Fake WhatsApp update from “WhatsApp Inc.” with Unicode whitespace: 1M downloads
Several years ago I read [1] a proposal for internationalized domain names from DJ Bernstein from before puny-code took hold.  The key observation was that there&#x27;s nothing stopping you from just using UTF-8 in the existing DNS protocols, but it included a discussion of how to treat visually indistinguishable unicode characters to prevent fraud, which is why I bring it up now:<p>The proposal was that the TLD administrators should whitelist in non-ASCII characters and generally require that domains are either entirely ASCII or entirely in a subset of Unicode that made sense for their native languages - .ru could allow all-ASCII or all-Cyrillic, .gr could require all-ASCII or all-Greek, .de could allow ASCII plus eszett and the umlauts, and could further require normalized encoding (ü must be FC and not CC 88 75) and consider ö.de and oe.de to be collisions [2], and so on.  Weird varieties of spaces, dashes, non-printing characters, accents that are only needed to type Klingon, and so on would never get whitelisted in.<p>I&#x27;ve always thought that was a great idea, and its a general principal App stores could use too.  (Although I realize that app stores don&#x27;t have as strong a concept of a native language as most TLDs do, which makes it a bit harder)<p>[1]: Its possible it was <a href="https:&#x2F;&#x2F;cr.yp.to&#x2F;djbdns&#x2F;idn.html" rel="nofollow">https:&#x2F;&#x2F;cr.yp.to&#x2F;djbdns&#x2F;idn.html</a>, but I&#x27;m not convinced.  Maybe it was an earlier revision.<p>[2]: In German, you spell &quot;ö&quot; as &quot;oe&quot; if you don&#x27;t have an ö key.  German speakers wouldn&#x27;t necessarily need &quot;ö&quot; and &quot;o&quot; to be collisions.