Any way to show IDNs correctly?

Question

I've made a Portfolio Website and chose to use a Domain with cyrillic characters. Sadly, it's being displayed as "xn--80afg8d.me", which is ugly as hell.

Is there any way to make browsers display it correctly? Does the same thing happen with other IDNs like Japanese ones?

Answer 1

Unfortunately for you, this "punycode" (RFC 3492) representation is used by browser vendors to increase security as it relates to their end users. This is largely to avoid homograph attacks where malicious actors register domain names using Cyrillic characters that look ever-so-slightly different from another Latin counterpart, which would more easily enable phishing attacks against users.

Google has an interesting document in their chromium source control explaining why and how this occurs in Chromium/Chrome:

Many years ago, domains could only consist of the Latin letters A to Z, digits, and a few other characters. Internationalized Domain Names (IDNs) were created to better support non-Latin alphabets for web users around the globe.

Different characters from different (or even the same!) languages can look very similar. We’ve seen reports of proof-of-concept attacks. These are called homograph attacks. For example, the Latin “a” looks a lot like the Cyrillic “а”, so someone could register http://ebаy.com (using Cyrillic “а”), which could be confused for http://ebay.com. This is a limitation of how URLs are displayed in browsers in general, not a specific bug in Chrome.

In a perfect world, domain registrars would not allow these confusable domain names to be registered. Some domain registrars do exactly that, mostly by restricting the characters allowed, but many do not. To better protect against these attacks, browsers display some domains in punycode (looks like xn--...) instead of the original IDN, according to their own IDN policies.

Other major vendors have also published similar documentation:

• Firefox - IDN Display Algorithm - MozillaWiki
• Opera - Upcoming update with IDN homograph phishing fix

Since this is handled at the individual browser level, if you are truly adamant about bypassing this punycode-ification of your domain, you'd have to work with each of the browser vendors to understand how to have your domain whitelisted such that it no longer is displayed in this fashion. A cursory search for such processes didn't turn up much of substance in this realm, so your best bet may be to reach out to the vendors directly. I wouldn't hold my breath on this unless your Cyrillic domain is one of the top ~500 visited sites on the Internet.

Answer 2

It happens with some domain names, a few rather than many.

The short version is that the browsers inspect the domain name and mostly display it as human-readable text, but may display it as xn--gibberish according to browser-specific policies. Firefox' policy is the shortest and simplest, and I wouldn't call it simple.

It's not obvious to me that геха.me should fail, and I'd actually try to get that fixed in the browsers. I see that this particular domain has been deregistered, so I didn't look closely at why it fails the tests.

The homograph issue isn't as important as it was, since registries now generally restrict homographic domains to the first registrant. You can find a homograph of "IBM", but since IBM has registered IBM dot foo under so many TLDs, registering your homographic word as a domain is now difficult. (Unless you are IBM, of course. You can register lots of homographic clones of your own domains.) AFAICT the browser policies don't take homographs into account.