Maalmo ka hor ayaa Cilmi-baareyaasha xallinta ayaa sii daayay helitaankooda cusub de hab cusub oo loogu diiwaangaliyo boggaga homoglyphs oo umuuqda kuwa kale xarago, laakiin runti way ku kala duwan yihiin joogitaanka jilayaal leh macno kale.
Noocyada noocan ah ee caalamiga ah (IDN) jaleecada hore kuma kala duwanaan karto oo ka socda shirkado caan ah iyo adeegyo, kuu oggolaanaya inaad u isticmaasho xoqidda, oo ay ku jiraan helitaanka shahaadooyinka TLS ee saxda ah iyaga.
Diiwaangelinta guuleysta ee degmooyinkan waxay u egtahay meelihii saxda ahaa waana la yaqaan, waxaana loo isticmaalaa in lagu qaado weerarada injineernimada bulshada ee hay'adaha.
Matt Hamilton, oo ah cilmi baare ka tirsan shirkadda 'Soluble', wuxuu caddeeyey inay suurtagal tahay in la diiwaan geliyo degmooyin badan heerka guud ee guud (gTLD) iyadoo la adeegsanayo astaamaha kordhinta Unicode Latin IPA (sida ɑ iyo ɩ), waxayna sidoo kale awood u yeelatay inay diiwaangeliso bogagga soo socda.
Beddelka caadiga ah ee loo yaqaan 'IDN domain' oo sida muuqata la mid ah ayaa muddo dheer lagu xanibay biraawsarayaasha iyo diiwaangeliyeyaasha, sababo la xiriira mamnuucidda isku dhafka jilayaasha xarfaha kala duwan. Tusaale ahaan, shabakadda beenta ah ee apple.com ("xn--pple-43d.com") laguma abuuri karo iyadoo lagu beddelayo Laatiinka "a" (U + 0061) laguna beddelayo Cyrillic "a" (U + 0430), tan iyo Isku-darka xarfaha xarfaha alifbeetada kala duwan lama ogola.
Sannadkii 2017, hab looga gudbayo ilaalintaas ayaa la helay adoo adeegsanaya kaliya xarfaha unicode ee aagga, adigoon isticmaalin xarfaha Laatiinka (tusaale ahaan, adoo adeegsanaya astaamo luqadeed leh jilayaal la mid ah Latin).
Hadda hab kale oo looga hortago ayaa la helay, iyada oo ku saleysan xaqiiqda ah in diiwaangeliyayaashu xayiraan isku dhafka Latinka iyo Unicode, laakiin haddii jilayaasha Unicode ee lagu qeexay aagga ay ka tirsan yihiin koox astaamo Latin ah, isku-darka noocan oo kale ah waa la oggol yahay, maaddaama jilayaasha ay ka tirsan yihiin alifbeeto isku mid ah.
Dhibaatadu waxay tahay kordhinta Unicode Latin IPA waxay kakoobantahay homoglyphs la mid ah hingaadda xarfaha kale ee Laatiinka: astaamaha "ɑ" wuxuu u egyahay "a", "ɡ" - "g", "ɩ" - "l".
Awoodda diiwaangelinta boggaga ay Latin ku qasan tahay astaamaha Unicode ee la tilmaamay waxaa lagu aqoonsaday diiwaan-hayaha Verisign (ma jiraan diiwaan-geliyeyaal kale oo la xaqiijiyay), iyo subdomains ayaa laga sameeyay adeegyada Amazon, Google, Wasabi iyo DigitalOcean.
In kastoo baaritaanka kaliya lagu sameeyay gTLD-yada Verisign-ay maamusho Looma tixgelin kooxda weyn ee shabakadda iyo inkasta oo ogeysiisyada la diray, seddex bilood ka dib, daqiiqadii ugu dambeysay, waxaa lagu hagaajiyay kaliya Amazon iyo Verisign maadaama kaliya iyaga gaar ahaan ay si dhab ah dhibaatada u qaateen.
Hamilton wuxuu si qarsoodi ah uga dhigay warbixintiisa ilaa Verisign, shirkadda maamusha diiwaangelinta domainka ee loogu talagalay fidinta domain heer sare ah (gTLDs) sida .com iyo .net, ayaa xallisay dhibaatada.
Baarayaasha ayaa sidoo kale bilaabay adeeg qadka ah oo ay ku xaqiijinayaan goobaha ay ku shaqeeyaan. raadinta waxyaabo kale oo suurtagal ah oo la mid ah 'homoglyphs', oo ay ku jiraan xaqiijinta meelaha horey loo diiwaangeliyey iyo shahaadooyinka TLS oo leh magacyo isku mid ah.
Marka laga hadlayo shahaadooyinka HTTPS, 300 domains oo leh homoglyphs ayaa lagu hubiyey diiwaanada Transparency Certificate, kuwaas oo 15 ka mid ah laga diiwaan geliyey jiilka shahaadooyinka.
Real Chrome iyo Firefox daalacayaashu waxay ku muujinayaan cinwaano isku mid ah cinwaanka cinwaanka ee qoraalka horjoogaha 'xn--', hase yeeshe cinwaanada waxaa loo arkaa iyadoon loo rogin xiriiriyeyaasha, taas oo loo adeegsan karo gelinta ilaha xun ama xiriiriyeyaasha bogagga, hoosta marmarsiinyo ah in laga soo dejiyo baraha sharciga ah.
Tusaale ahaan, mid ka mid ah aagagga loo aqoonsaday homoglyphs, faafitaanka nooc xun oo maktabadda jQuery ah ayaa la duubay.
Intii lagu guda jiray tijaabada, cilmi baarayaashu waxay isticmaaleen $ 400 waxayna diiwaangeliyeen aagagga soo socda leh Verisign:
- amazon.com
- chase.com
- sɑlesforce.com
- ɑmɑil.com
- ɑppɩe.com
- ebey.com
- static.com
- Steɑmpowered.com
- theguardian.com
- theverɡe.com
- washingtonpost.com
- pɑypɑɩ.com
- wɑlmɑrt.com
- waasɑbisys.com
- yahoo.com
- cɩoudfɩare.com
- deɩ.com
- gmɑiɩ.com
- www.gooɡleapis.com
- huffinɡtonpost.com
- Instagram.com
- microsoftonɩine.com
- amazonaws.com
- roidndroid.com
- netfɩix.com
- nvidiɑ.com
- oogɩe.com
Si waxaad rabtaa inaad ka ogaato faahfaahin dheeraad ah oo ku saabsan ku saabsan daahfurkaan, waad la tashan kartaa xiriirka soo socda.