Post #2289992
2026-05-02 07:53 UTC
This is done as domains need to be ASCII only
They don’t need to, but a punycode-attack is done by using a letter of another language that looks almost identical. I think you still have to actively enable the defense against it (some about:config setting), the poster did.
Replies (1)
-
@elvith@feddit.org 2026-05-02 12:14
DNS is ASCII only and so this conversion is done. It is not needed to display the “technical” domain name that results when you enter a domain name with non ASCII chars in apps, but yes, this prevents character confusion. https://en.wikipedia.org/wiki/Internationalized_domain_name In the Domain Name System, these domains use an ASCII representation consisting of the prefix xn-- followed by the Punycode translation of the Unicode representation of the language-specific alphabet or script glyphs. For example, the Cyrillic name of Russia’s IDN ccTLD is рф. In Punycode representation, this is p1ai, and its DNS name is xn--p1ai.