THE FOLD / CHEAT / THE BACKDOOR / THE HOMOGLYPH
THE HOMOGLYPH
thirty-two spellings, one shape
1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION
Cyrillic а is not Latin a. Different code point, different alphabet, different language — and on every screen you will ever look at, the same shape.
LIT verified live. the word
LIT verified live. the word
paypal has 5 positions whose Latin letter has a Cyrillic look-alike, giving 25 = 32 substitutions. All 32 are distinct strings — no two are equal — and exactly 1 of them is the original. The other 31 compare unequal to it, hash differently, sort differently, and render identically. Latin a is U+0061; Cyrillic а is U+0430.2 HOW IT WAS WEAVED · AI + HUMAN
Homoglyph attacks and the IDN spoofing problem are why registrars restrict mixed-script domains and why browsers show punycode for suspicious labels; Unicode publishes a confusables table (UTS #39).
AVAN (AI) counted the space rather than showing one spoofed word, because 32 is the argument. A blocklist of known-bad strings is the usual defence and it is defeated arithmetically: the attacker picks a different one of the 31. The defence that works is not enumeration, it is refusing to mix scripts in the first place — a rule about the alphabet, not about the words.
AVAN (AI) counted the space rather than showing one spoofed word, because 32 is the argument. A blocklist of known-bad strings is the usual defence and it is defeated arithmetically: the attacker picks a different one of the 31. The defence that works is not enumeration, it is refusing to mix scripts in the first place — a rule about the alphabet, not about the words.
3 ONE DIMENSION
Thirty-two spellings. One shape.
4 TWO DIMENSIONS · INTERACTIVE
Swap letters for their look-alikes and watch nothing change.
5 THREE DIMENSIONS + AVAN’S INVERSE
The green forward object.
AVAN’s addition (the inverse-companion): the forward reading is that you cannot trust what a string looks like. The inverse is that identity was never in the glyph — the glyph is a rendering decision, and rendering is designed to hide the difference. Two code points that mean different letters in different alphabets are drawn the same because that is what the shapes are, historically. Read backwards, the spoof is not an abuse of Unicode; it is Unicode working, and any system that treated appearance as identity had already made an assumption the writing system never agreed to.
LIT the word paypal has 5 positions whose Latin letter has a Cyrillic look-alike, giving 2^5 = 32 substitutions, and all 32 are distinct strings with exactly 1 of them the original - the other 31 compare unequal to it, hash differently, sort differently and render identically, since Latin a is U+0061 and Cyrillic a is U+0430
FIG Homoglyph attacks and IDN spoofing are why registrars restrict mixed-script domains and browsers show punycode for suspicious labels; Unicode publishes a confusables table (UTS #39). AVAN counted the space rather than showing one spoofed word, because 32 is the argument: a blocklist of known-bad strings is the usual defence and it is defeated arithmetically, since the attacker picks a different one of the 31. The defence that works is refusing to mix scripts - a rule about the alphabet, not about the words.
FIG Homoglyph attacks and IDN spoofing are why registrars restrict mixed-script domains and browsers show punycode for suspicious labels; Unicode publishes a confusables table (UTS #39). AVAN counted the space rather than showing one spoofed word, because 32 is the argument: a blocklist of known-bad strings is the usual defence and it is defeated arithmetically, since the attacker picks a different one of the 31. The defence that works is refusing to mix scripts - a rule about the alphabet, not about the words.
◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE BACKDOOR · David Lee Wise (ROOT0), with AVAN