Skip to content

Ability to disallow confusing unicode characters to prevent homoglyph phishing attacks #157

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
alanhamlett opened this issue May 23, 2025 · 1 comment
Open

Ability to disallow confusing unicode characters to prevent homoglyph phishing attacks #157

alanhamlett opened this issue May 23, 2025 · 1 comment

Comments

@alanhamlett
Copy link

alanhamlett commented May 23, 2025 •
edited
Loading

When emails contain unicode characters that look similar to ascii characters, an attack vector is possible anytime we display the unicode email as an identifier of a user without punycode encoding the displayed email.

It would be nice to have an option to make confusing unicode characters fail email validation, but might be outside the scope of this library since it depends on the external confusables.txt data file from unicode.org?

The Unicode Consortium's Visual Spoofing Recommendations agree with this solution as a better alternative than blocking all unicode characters in domains and emails.
@JoshData
Copy link
Owner

I'm reluctant to address security issues like this without fully understanding a specific use case that we're trying to solve because then I have a feature that I don't know if it solves a problem. For example I'm not sure whether the confusable characters lost actually solves the problem or if it just removes some cases but leaves open exploitable possibilities.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@JoshData @alanhamlett