Subject: [Ltru] [psg.com #967] address homograph issues in security considerations

From: "Randy Presuhn" <[email-masked]>
Date: Wed, 11 May 2005 23:43:14 -0700

Hi -

> Comment
> http://www.ietf.org/mail-archive/web/ltru/current/msg00540.html
> reads:
> "39. 4. An important security consideration is homographs. It is
> certainly possible to include part of text in a foreign language which
> look printed as in another language or having a different meaning or
> printing (phishing). Concerns are also the double "-" which is
> specifically used by the IANA code "xn"."
>
> language issue, rather than tagging,
> see http://www.ietf.org/mail-archive/web/ltru/current/msg00628.html

I think we're close to rejecting this one.

Randy, ltru co-chair

Technical comment:
Perhaps this one might be accomodated by including an explicit statement
about how the repertoire for creating language tags makes homographs a
non-issue (at least in a well-designed font) for the tags themselves.

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru

---

From: "Doug Ewell" <[email-masked]>
Date: Sat, 21 May 2005 13:26:28 -0700

John Cowan <jcowan at reutershealth dot com> wrote:

> I think this is too strong because of the ell vs Eye contrast combined
> with the official caselessness of tags.  We already have 23 pairs of
> subtags that differ only in having an ell vs. an eye.  For example, ia
> and la are both valid language subtags, as are sal and sai; GI and GL
> are both valid region subtags.  In fact, ii, li, IL, and LI are all
> valid subtags.
>
> As long as everything is cased consistently, there is no problem, but
> if someone uses anomalous casing, these would become a problem under
> your proposal.  I propose therefore that only zero/oh, one/eye, and
> one/ell be treated as confusables; these could arise only in variant
> subtags.

+l

--
Doug Ewell
Fullerton, California
http://users.adelphia.net/~dewell/

---

From: "Doug Ewell" <[email-masked]>
Date: Mon, 23 May 2005 22:27:54 -0700

Addison Phillips <addison dot phillips at quest dot com> wrote:

> <t>Language tags are formed from ASCII letters and digits. Some of
> these characters may be confused when displayed in certain fonts in
> certain user interfaces. In well-formed tags (where all of the subtags
> are actually valid), the only subtags that are affected are registered
> primary-language subtags (those longer than four characters, none of
> which exist at the time of adoption of this document) or variant
> subtags. The character pairs normally considered confusable in these
> subtags are 0 vs. O (%x30 vs. %x4F) and 1 and l (%x31 vs. %x6c). No
> subtags will be permitted for registration that differ only by these
> character pairs. For example, if a subtag 'example' (%x65.78.61.6d.70.
> 6c.65) were registered as a variant, the subtag 'examp1e' (%x65.78.61.
> 6d.70.31.65) would not be valid for registration. In addition,
> applications for registration that present obviously confusable
> sequences (such as 'examp1e') will probably be rejected.</t>

Whew.

I wouldn't say "some of these characters may be confused."  I think
they're quite certain of their own identity.  :-)  I think some of them
might be confused for each other, though.

I think the third sentence doth protest too much, and could be trimmed
to state simply that this applies only to subtags proposed on
registration forms, not those that come from core standards.  I might
remove the eye-glazing hex sequences, and write something like "the
subtag 'examp1e' (with the digit one)" if the spoof might not be clear
enough.  And I would definitely state the obvious case of deliberate
spoofing ("examp1e") before the less-likely case where two subtags might
both be legitimate, but the second is rejected because of similarity to
the first.

---

From: "Doug Ewell" <[email-masked]>
Date: Mon, 23 May 2005 22:58:33 -0700

Randy Presuhn <randy underscore presuhn at mindspring dot com> wrote:

> The language tag associated with a particular bit of content is of no
> consequence whatsoever in determining whether that content might
> contain possible homographs.  The fact that a text is tagged as being
> in one language provides no assurance whatsoever that it doesn't
> contain characters from scripts other than the one(s) associated with
> that language.

In a similar vein, I would have sworn that either the draft, or RFC 3066
or 1766, had a passage somewhere to the effect that there was no
guarantee that a run of text tagged, say, "fr" was actually in the
French language.  In other words, there is nothing that can be done
within the language tagging mechanism to ensure it will never be
misused.

I couldn't find such a passage -- maybe I read it somewhere else -- but
it is certainly true, and closely related to Randy's statement above.

> Would it satisfy you if we were to include this statement in the
> security considerations section?  Would other WG members object to
> including this statement?

I would not object at all.  At the very least, it is harmless.