Two letters you have never typed can make a fake apple.com look real in Chrome

Look at this: аррлө.com. In Chrome's address bar it reads as apple.com. It is not apple.com, and Chrome will not warn you.

Ian Muscat and Leanne Briffa, of the domain monitoring service Have I Been Squatted, published the finding on 10 October. Browsers have guarded against this sort of thing for years: mix alphabets in a web address and Chromium shows you the ugly machine-readable version instead of the pretty one. The catch is that the check only fires when every single character in the name is on a hardcoded list of known impostors. Two letters are not on it. One is ө, a Cyrillic letter used in Kazakh, Mongolian and Tatar. The other is ƙ, a Latin k with a hook, used in Hausa. Drop either one into a name and the whole warning stands down. The researchers registered 20 working proof-of-concept domains that way, impersonating Apple, Okta, Nike, SpaceX, Pinterest, Kickstarter and others.

This affects Chrome and Edge, which share the same engine, and the supply of raw material is not small: a sweep of the .com registry turned up nearly 162,000 pairs of international domain names that look like ordinary ones. Nothing has been caught abusing these two letters in the wild yet, which is the good news, and the only reason you are hearing about it now.

What it kills is the advice everyone repeats, which is to read the address carefully before you type a password. You cannot read your way out of this one. Reach your bank, your email and your shopping accounts from a bookmark you made yourself, never from a link in a message. If a convincing fake has already talked you into installing something, Tendvane's "browser hijacked" repair wizard puts your search engine, home page and extensions back the way you had them.