confusable-vision renders every TR39 confusable pair across 230 macOS system fonts and measures visual similarity with SSIM. 96.5% of confusables.txt is not high-risk, but 82 pairs are pixel-identical in at least one font.

Hacker News is a community-driven platform for sharing and discussing technology news, startups, and programming-related topics. Through user submissions and comments, Hacker News offers insights into emerging technology trends, industry developments, and entrepreneurial ventures. Readers can participate in discussions, share their insights, and stay informed about the latest advancements in technology and innovation.

Hacker News

A developer built confusable-vision, a tool that renders all 1,418 Unicode TR39 confusable pairs across 230 macOS system fonts and measures visual similarity using SSIM. Key findings: 96.5% of confusables.txt entries are not visually high-risk, but 82 pairs are pixel-identical in at least one font. Core Cyrillic homoglyphs (а, е, о, р, с, у, х) are pixel-identical to their Latin counterparts in 35-46 fonts including Arial, Georgia, and Verdana. The analysis reveals that confusable risk is font-dependent, not just character-pair-dependent. Fonts like Phosphate and Copperplate have 67%+ danger rates, while Zapfino has 0%. The tool uses SSIM over CNN-based approaches for determinism and reproducibility. Practical implications include browser font fallback determining spoofing risk, address bars being vulnerable to Cyrillic homograph attacks, and the need for per-script thresholds in confusable detection systems rather than binary membership checks.

I rendered 1,418 Unicode confusable pairs across 230 fonts. Most aren't confusable to the eye.

The headline: 96.5% of confusables.txt is not high-risk

Same-font vs cross-font: font pairing matters