Comment #12 on issue 30881 by bre...@chromium.org: IDNs displayed as punycode in omnibox http://code.google.com/p/chromium/issues/detail?id=30881
Jungshik (on the I18N team) came up with most of the current rules. Blindly displaying IDN in all cases is a really bad idea. We mostly match IE with a few tweaks. The basic algorithm, if I recall, is to check each character in the decoded name and look up which writing script each character is in. If a character is in a script not included by any of the user's accept languages, it is rejected. This works quite well in practice protecting the user from homograph attacks since normally the user will have an accept language setting for languages they speak (normally this is only one). Additionally, if the languages cross more than one script, they are rejected. The prevents Cryrillic characters from being used in the place of Latin-1 ones, when the domain name otherwise looks ASCII. There is a whitelist of exceptions to the above rules which ends up allowing ASCII to be combined with Asian languages, since there is little chance of confusion. -- You received this message because you are listed in the owner or CC fields of this issue, or because you starred this issue. You may adjust your issue notification preferences at: http://code.google.com/hosting/settings -- Automated mail from issue updates at http://crbug.com/ Subscription options: http://groups.google.com/group/chromium-bugs
