How to protect your browser from Unicode domain phishing attacks

https://www.grahamcluley.com/protect-browser-unicode-domain-phishing-attacks/

 

I tried the IDN Safe extension on Vivaldi browser, but doesn't works...

Thanks!

 

Just installed a short time ago in Opera!

 

The Firefox and Chrome extensions work.

 

IDN Safe extension added to Chrome. TY for the heads up, Minimalist.

 

You're welcome.
I enabled an option in about:config on my system also.

 

Thing is, with browser extensions, users have to wonder if Chrome's vetting process has improved, i.e. the question arises as to whether the extension you are adding is going to cause harm on its own. So I come to Wilders and follow advice from people I hold in high regard, and I make a judgement on the rep of the author of the article that is linked. Diligence never sleeps, huh?

 

Yes, just added to Chrome thanks.

 

Hi

What sites to test the extensions?

Thanks

 

There's one on the link in @Minimalist 's first post.

 

Found it, thanks

FF Quantum - Icon turns Red with counter showing 1 blocked
Chrome - Icon remains GREEN with counter showing 1 blocked

You have the same result? I think the extension has a color issue in Chrome browser

Actually, in FF Quantum v58.0.2 without using the extension it shows

https://www.xn--pple-43d.com/ at the address bar when I clicked 'www.apple.com' (with Unicode domain) and the below message appears. So FF Quantum v58.0.2 is blocking the site and there's no need to use the extension. It's the same in FF Quantum for Android v58.0.2

In Chrome (without using the extension) the error message

 

Same here in Vivaldi I think. The green shield did not turn red but Vivaldi did block the page. But I don't know what in Vivaldi or my setup blocked the page. Running BDIS2018. My Vivaldi security extensions are BD TrafficLight, & uBlock Origin.

Screenshot:

 

No, in Chrome the colour changes to red as it does in FF here.

I could be wrong but I suspect that is a test site as when I temporarily allow the page is blank.

 

Not on my machines, it definitely changes to red using Chrome...

 

https://threatpost.com/google-fixes...ity-in-chrome-58-firefox-standing-pat/125099/ "Google fixed a handful of issues when it released the latest version of its browser, Chrome 58, on Wednesday, including a vulnerability that could have made it easier for an attacker to carry out a phishing attack with Unicode domains".

 

thanks Minimalist, added to Yandex, works perfectly fine

 

You're welcome. Nice to hear it's working OK

 

Doesn't this render the extension unnecessary?

 

It looks like the IDN Extensions were put out days before Chrome fixed the problems. The Extensions have not been updated since they were first put in the chrome store.

 

I agree with that timeline. I think I'll disable or remove IDN Safe. I didn't realize that Chrome had addressed this issue so long ago (approximately April of 2017).

 

Has FF addressed this issue?

 

No, and they won't fix it:

 

Just added it to Chrome. Thanks.