Tuesday, December 20, 2011

Internationalized Domain Names Revisited

Since my earlier article on this topic, updated specifications for Internationalized Domain Names (IDNA2008) have been published. As a result, users can probably expect to see a rapid increase in urls written in scripts other than Latin.

Because of security concerns about phishing and other possible misuse of IDN's, browser makers have adopted (differing) mechanisms to filter the way users see such urls in the address bar after they click on a link.

Safari will display urls in their Unicode form for any script on a well-hidden, user-editable "whitelist." Others are displayed in a Latin "punycode" version.

Chrome displays urls in their Unicode form as long as they contain characters from a single language among those on a list set by the user in the browser preferences and do not contain any "blacklisted" characters. Otherwise in punycode.

Firefox and Opera display urls in their Unicode form only if they are on a "whitelist" of approved domains maintained by Mozilla and do not contain any "blacklisted" characters. Otherwise in punycode.

I had a look at the Safari script whitelist and it seems to me that it could be a good deal longer without causing any additional problems. As a "script" can sometimes cover many languages, Apple's method seems rather less restrictive than those used by the other browsers. Whether that is better for the user I don't know.

1 comment:

Smokey Ardisson said...

Boy, that is a bizarre file. I suspect it’s also in danger of being wiped out on every Safari/WebKit update, given where it lives.