PunyGuard: A Chrome Extension That Blocks Every Internationalized Domain

A Chrome extension named PunyGuard has been developed to block all internationalized domain names (IDNs). The extension is designed to eliminate the risk of confusion arising from similar-looking domain names, particularly those in non-ASCII characters such as Cyrillic or Japanese.

Upon reading an article explaining how Chrome displays internationalized domain names in their native characters, the extension's creator built PunyGuard to address this issue. The extension does not attempt to judge whether a domain looks similar to another; rather, it blocks any domain that begins with the string "xn--", which is the Punycode prefix for IDNs. This means that legitimate Japanese or Cyrillic domains will also be blocked by PunyGuard.

The creator of PunyGuard has a personal bias against Japanese domain names, and this conviction drove the design of the extension. Instead of relying on Chrome's fuzzy judgment algorithm for detecting similar-looking domains, PunyGuard uses a strict rule that blocks any domain with a label starting with "xn--". This approach eliminates the possibility of homograph attacks, where attackers exploit look-alike characters to trick users into visiting malicious sites.

To implement PunyGuard, the creator utilized Chrome's declarativeNetRequest (DNR) mechanism, registering a single rule that matches any URL containing a label starting with "xn--", including top-level domains in IDNs. The extension applies this rule to both top-level page navigations and embedded pages in iframes, without affecting the loading of resources like images or scripts.

PunyGuard effectively blocks all IDNs, regardless of how they appear in the address bar. While legitimate Japanese domains will be blocked, the creator believes that this is an acceptable trade-off given the creator's personal stance on Japanese domain names. The extension can be found on GitHub at https://github.com/sho7650/punyguard.