Skip to main content

lemmy - Link to source

Weaponised Fonts
Arguably more security than privacy, but this made me think. I havent considered the use of ambiguous fonts in phishing before. Worth reading.

Weaponized Fonts

Ambiguity is the enemy of security. An ambiguous font? It's a recipe for disaster.
Gardiner Bryant (The Bryant Review)
#privacy
This entry was edited (3 weeks ago)
in reply to GMac

(des)mosthenes
lemmy - Link to source
(des)mosthenes
• •
that’s why mono fonts are best
in reply to (des)mosthenes

rnercle
lemmy - Link to source
rnercle
• •
And wouldn't you know, the Wall Street Journal revealed that the Polymarket set up a fake version of their website and named it PoIymarket. (Did you catch it?)

PoIymarket (spelled with a capital "i" instead of a lower case "l"), is a fake version of their platform.


what difference a mono font would make with the I & l difference?

in reply to rnercle

Megabit
lemmy - Link to source
Megabit
• •
It would make those characters more distinct. Should be able to see it here with a code line. The letter O and the number 0 also have more noticeable differences that go beyond what serif fonts can do
Capital I
Lowercase l 
Number 1
Capital O
Number 0
This entry was edited (3 weeks ago)
in reply to (des)mosthenes

grandma
lemmy - Link to source
grandma
• •
Doesn't need to be mono to fix it. Look at Atkinson Hyperlegible
in reply to grandma

(des)mosthenes
lemmy - Link to source
(des)mosthenes
• •
mono fonts just address this consistently as opposed to case by case for sans serif type
in reply to GMac

freeman
lemmy - Link to source
freeman
• •
i thought this is common knowledge with tech people. I heard years ago about swapping of the cyrillic „a“, maybe thats why.
This entry was edited (3 weeks ago)
in reply to freeman

Azura The Spellkissed
lemmy - Link to source
Azura The Spellkissed
• •

Yeah. Here are some resources for interested people


IDN Homograph Attack — Unicode Domain Phishing Explained

Deep dive into IDN homograph attacks: how attackers register domains using Unicode confusable characters (Cyrillic a vs Latin a, etc.) that look identical to legitimate brands, the 2017 apple.
Glueo, s.r.o. (Punycoder)
in reply to GMac

NekuSoul
lemmy - Link to source
NekuSoul
• •
While this is a very special and interestng use of this attack vector, I do think it often gets too much focus, mostly because it's ignoring a much bigger problem: The average person doesn't even know what the legit URL of a website should even be, and that starts with the TLD. Was it .com? Or maybe .org? Maybe some country-TLD or maybe one of the thousands of new TLDs like .world or .finance? If you don't have a perfect memory of every URL of all the websites you're using, being able to inspect the exact shape of each letter isn't going to help you.
This entry was edited (3 weeks ago)
in reply to NekuSoul

strawberry_enjoyer42
lemmy - Link to source
strawberry_enjoyer42
• •
TIL I'm not the average web user. Not suprising, since I use Arch (btw), and I've done web dev projects. Do average people really just look up the url every time?
in reply to strawberry_enjoyer42

Azura The Spellkissed
lemmy - Link to source
Azura The Spellkissed
• •
My dad used to put "Google" in the omnibar (adressbar), hit enter, then click the first Yahoo search result for google.com, then enter his actual search query into Google.
in reply to GMac

Autonomous
lemmy - Link to source
Autonomous
• •
in reply to GMac

highbank
lemmy - Link to source
highbank
• •
Just created an issue about this on URLCheck's GitHub.

Feature request: More distinguishable font or feature to change fonts

Describe a related problem (optional) No response Describe your suggested feature This feature request was inspired by this article of Gardiner Bryant about 'weaponized fonts', and the recent 'www....
PorousSpoon (GitHub)
⇧