A host built from lookalike characters

Addresses and identifiers

Substituting characters that look alike is a general problem with names, and inside an onion host it is a much smaller problem than its reputation suggests.

The shape

This card has no shape of its own. It describes a way of attacking other shapes, so the useful statement is about what the target permits. An onion host is drawn from twenty six lower case letters and the digits two to seven, and that restriction was made for other reasons entirely, but it happens to remove most of the classic substitutions before anybody can attempt them.

Work through the standard pairs and the field thins out quickly. The digit one against the letter l is dead, because one is outside the alphabet: a host containing it is malformed rather than misleading. The digit zero against the letter o is dead for the same reason. A capital O against a zero is dead twice over, since capitals normalise to lower case and the zero was never available. Letters borrowed from other scripts are dead as well, because nothing outside plain ASCII survives in the label.

What survives is the shape of one letter against the shape of two. The sequence rn can pass for m in a narrow font, vv can pass for w, and cl can pass for d. All six of those characters are legal, so the substitution is genuinely available. It costs something, though, and the cost is worth stating precisely: swapping one letter for two makes the label one character longer than it should be, and the current format has only one legal width. An imitation built this way has to give a character back somewhere else to keep the count right.

Applies to

the host, and to any text presented as a host

Characters available inside a label

lower case letters, digits two to seven, nothing else

Pairs that survive

rn against m, vv against w, cl against d

Pairs that cannot occur

anything requiring 0, 1, 8, 9, a capital, or a non ASCII letter

Side effect of the survivors

the label grows by one character each time

Unaffected

the path, the query and the visible text of a link, none of which are limited this way

xxrnxx.onion   two characters: r then n
xxmxxx.onion   one character: m
same apparent width on screen, different character count

Where the confusion actually lives

Because the label itself is so constrained, the interesting substitutions happen everywhere except inside it. The visible text of a link is ordinary prose and can say anything at all, including a correct address, while the destination underneath says something else. That gap is not a character trick; it is the normal behaviour of links, and it is why the eye procedure on the mirror link card starts by isolating the destination rather than reading the sentence.

Ordinary domain names are the other place the classic tricks still work in full. A domain can contain hyphens, digits, capitals and letters from other scripts, so a name that borrows a familiar word and adds a hyphen, or replaces a letter with a digit, is easy to build and reads as reasonable at a glance. Names like that are not onion hosts and cannot be reached the same way, but they can be printed beside a genuine string, or wrapped around one as the outer host of a link.

The last place is the human one. A string that begins with a familiar word invites the reader to stop reading. That is not a font problem or an alphabet problem, and no restriction on the character set does anything about it.

How to check it by eye

What a wrong shape means

A host that fails the alphabet is malformed, and malformed is not the same as hostile. It cannot resolve, so it cannot be used to catch anybody, which makes accident by far the better explanation. Line noise, a transcription from a photograph, an autocorrect that capitalised the start of a line: these produce illegal characters constantly and mean nothing.

A host that passes the alphabet but is not the host you expected is a different matter, and the shape cannot settle which of the two possibilities you are in. You may have been given a different address by somebody who had a different address. You may be looking at an imitation. The characters look identical in both cases, because in both cases they are legal characters correctly arranged.

exarnplexxxxxx.onion
the third and fourth letters are r and n

examplexxxxxxx.onion
the same stretch is a single m

Both are placeholders built from the word example, shown at the same apparent width. The left one needs one more character than the right one to occupy the same space, which is the only reliable difference between them and the reason width is checked before letters.

What a correct shape does not prove

Passing every test on this card is a narrow result. It means no character in front of you is pretending to be another character. It does not reach any of the following.

• That the host is the right host. Imitation is only one way to be handed the wrong string, and it is not the most common one.
• That the string was not swapped wholesale. A completely different legal address contains no confusable characters at all, because it is not imitating anything.
• That the surrounding text is honest. The label can be flawless while the sentence around it describes it as something it is not.
• That your eyes were the deciding factor. Fonts differ between devices, and a pair that separated cleanly on one screen may close up on another.
• That the character set will always protect you. The narrowness described here is a property of this particular label format, not a general defence, and it disappears the moment the string you are reading is an ordinary domain name.

What this card is not

The rules of the host as a string belong to the onion address card, and this one assumes them rather than restating them. Structure around the host, including which part of a link is even the host, is on the mirror link card. Characters that are hidden rather than disguised, such as the ones with no width at all, are handled on the username card, since that is where they actually turn up. Escapes that disguise a character by spelling it in hex are on the percent encoding card.