Subject: RE: [Ltru] [psg.com #967] address homograph issues in securityconsiderations

From: "Addison Phillips" <[email-masked]>
Date: Thu, 12 May 2005 08:37:33 -0700

Close to rejecting it? It's utterly confused. Langtags have nothing to do with IDN (which uses xn-- for something special) and there are no homographs in the ASCII range allowed for language tags (unless you count L vs. 1 and o vs. 0). But these are restricted in use (nearly all the defined tags use alpha codes) and would have no measurable security impact.

Addison

Addison P. Phillips
Globalization Architect, Quest Software
Chair, W3C Internationalization Core Working Group

Internationalization is not a feature.
It is an architecture. 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Randy Presuhn
> Sent: 2005?5?11? 23:43
> To: LTRU Working Group
> Subject: [Ltru] [psg.com #967] address homograph issues in
> securityconsiderations
> 
> Hi -
> 
> > Comment
> > http://www.ietf.org/mail-archive/web/ltru/current/msg00540.html
> > reads:
> > "39. 4. An important security consideration is homographs. It is
> > certainly possible to include part of text in a foreign language which
> > look printed as in another language or having a different meaning or
> > printing (phishing). Concerns are also the double "-" which is
> > specifically used by the IANA code "xn"."
> >
> > language issue, rather than tagging,
> > see http://www.ietf.org/mail-archive/web/ltru/current/msg00628.html
> 
> I think we're close to rejecting this one.
> 
> Randy, ltru co-chair
> 
> Technical comment:
> Perhaps this one might be accomodated by including an explicit statement
> about how the repertoire for creating language tags makes homographs a
> non-issue (at least in a well-designed font) for the tags themselves.
> 
> 
> 
> 
> _______________________________________________
> Ltru mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/ltru

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru

---

From: "Peter Constable" <[email-masked]>
Date: Mon, 23 May 2005 14:20:09 -0700

> From: [email-masked] [mailto:[email-masked]]
On Behalf Of
> John Cowan

> As long as everything is cased consistently, there is no problem, but
if someone
> uses anomalous casing, these would become a problem under your
proposal.
> I propose therefore that only zero/oh, one/eye, and one/ell be treated
as
> confusables; these could arise only in variant subtags.

As John notes, there isn't an issue for subtags from ISO source
standards when casing conventions are applied, though there certainly
could be when they are not -- e.g. "ia" and "la" in ISO 639-1 -- but we
don't want to prohibit such on the basis of failure to apply casing
conventions: a security-conscious app *should* apply the casing
conventions if displaying these tags in a UI. 

As John also notes, zero/Oh, one/Eye and one/el issues can arise for
variants, and we should ensure that they are prevented. They can also
arise for the registered-lang subtag, and that should also be prevented.

The registered-lang subtags is also susceptible to the el / "Eye" issue
since there are no casing conventions for this subtag. I think we should
be adding prevention for that as well.

Since extensions cannot be interpreted without reference to other RFCs,
I don't think we need to worry about homographs within extensions.

Peter Constable