Subject: RE: [Ltru] [psg.com #967] address homograph issuesinsecurityconsiderations

From: "Peter Constable" <[email-masked]>
Date: Thu, 12 May 2005 08:41:10 -0700

> From: [email-masked] [mailto:[email-masked]]
On
> Behalf Of Misha Wolf

> Peter Constable wrote:
> 
> > I believe the only homograph issue is between LATIN SMALL
> > LETTER L and DIGIT ONE.
> 
> What about the digit "0" and the letter "O" ?

Yes, of course.

Peter Constable

_______________________________________________
Ltru mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ltru

---

From: "Addison Phillips" <[email-masked]>
Date: Thu, 12 May 2005 09:15:18 -0700

Yes, but the security impact of such confusion is very small: you get a match or not on some requested content. Or you get the wrong content. But language tags are not addresses. Addresses present a security risk. Asking for de-L996 is a security risk how?

Addison

Addison P. Phillips
Globalization Architect, Quest Software
Chair, W3C Internationalization Core Working Group

Internationalization is not a feature.
It is an architecture. 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Peter Constable
> Sent: 2005?5?12? 8:46
> To: LTRU Working Group
> Subject: RE: [Ltru] [psg.com #967] address homograph
> issuesinsecurityconsiderations
> 
> > Behalf Of Addison Phillips
> 
> 
> > Close to rejecting it? It's utterly confused. Langtags have nothing to
> do
> > with IDN (which uses xn-- for something special) and there are no
> > homographs in the ASCII range allowed for language tags (unless you
> count
> > L vs. 1 and o vs. 0). But these are restricted in use (nearly all the
> > defined tags use alpha codes) and would have no measurable security
> impact.
> 
> Quite so. To compare with the security issues of IDN is more than a
> stretch.
> 
> On the other hand, can we be certain that someone someday might not find
> a way to turn a confusion between e.g. 1996 and l996 in some future
> client protocol?
> 
> I'm not saying I'm convinced it's something we need to do. Just raising
> possibilities.
> 
> 
> 
> Peter Constable
>