9 Replies Latest reply: Oct 18, 2013 4:48 PM by Tom Gewecke
RETRAX Level 1 (40 points)

Hello Safari / WebKit-Team,

 

The .de NIC (denic.de) will implement IDNA2008 from 2010-11-16 onwards,

especially allowing for ß (\u00df) in domain names. Hence, the automatic

translation of ß to ss may result in looking up the wrong domain name, allowing

for spoofing attacks.

(DENIC will run a sunrise period (2010-10-26 to 2010-11-15) during which

holders of domains with ss will be allowed top register the respective ß domain

in advance.)

 

http://www.denic.de/en/domains/internationalized-domain-names/sharp-s.html

 

ß and ss are not exchangable in German. ss instead of ß is just a makeshift. Germans expect ß to usually just work if

umlauts work (which already do for a while).

 

Steps to Reproduce:

1. Start Safari on OS X Mountain Lion or on iOS

2. Open the domain "http://www.heß.de" (a family name).

 

 

Expected Results:

Safari will change the "ß" character to "ss" and open "http://www.hess.de" which is a completely different family name (last name).

 

For example: "Michael Heß" and "Peter Hess".

 

 

Thanks & Regards

 

Michael


iMac, OS X Mountain Lion (10.8.5)
  • Klaus1 Level 8 (47,755 points)

    You are not actually contacting Apple here, we are all just fellow users!

     

    You can send your suggestion via the Feedback link. You won't receive a reply but Apple will see it.

     

    Where to send product feedback to Apple:

     

    http://www.apple.com/feedback/

  • Tom Gewecke Level 9 (77,165 points)

    Does Firefox behave the same way for you?

  • Tom Gewecke Level 9 (77,165 points)

    .

  • Tom Gewecke Level 9 (77,165 points)

    PS My research indicates that no browser has so far adopted the behavior you are requesting regarding ß because of security concerns about spoofing of web addresses.

     

    If you have a contrary example, let us know.

  • RETRAX Level 1 (40 points)

    For the Mozilla/FireFox-Discussion of this topic please look here:

     

    https://bugzilla.mozilla.org/show_bug.cgi?id=479520

     

    Opera Browser V12.15 is the only Browser which do it right (for the moment).

     

    I heared, that in the newest Chromium Builds IDNA2008 is also implemented.

  • Tom Gewecke Level 9 (77,165 points)

    RETRAX wrote:

     

    Opera Browser V12.15 is the only Browser which do it right (for the moment).

     

    But my Opera is V17 and no longer does it.

     

    Thanks much for the bugzilla link which shows why no one is doing it.  Regardless of the standard, browser makers are worried about getting blamed for the potentially dangerous spoofing that can result from careless practices of the people who sell domain names.

     

    It will be interesting to see if Chrome becomes the first to separate ß and ss,

  • RETRAX Level 1 (40 points)

    Tom Gewecke wrote:

    But my Opera is V17 and no longer does it.

     

    It may have to do with that Opera changed the entire Browser-Engine.

    They moved from something own to the Chrome-WebKit-Distribution.

    But you will find the 12.15 Version of Opera in the Mac App Store (last checked: today).

    The Version you are using is called "Opera Next" or something else and is build new from the scratch using Google's-Engine.

     

    But if IDNA2008 is realized in the newest Chromium-Nightlys... let us hope that Apple and Mozilla will have IDNA2008-Support in the next 3-5 years...

     

    I don't want to say anything about the IE and IDNA2008... maybe in 10+ years from now on...

  • Tom Gewecke Level 9 (77,165 points)

    RETRAX wrote:

     

    But if IDNA2008 is realized in the newest Chromium-Nightlys... let us hope that Apple and Mozilla will have IDNA2008-Support in the next 3-5 years...

     

    I had look at Chrome Canary, but it did not seem to do this yet either.  Will try to check the older Opera.  Indeed I think all browsers should move quickly in this direction as soon as they can feel more secure about how domain registries are behaving, and the registries can't make make much money selling urls that the main browsers won't go to.

  • Tom Gewecke Level 9 (77,165 points)

    In addition to the old Opera version, I found that both the iOS and OS X versions of the iCab browser do what you want with ß.