Subject: Re: [idn] homograph attacks

From: Dirk-Willem van Gulik <[email-masked]>
Date: Tue, 15 Feb 2005 11:30:10 -0800 (PST)

On Tue, 15 Feb 2005, "Martin v. Löwis" wrote:

> >    http://www.p&1072;ypal.com
>
> Indeed. However, I am somewhat disheartened that this could
> happen. IMO, Verisign should have never have registered that
> domain - the registrar should have provided a language for
> the label, that language should have been "Russian" (or
> else &1072; should not have been allowed), and this combination
> of Cyrillic and Latin letters should not be allowed for the
> Russian language.

Which is easier than it sounds - there are thousands of homonyms in
unicode (depending on the font sometimes even significantly more) and even
in the easy western european languages you may have a accentgrave dropping
of in some fonts/cases with lowercase chars. And wether it is a true
homonym may differ from language to language and even depends on wether
this is uppercase or not.

Even in an easy language like dutch - would you see the difference between
wwww.ijselmeer.nl and www.?selmeer.nl ('i'+'j' or just unicode 0133 (or
0133 for uppercase)) ?

And even that - to a lot of readers the URLs www.langorse.co.uk and
www.1angorse.co.uk will appear identical. (Try Courier (new) or Gill Sans).

Plus it is not uncommon in some asian company/logo's to see essentially
two or even three "scripts" combined.

Dw

---

From: "Martin v. Löwis" <[email-masked]>
Date: Tue, 15 Feb 2005 21:14:26 +0100

Dirk-Willem van Gulik wrote:
> of in some fonts/cases with lowercase chars.

Please read carefully. I'm not at all suggesting that homo*graphs*
should be used in considering whether registration is allowed.

I'm suggesting that Verisign does what they say they do: define
"language packs" for each language, see

http://verisign.com/products-services/naming-and-directory-services/naming-services/internationalized-domain-names/page_001382.html

> wwww.ijselmeer.nl and www.?selmeer.nl ('i'+'j' or just unicode 0133 (or

By design, IDN normalizes U+0133 as ij, so whether you have "&#x0133;"
or "ij" in the URL - IDNA will resolve that as the same machine in
all cases.

> two or even three "scripts" combined.

Yes, that's why the language pack needs to define what characters are
acceptable. For example, in the .de zone, you simply cannot register
labels with Cyrillic or Japanese characters - DENIC just won't register
them, by policy. An adequate policy should be in place for .COM as
well. Indeed, the SRS (shared registry system) requires that each
registrar provides a language tag for each IDN label. I'm curious why
this failed for the paypal case.

Regards,
Martin