Xudong Zhang

I've been working on a aluminum and wireless version of the ErgoDox and the group buy will start this weekend. It will be around $350 excluding switches and keycaps. With DSA keycaps (the shortest possible one) the total height is 29mm (including rubber feet). You can see the details of the earlier laser cut prototype here (and subscribe to the mailing list for updates): https://www.xudongz.com/blog/2020/ergoblue/. The details of the aluminum version will be announced when the group buy is officially announced. You can find also my contact information on my homepage for questions and feedback.

I think this is something worth showing in your class https://www.xudongz.com/blog/2017/idn-phishing/

But as the title of the post says, browsers already solved this problem. https://www.xudongz.com/blog/2017/idn-phishing/ It does make running commands from an untrusted website a little safer, which is nice. I imagine it's not uncommon to copy installation scripts from random StackOverflow comments or blog posts, for example. But that's still not safe even with this tool. Homograph attacks aside, how can you tell if a URL you're pasting into your terminal is the official source for something? It's trivial to create fake GitHub accounts or organizations.

The attacker doesn’t need to spoof anything, this is known as a homograph attack: https://en.m.wikipedia.org/wiki/IDN_homograph_attack https://www.xudongz.com/blog/2017/idn-phishing/

This seems ripe for phishing, similar to @аррӏе.com (which isn't @apple.com -- go ahead and check) and someone actually did this once. [0] There are lots of emojis that are hard to tell apart from each other. [0] https://www.xudongz.com/blog/2017/idn-phishing/

Firefox users: be sure to set "network.IDN_show_punycode" to "true" in about:config. Test with the fake Apple domain https://www.xn--80ak6aa92e.com/ . See "Phishing with Unicode Domains" for more information: https://www.xudongz.com/blog/2017/idn-phishing/ .

It's a bit disingenuous ars technica ledes with a screenshot of a homograph attack that Chrome mitigated in March 2017, and really doesn't relate to the article. https://www.xudongz.com/blog/2017/idn-phishing/

Yeah its a problem for domain names too: https://www.xudongz.com/blog/2017/idn-phishing/

Somewhat off-topic, but the explosion Unicode glyphs can lead to problems more serious than aesthetics: Punycode exploit: https://www.xudongz.com/blog/2017/idn-phishing/ Greek question mark: https://stackoverflow.com/questions/26965331/javascript-prank-joke Shameless plug: https://github.com/BourgeoisBear/A-E-S-T-H-E-T-I-C

This was posted the other day, checking its green isn't enough. https://www.xudongz.com/blog/2017/idn-phishing/ Edited: you're right I thought you meant just check its https.

That wasn't quite what they were talking about. They were talking about IDN Phishing [0] and not http-->https redirection (which is what HSTS is directed towards). But since we're talking about DNS redirection the http:// handshake against the legitimate server never happens, you're only ever visiting a malicious website (which the certificate checks would all fail - except visually in the case of IDN phishing which only works against Firefox users). [0] https://www.xudongz.com/blog/2017/idn-phishing/ [1] https://www.аррӏе.com/ (this will show the punycode domain on HN, visit it in Firefox it will look just like https://apple.com ) [2] The cert still shows punycode though most users wouldn't check the cert: https://kimiwo.aishitei.ru/i/MMFWtvE5ZgYdHWki.png