On: Ask HN: Google Doc email virus?

[the_mitsuhiko]

Is it actually Google or is there some unicode trickery going on?

[aaronmiler → the_mitsuhiko]

From what I can tell, it's actually Google, but then they redirect you to a malicious URL after auth/approval

[creichert → the_mitsuhiko]

Seems like it's allowed in the oauth form: https://pbs.twimg.com/media/C-7NlIzXUAErblp.jpg:large

[hemancuso → the_mitsuhiko]

Doesn't look like a unicode trick on the app-strings I'm getting

[oh_sigh → hemancuso]

Is there a database of homoglyphs for common fonts that one could use to write a visual string matching algorithm?

[mintplant → oh_sigh]

http://www.unicode.org/Public/security/8.0.0/confusables.txt

https://github.com/codebox/homoglyph

http://homoglyphs.net/