THE FOLD / CHEAT / THE BACKDOOR / THE PUNYCODE
THE PUNYCODE
the boundary sits where a machine hands something to an eye
1 WHAT IT IS · WHAT IT DOES · FACT OR FICTION
Domain names became international, so every script on Earth can now appear in a URL. Cyrillic а and Latin a are different characters that render identically in most fonts — and a name is only as trustworthy as the difference you can see.
LIT verified live. 10 Cyrillic letters that render like Latin ones, all 10 at genuinely different codepoints. In the word apple, 4 of the 5 letters have a lookalike, giving 15 distinct strings that display identically and are all different bytes — exactly
LIT verified live. 10 Cyrillic letters that render like Latin ones, all 10 at genuinely different codepoints. In the word apple, 4 of the 5 letters have a lookalike, giving 15 distinct strings that display identically and are all different bytes — exactly
24−1. The first character is codepoint 97 in one and 1072 in the other. Same length, same picture, different name.2 HOW IT WAS WEAVED · AI + HUMAN
Punycode (RFC 3492) encodes Unicode names into ASCII so DNS can carry them; the homograph attack was demonstrated against PayPal in 2005 and browsers have been patching the display rules ever since.
AVAN (AI) counted the substitutable positions rather than assuming them. My first version asserted 7 variants from a guess about how many letters of apple had lookalikes; the answer is 4 positions and therefore 15. The check now gates on the relationship — variants equals
AVAN (AI) counted the substitutable positions rather than assuming them. My first version asserted 7 variants from a guess about how many letters of apple had lookalikes; the answer is 4 positions and therefore 15. The check now gates on the relationship — variants equals
2k−1 for k substitutable letters — instead of on a constant I had reasoned out in my head and got wrong.3 ONE DIMENSION
Ten pairs. Identical picture, different number.
4 TWO DIMENSIONS · INTERACTIVE
Swap letters for their lookalikes and count the variants.
5 THREE DIMENSIONS + AVAN’S INVERSE
The green forward object: two names with one appearance.
AVAN’s addition (the inverse-companion): the forward reading is that lookalike characters make names unsafe. The inverse is that the name was never the thing you were checking — the picture was. A domain name is bytes, and bytes were always unambiguous; what failed is the rendering, which is a font decision made by someone who has never heard of your threat model. Read backwards, this is not a Unicode flaw. It is what happens when a security boundary is drawn at the point where a machine hands something to a human eye, which is the one place neither party controls.
LIT 10 Cyrillic letters that render like Latin ones sit at 10 genuinely different codepoints, and in the word apple 4 of the 5 letters have a lookalike - giving 15 distinct strings that display identically and are all different bytes, exactly 2 to the 4th minus 1 - with the first character at codepoint 97 in one and 1072 in the other
FIG Punycode (RFC 3492) encodes Unicode names into ASCII so DNS can carry them; the homograph attack was demonstrated against PayPal in 2005 and browsers have been patching display rules ever since. AVAN counted the substitutable positions rather than assuming them: my first version asserted 7 variants from a guess about how many letters of apple had lookalikes, when the answer is 4 positions and therefore 15. The check now gates on the relationship - variants equals 2^k - 1 for k substitutable letters - instead of a constant I reasoned out and got wrong.
FIG Punycode (RFC 3492) encodes Unicode names into ASCII so DNS can carry them; the homograph attack was demonstrated against PayPal in 2005 and browsers have been patching display rules ever since. AVAN counted the substitutable positions rather than assuming them: my first version asserted 7 variants from a guess about how many letters of apple had lookalikes, when the answer is 4 positions and therefore 15. The check now gates on the relationship - variants equals 2^k - 1 for k substitutable letters - instead of a constant I reasoned out and got wrong.
◆ sealed .dlw.fold → folded to ROOT_0 · a sphere of THE BACKDOOR · David Lee Wise (ROOT0), with AVAN