View Single Post
We used to decode Unicode characters in the URL, but phishing sites started taking advantage of that browser feature to try to spoof sites like paypal and get people to enter their financial data.

Secunia reported this security issue to us (see their Multiple Browsers IDN Spoofing Test), and we quickly released an OmniWeb 5.1.1 patch to turn off that support and close that hole. We left a preference in place called DecodeIDNHostnames which people could use to turn that support back on, but we accidentally lost that support in 5.5 when we rewrote a lot of that code during the move from WebCore to WebKit.

We intend to bring back that preference and to make it site-specific, so you can decide to turn it on for sites you trust but leave it off by default. But (according to our bug database) we only get asked about it about once every two years, so it hasn't been a very high priority. If you want to vote for these features, they're in our database as <bug://bugs/30963> (Regression: Reimplement IDN support) and <bug://bugs/21439> (Add a site preference for DecodeIDNHostnames).