41,554 blogs · 4,981,167 posts Claim your blog

Record · corpus.blog/posts/01a087be-46ff-7079-a3b1-b8c148bc6a29

A threat model for Unicode identifier spoofing

paultendo.github.io · published 25 February 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at paultendo.github.io Wayback capture

0blogs citing

First cited: —
Most recent: —
Rank this month: not ranked
External links: 10
Words captured: 1,483

Cited by

No blog we hold has cited this post yet.

Links from this post

Link

Host

https://engineering.atspotify.com/2013/06/creative-usernames

engineering.atspotify.com

https://trojansource.codes/

trojansource.codes

https://nvd.nist.gov/vuln/detail/CVE-2021-42574

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2021-42694

nvd.nist.gov

https://unicode.org/Public/security/latest/confusables.txt

unicode.org

https://www.unicode.org/reports/tr39/

unicode.org

https://rust-lang.github.io/rfcs/2457-non-ascii-idents.html

rust-lang.github.io

https://alephsecurity.com/2020/07/23/revised-homograph-attacks2/

alephsecurity.com

https://github.com/paultendo/namespace-guard/blob/main/docs/data/confusable-bench.v1.json

github.com

https://www.unicode.org/review/pri540/

unicode.org

Elsewhere on paultendo.github.io (2)

confusables.txt and NFKC disagree on 31 characters Read at the source ↗

paultendo.github.io

Unicode ships one confusable map. You need two. Read at the source ↗

paultendo.github.io