLs and Anchor texts.
The CSS a:visited issues should have been solved the same way, but they took away that control!.
Will it stop abuse? Will ANY of this stop abuse?
No. Retards are retards. They'll click anything. They should not be allowed on computers in the first place. There should have been a licence to use the damn things.
I had my own mother complaining she "couldn't google anything" while clicking a bunch of links on her craptop.
She was stuck in some fucking ad-farm with related links. All because she had installed some extension from Google Play. How the hell she even installed it is beyond me, but retards find a way.
See subject & https://www.bleepingcomputer.c... & addons = easily detected & blocked by webmasters + run in SLOW usermode (vs. hosts in FASTER kernelmode as part of the IP stack itself) & NO SINGLE addon does as much as hosts & hosts do so for FAR LESS too!
* NOT HOSTS FILES THOUGH https://developers.slashdot.or...
P.S.=> To CHATTERING do-NOTHING "ne'er-do-well" TWATS who will STALK me here by UNIDENTIFIABLE anon posts (& downmod bomb this post to HIDE facts in it):
GET ON TOPIC & quit STALKING me by UNIDENTIFIABLE anonymous troll posts, loons!
Make a Wheel (as I have multiplatform) instead https://isc.sans.edu/forums/di... vs. wasting your time (after all, YOU can't STOP me doing the RIGHT thing - &, I clearly am per 100++k users of my work in this program alone)... apk
See subject (great episode too) &: "In response to nuclear warhead placed in suborbit by other major power, United States today launching sub-orbital platform w/ MULTI-WARHEAD capacity - purpose: To maintain BALANCE OF POWER..." (in MY favor, lol & my warhead is my program for hosts that does MORE for FAR LESS vs. ANY single browser addon (easily detected & blocked by webmasters no less)) - "ASSIGNMENT EARTH"
* That MULTI-WARHEAD capable system? Hey, you know:
APK Hosts File Engine 2.0++ 64-bit for Linux h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p (remove spaces between chars & download)
APK Hosts File Engine 10++ SR-1 32/64-bit for Windows https://hosts-file.net/?s=Down... (DL link @ bottom)
Soon for MacOS too (I just got a NEW Mac-Mini to port it there too)
APK
P.S.=> Yes - it is GOOD to be KING (The "Lord of Hosts" so-to-speak)... apk
My HOSTing
big dicks in my butt
small dicks in my butt
all dicks in my butt
Iâ(TM)mGAYpk
Ready to host dicks all day
So cum in my ass
Youâ(TM)ll have a gas
Iâ(TM)mGAYpk
The only solid way to prevent abuses like this would be to get rid of DNS entirely. With IPv6 there are enough addresses that there is no reason to ever change the IP of a server, which means links could just use direct IP addresses. Browsers should have quick and easy ways to bookmark an IP with a default name offered by the site itself, and should resolve those bookmarks like it was a domain name when the user types them into the address bar. Users couldn't just type in an address they saw on a billboard but everybody uses QR codes for that already so it wouldn't be a problem.
chrome://flags/#tenable-lookalike-url-navigation-suggestions.