View source for Homoglyph

{{Short description|Different glyphs which are visually similar}}
{{Multiple issues|
{{original research|date=July 2016}}
{{more citations needed|date=July 2016}}
}}
[[File:Homoglyph a.svg|thumb|The homoglyphs<br />{{unichar|0061|Latin Small Letter A}} and<br />{{unichar|0430|Cyrillic Small Letter A}} overlaid.  In the image, both characters are set in [[Helvetica]] LT Std Roman.]]
In [[orthography]] and [[typography]], a '''homoglyph''' is one of two or more [[grapheme]]s, [[character (computing)|characters]], or [[glyph]]s with shapes that appear identical or very similar but may have differing meaning. The designation is also applied to sequences of characters sharing these properties.

In 2008, the [[Unicode Consortium]] published its Technical Report #36<ref name=":0">{{cite web|url=https://www.unicode.org/reports/tr36/|title=UTR #36: Unicode Security Considerations|website=www.unicode.org}}</ref> on a range of issues deriving from the visual similarity of characters both in single scripts, and similarities between characters in different scripts.

Examples of homoglyphic symbols are (a) the [[diaeresis (diacritic)|diaeresis]] and umlaut (both a pair of dots, but with different meaning, although [[character encoding|encoded]] with the same [[code point]]s); and (b) the [[hyphen]] and [[minus sign]] (both a short horizontal stroke, but with different meaning, although often encoded with [[hyphen-minus|the same code point]]). Among [[numerical digit|digits]] and [[letter (alphabet)|letters]], digit [[1]] and lowercase [[l]] are always encoded separately but in many [[typeface]]s are given very similar glyphs, and digit [[0]] and capital [[O]] are always encoded separately but in many typefaces are given very similar glyphs. Virtually every example of a homoglyphic pair of characters can potentially be differentiated graphically with clearly distinguishable glyphs and separate code points, but this is not always done. [[Typeface]]s that do not emphatically distinguish the one/el and zero/oh homoglyphs are considered unsuitable for writing [[formula]]s, [[URL]]s, [[source code]], IDs and other text where characters cannot always be differentiated without [[context (language use)|context]]. Fonts which distinguish glyphs by means of a [[slashed zero]], for example, are preferred for those uses.

==Related terms==
The term ''[[homograph]]'' is sometimes misused [[synonym]]ously with ''homoglyph'', but in the usual linguistic sense, homographs are [[word]]s that are spelled the same but have different meanings, a property of words, not characters.

[[Allograph]]s are [[typeface]] design variants that look different but mean the same thing{{snd}} for example {{serif|{{angbr|g}}}} and {{sans-serif|{{angbr|g}}}}, or a [[dollar sign]] with one or two strokes. The term '''''synoglyph''''' has a similar but slightly more abstract meaning{{snd}} for example the symbol {{angbr|£}} and the letter {{angbr|L}} (in [[£sd|Lsd]]) both mean the [[pound sterling]],<ref>{{cite web|title=A writer's guide to diacritics and special characters |url=https://www.textwizard.com/copywriters-diacritics-special-characters/ | first=Chas |last=Walton |date= October 7, 2020 |website=Text Wizard}}</ref> but only in that context. Allographs and synoglyphs are also known informally as ''display variants''.

==Trema for umlaut and diaeresis==
The ''[[Two dots (diacritic)|trema]]'' is used to indicate [[Umlaut (linguistics)|umlaut]] or [[Vowel hiatus|diaeresis]]. In the days of early mechanical typewriters it was typed with the same key (using the "backspace and over-type" technique) used for a double inverted comma. However, the umlaut originated specifically as a pair of short vertical lines, not two dots (see [[Sutterlin]]). Incidentally, the two dots above the letter ⟨ë⟩ in Albanian are described as a ''diaeresis'' but do not fulfil the function of a diaeresis.
<ref>Describing these as homoglyphs is questionable as there are probably no languages in which the glyph can fulfil both these roles. It would be just as valid to describe, say, a grave accent as a homoglyph because it fulfils different roles in different languages.</ref>

== 0 and O; 1, l and I ==
Two common and important sets of homoglyphs in use today are the digit zero ⟨0⟩ and the capital letter ⟨O⟩; and the digit one ⟨1⟩, the lowercase letter ''L'' ⟨l⟩ and the uppercase ''i'' ⟨I⟩. In the early days of mechanical typewriters it was common to omit keys for the digits ⟨1⟩ and ⟨0⟩, and the keys for the letters ⟨l⟩ and ⟨O⟩ produced glyphs used for both characters. As typists who had used such typewriters transitioned in the 1970s and 1980s to being computer keyboard operators, their old keyboarding habits continued with them and were an occasional source of confusion.

Most current type designs carefully distinguish between these homoglyphs, usually by drawing the digit zero narrower and drawing the digit one with prominent [[serifs]]. Early computer print-outs went even further and marked the zero with a slash or dot, which led to a new conflict involving the [[Scandinavian language|Scandinavian]] letter "[[Ø]]" and the Greek letter Φ ([[phi]]). The redesigning of character types to differentiate these characters has meant less confusion.<ref name="helfrich">{{cite conference |last1=Helfrich |first1=James |first2=Rick |last2=Neff |title=2012 e ''Crime'' Researchers Summit |chapter=Dual canonicalization: An answer to the homograph attack |conference= eCrime Researchers Summit (eCrime), 2012 |year=2012|pages=1–10 |doi=10.1109/eCrime.2012.6489517 |isbn=978-1-4673-2543-1 }}</ref>

Some type designs conform to the [[DIN]] 1450 legibility standard by carefully designing such characters to be easy to distinguish: [[slashed zero]] to distinguish it from capital ⟨O⟩; [[l#Forms and variants|lowercase l]] with a tail and uppercase ⟨I⟩ with serifs to distinguish it from the digit ⟨1⟩; distinguishing the numeral ⟨5⟩ from the capital ⟨S⟩; etc.<ref>
Nigel Tao, Chuck Bigelow, and Rob Pike.  
[https://go.dev/blog/go-fonts Go fonts: DIN Legibility Standard"].
2016.
</ref>

An example of confusion due to near-homoglyphs arose from the use of a {{angbr|y}} to represent a {{angbr|þ}} ([[Thorn (letter)|thorn]]). Early English typesetters imported Dutch typesets that did not contain the latter character, so used the letter {{angbr|y}} instead because (in [[Blackletter]] typeface) they look sufficiently similar.<ref name=Hill>{{cite book |title=The Routledge Handbook of the English Writing System |isbn=9780367581565 |chapter=Chapter 25: Typography and the printed English text |first=Will |last=Hill |date=30 June 2020 |chapter-url=https://arro.anglia.ac.uk/id/eprint/703215/1/25HillFinalDV.pdf |page=6 |publisher=Taylor & Francis |quote=The types used by Caxton and his contemporaries originated in Holland and Belgium, and did not provide for the continuing use of elements of the Old English alphabet such as thorn ⟨þ⟩, eth ⟨ð⟩, and yogh ⟨ʒ⟩. The substitution of visually similar typographic forms has led to some anomalies which persist to this day in the reprinting of archaic texts and the spelling of regional words. The widely misunderstood 'ye' occurs through a habit of printer’s usage that originates in Caxton’s time, when printers would substitute the ⟨y⟩ (often accompanied by a superscript ⟨e⟩) in place of the thorn ⟨þ⟩ or the eth ⟨ð⟩, both of which were used to denote both the voiced and non-voiced sounds, /ð/ and /θ/ (Anderson, D. (1969) The Art of Written Forms. New York: Holt, Rinehart and Winston, p 169) |access-date=24 January 2024 |archive-date=10 July 2022 |archive-url=https://web.archive.org/web/20220710022857/https://arro.anglia.ac.uk/id/eprint/703215/1/25HillFinalDV.pdf |url-status=dead }}</ref> It has led in modern times to such phenomena as ''[[Ye olde]] shoppe'', implying incorrectly that the word ''the'' was formerly written ''ye'' {{IPAc-en|j|iː}} rather than ''þe''. The spelling of the name [[Menzies]] (pronounced ''Mengis'' and originally spelled ''Menȝies'') arose for the same reason: the letter {{angbr|z}} was substituted for {{angbr|ȝ}} ([[yogh]]).

== Multi-letter homoglyphs ==
<!-- Both of the following span tags are needed, since this page is, by default, sans-serif when displayed and serif when printed. -->
[[File:Letters m and r+n in fonts Arial, Calibri, Times New Roman, Cambria, Walbaum Fraktur, Comic Sans.svg|thumb|The letter ⟨m⟩ and letters ⟨rn⟩ in typefaces [[Arial]], [[Calibri]], [[Times New Roman]], [[Cambria (typeface)|Cambria]], [[Walbaum (typeface)|Walbaum]]-[[Fraktur]], and [[Comic Sans]]]]
[[File:Stefan Szczotkowski (1767-1836).jpg|thumb|'''''St'''efan Szczotkowski'' looks like '''''A'''effan Szczotkowski'' on the gravestone.]]
Some other combinations of letters look similar, for instance ⟨rn⟩ looks similar to ⟨m⟩, ⟨cl⟩ looks similar to ⟨d⟩,  and ⟨vv⟩ looks similar to ⟨w⟩.

In certain narrow-spaced fonts (such as [[Tahoma (typeface)|Tahoma]]), placing the letter ⟨c⟩ next to a letter such as ⟨j⟩, ⟨l⟩ or ⟨i⟩ will create a homoglyph, such as ⟨<span style="font: 8pt Tahoma, sans-serif;">cj cl ci</span>⟩ (⟨g d a⟩).

When some characters are placed next to each other, seen together at a glance they give the visual impression of another, unrelated character. A more precise way of saying this is that some [[Typographical ligature|typographic ligatures]] can look similar to standalone glyphs. For example, the ⟨{{not a typo|ﬁ}}⟩ ligature (of ⟨f⟩ and ⟨i⟩) can look similar to ⟨A⟩ in some typefaces or fonts. This potential for confusion is sometimes an argument made against the use of ligatures.{{Citation needed|date=August 2009}}

== Canonicalization ==

Homoglyphs of all kinds can be detected through a process called 'dual canonicalization'.<ref name="helfrich"/> The first step in this process is to identify homoglyph sets, namely characters appearing the same to a given observer. From here, a single token is specified to represent the homoglyph set. This token is called a canon. The next step is to convert each character in the text to the corresponding canon in a process called [[canonicalization]]. If the canons of two runs of text are the same but the original text is different, then a homoglyph exists in the text.

== Homoglyph prevention ==

Homoglyph attacks can be mitigated through a combination of user awareness and proactive measures. It is crucial to educate users about the risks associated with homoglyph attacks, urging them to meticulously inspect URLs before clicking.<ref>https://governance.dev/phishing-domain-check, accessed on February 12, 2024</ref> Employing advanced security solutions, particularly those capable of scanning for homoglyph variations in domain names, can automate the detection and prevention of potential threats. Additionally, implementing stringent domain name monitoring and registration policies can help identify and neutralize homoglyph-related risks promptly. By fostering a culture of cyber vigilance and leveraging cutting-edge technologies, organizations can fortify their defenses against homoglyph attacks, ensuring a more secure online environment.

== Unicode homoglyphs ==
[[File:Venn diagram gr la ru.svg|thumb|right|The three most prominent European alphabets (Greek, Cyrillic and Latin) share many letter forms that are encoded in Unicode under separate code points.]]
[[Unicode]] has [[code point]]s for many strongly homoglyphic characters, known as "confusables".<ref name=":0" /> These present security risks in a variety of situations (addressed in UTR#36)<ref>{{cite web |title=UTR #36: Unicode Security Considerations |url=http://unicode.org/reports/tr36/ |website=unicode.org}}</ref> and were called to particular attention in regard to [[internationalized domain name]]s. In theory at least, one might deliberately spoof a domain name by replacing one character with its homoglyph, thus creating a second domain name, not readily distinguishable from the first, that can be exploited in [[phishing]] (''see main article [[IDN homograph attack]]''). In many [[typeface]]s, the [[Greek alphabet|Greek]] letter ⟨Α⟩, the [[Cyrillic]] letter ⟨А⟩ and the [[Latin alphabet|Latin]] letter ⟨A⟩ are visually identical, as are the Latin letter ⟨a⟩ and the Cyrillic letter ⟨а⟩ (the same can be applied to the Latin letters "aBceHKopTxy" and the Cyrillic letters "{{Script|Cyrl|аВсеНКорТху}}"). A domain name can be spoofed simply by substituting one of these forms for another in a separately registered name. There are also many examples of near-homoglyphs within the same script such as ⟨í⟩ (with an [[acute accent]]) and ⟨i⟩ (with a [[tittle]]), ⟨É⟩ (''E''-acute) and ⟨Ė⟩ (⟨E⟩ with dot above) and ⟨È⟩ (''E''-grave), ⟨Í⟩ (capital ⟨I⟩ with an acute accent) and ⟨ĺ⟩ (lowercase ⟨L⟩ with acute accent). When discussing this specific security issue, any two sequences of similar characters may be assessed in terms of its potential to be taken as a ''homoglyph pair'', or if the sequences clearly appear to be words, as ''pseudo-homographs'' (noting again that these terms may themselves cause confusion in other contexts). In the [[Chinese language]], many [[simplified Chinese characters]] are homoglyphs of the corresponding [[traditional Chinese characters]].

Efforts by [[DNS registry|TLD registries]] and [[Web browser]] designers aim to minimize the risks of homoglyphic confusion. Commonly, this is achieved by prohibiting names which mix character sets from multiple languages ([[Toys "R" Us|toys-Я-us.org]], using the Cyrillic letter ⟨[[Ya (Cyrillic)|Я]]⟩, would be invalid, but [[Uncyclopedia#Portuguese – Desciclopédia|wíkipedia.org]] and [[Wikipedia|wikipedia.org]] still exist as different websites); Canada's [[.ca]] registry goes one step further by requiring names which differ only in [[diacritic]]s to have the same owner and same registrar.<ref>{{cite web |url=http://www.cira.ca/why-ca/french-ca/ |title=Register a .CA in French! |access-date=2013-03-29 |url-status=dead |archive-url=https://web.archive.org/web/20130328203849/http://www.cira.ca/why-ca/french-ca/ |archive-date=2013-03-28 }}</ref> The handling of Chinese characters varies: in [[.org]] and [[.info]] registration of one variant renders the other unavailable to anyone, while in [[.biz]] the traditional and simplified versions of the same name are delivered as a two-domain bundle which both point to the same [[domain name server]].

Relevant documentation will be found both on the developers' Web sites, and on an IDN Forum<ref>{{cite web|url=http://forum.icann.org/lists/idn-guidelines/|title=ICANN Email Archives: [idn-guidelines]|website=forum.icann.org}}</ref> provided by [[ICANN]].

[[File:ES1845_keyboard.jpg|thumb|upright 1.5|ES1845 JCUKEN-QWERTY hybrid layout keyboard]]
The Cyrillic letter {{angbr|С}} ({{unichar|0421|nlink=}}) not only looks like Latin {{angbr|C}} ({{unichar|0043|nlink=}}), but also occupies the same button in JCUKEN-QWERTY hybrid layout keyboards. This design nuance can be seen on the C/С button represented in [[Keyboard Monument]] in [[Yekaterinburg]].

== See also ==
*{{annotated link|IDN homograph attack}}
*{{annotated link|Duplicate characters in Unicode}}
*[[Vehicle registration plates of Bosnia and Herzegovina]] use only numbers and letters that look the same in the Latin and Cyrillic alphabets.
* {{Transliteration|ko|[[Yaminjeongeum]]}}, South Korean language game of intentionally substituting [[Hangul]] characters for homoglyphs.

== References ==
{{Reflist}}

== External links ==
{{Wiktionary}}
*[https://www.unicode.org/Public/security/latest/confusables.txt https://www.unicode.org/Public/security/latest/confusables.txt] - recommended confusable mapping for IDN.

{{Unicode navigation}}

[[Category:Typography]]
[[Category:Unicode]]