Subject: RE: [idn] homograph attacks

From: "Michel Suignard" <[email-masked]>
Date: Wed, 16 Feb 2005 14:18:51 -0800

I think that building language tables for Latin based writing systems is a nice but mostly futile exercise. Modern language are constantly borrowing from other languages using the same script. If you think that English only use a-z, A-Z, you are going to be surprised. Take for example 'Häagen-Dazs", isn't it an English brand? If not what is it? English is constantly using French and German words, among others, in everyday life usage. Think of English words such as naïve, naïvely and many others. Should non ascii letters in them they be excluded from 'english' tables?

I have seen European standard bodies spending forests of paper to try to establish these language tables, but there have never been an authoritative version because simply you can't.
 
It is not a bad idea to have language tables to filter, but you have to allow exception for the reasons exposed above.

Same is true for Cyrillic as well.

Furthermore most ccTLD won't follow any registry regulation imposed from outside. So any such regulation can only be hoped for, not expected in all cases. I can perfectly see that some gTLD and possibly few ccTLD will have such rules, but they will have to be fairly accommodating to accept reality.

Michel

-----Original Message-----
From: Erik van der Poel [mailto:[email-masked]] 
Sent: Wednesday, February 16, 2005 1:20 PM
To: William Tan
Cc: "Martin v. Löwis"; Michel Suignard; Kane, Pat; [email-masked]; [email-masked]; tedd; [email-masked]
Subject: Re: [idn] homograph attacks

Hello all,

It seems to me that a registry should not allow the registration of an IDN domain name under a particular language if that registry does not have a table for that language.

When a registry *does* have a table for a particular language, the IDN domain name is restricted to the characters that appear in that table.

So, when there is *no* table for a language, then *no* characters should be allowed. In other words, no IDN domain names (starting with xn--) should be allowed.

Also, it seems to me that registries like COM could "stop the bleeding" 
(for now) by immediately deploying systems that enforce a policy where registrations for languages for which they do not have tables are rejected.

After that, they could continue to gather or compile tables.

Regards,

Erik van der Poel

William Tan wrote:
> 
> Pat can correct me if I'm wrong, but my understanding is that VGRS 
> does NOT have a table associated with the German language. So, if you 
> went ahead and register an IDN, and selected the German language, you 
> can pretty much register any label that is permitted by IDNA, 
> including characters that aren't remotely related to German.
> 
> Regsards,
> wil.

---

From: "Martin v. Löwis" <[email-masked]>
Date: Thu, 17 Feb 2005 00:28:14 +0100

Michel Suignard wrote:
> I have seen European standard bodies spending forests of paper to try
> to establish these language tables, but there have never been an
> authoritative version because simply you can't.

Why do you say that? DENIC is using an authorative list for .DE, see

http://www.denic.de/de/domains/idns/liste.html

> It is not a bad idea to have language tables to filter, but you have
> to allow exception for the reasons exposed above.

No, you don't. The exception you mention (Häagen-Dazs) is already
covered in the list of characters. It might be that some company
cannot use its logo as a domain name - tough luck. There might not
even be a Unicode character for the logo. They will find a solution,
using some sort of transliteration. If enough users complain that
they want a certain, say, Greek character to be available in the
.de zone, DENIC might reconsider. However, I very much doubt this
will ever happen. For the .de zone, the DENIC list of characters
covers all actual needs. It may be that artificial needs are not
covered, but I could not care less.

It is a very good idea to be more restrictive at the beginning,
and the gradually become less restrictive. This is how the DNS
started out - allowing only ASCII letters. With IDNA, it is
possible to widen this, but that does not mean you cannot have
a policy more restrictive than "full Unicode".

Regards,
Martin

---

From: Martin Duerst <[email-masked]>
Date: Thu, 17 Feb 2005 09:20:45 +0900

It is very important to be clear about the fact that neither
the .de table nor the .ch table (at http://www.switch.ch/de/id/faq/idn.html)
too close a relationship with German as a language (or French,
Italian, or Romansh in the Swiss case). These tables are as
much based on user needs (which we can assume have a linguistic
basis) as on technical needs. The Swiss registry decided to
keep their iso-8859-1-based implementation, whereas the German
registry upgraded to utf-8 when they introduced IDNs.

What European standards bodies spent forests of paper on was
an attempt at some 'ultimately correct' linguistic-based table.
What we need for IDN are reasonably okay tables that do not
need to be 'linguistically correct'.

Regards,    Martin.

At 08:28 05/02/17, Martin v. L$B‹X(Bis wrote:
 >No, you don't. The exception you mention (H$BgB(Bgen-Dazs) is already