Ewe Cant Trusst Yore Eers

The talk opens with an audience exercise: four audio clips of domain names read aloud by a screen reader, where only one is the real site. The speaker explains that the sounds of sound-alike and lookalike strings can fool listeners who cannot check spelling visually. He frames this as homophone attacks, extending earlier research into sound-alike domain squatting used for phishing.

The middle section shows that the attack surface goes further than plain homophones. Unicode characters from different scripts can be chained so that they sound out an English word, and emoji domains can collide with text domains when read aloud. ARIA labels, which override what a screen reader announces for a link, can make a link sound like a different site, and that override can be injected through cross-site scripting. Some Unicode tricks that fool sighted users are blocked by screen readers, but the audio-based ones have received little attention. The question session covered registrar and TLD rules for mixed-script domains and whether waveform comparison could help.

The closing recommendations are practical. Ask users which accessibility tools they rely on, update anti-phishing training to teach spelling mode, and encourage link resolution instead of trusting ARIA. Re-transcribing suspicious audio with speech-to-text can expose the true domain, though the speaker doubts that this scales. He asks threat hunters to look for these attacks and researchers to fuzz screen readers and speech-to-text tools.