Kagi currently serves punycode domains in the search results like any other domain. This enables attackers to impersonate well-known domains.
Here's an example:
The query to find this result in the results list is "punycode demo".
Kagi decodes and formats the domain name correctly, including punycode characters, which is not always helpful in this special case.
I have the following suggestions how one might go about resolving this issue:
- Allow users to filter out all punycode domains via a dedicated toggle in the settings. This would only require filtering out all domains beginning with "xn--"
- Since internationalized domain names might include punycode for legit reasons (like having regional characters in the name) users might prefer to not filter out all such domains. In this case, a search result should display both the decoded and undecoded domain name:
bücher.tld (xn--bcher-kva.tld)
or even better:
xn--bcher-kva.tld (bücher.tld)
- Punycode domains that include both latin characters and characters commonly (mis-)used for IDN homograph attacks could be marked with an exclamation mark icon or something similar to alert users of possible deception taking place
Of course, these are only the ideas I came up with in a few minutes, maybe there are better ways to handle this.
The domains in question should also rarely show up in search results because of their low relevance but still: I think this is an issue for less experienced users.
