Punycode in url box
-
I'm not sure if this is just somewhere hidden in the settings, but anyway: i have some URL with punycode, like this strežnik.net, but other browsers do visible conversion to strežnik.net. Is there any way to enable punycode conversion in the URL box?
-
2 years and no answers?
[Jira] (VB-39723) Raw punycode displayed in the address bar.
-
@anrdaemon As far as I remember this is a feature and not a bug - as it allows to indicate if it is the real or a faked url by invisible letters.
Referring to some exploit like this: https://mybroadband.co.za/news/security/207434-punycode-url-attack-can-trick-chrome-and-firefox-users.html
-
This this should be configurable.
-
@anrdaemon I agree. There is a risk to some users, however at the very least you could have an option to show the full address in the current locale (ideally with a big security disclaimer or warning).
E.g. if you have an Eastern European locale enabled, don't do puny translation for characters specific to that locale.
And just to be safe, add an extra identifier to the site info box to indicate potentially misleading characters are in use.