Subject: Re: [idn] IDN spoofing

From: "Doug Ewell" <[email-masked]>
Date: Sat, 19 Feb 2005 13:31:37 -0800

Philippe Verdy <vpi92 at yahoo dot fr> wrote:

> The bad thing about your argument is that you are trying to mix
> uppercase and uppercase letters. But for IDN, only lowercase letters
> are really made distinct and encodable, as uppercase letters are case
> folded to lowercase. So let's just concentrate on the set of letters
> that really are distinct in lowercase because this is the form where
> DNS servers will make distinctions in ASCII letters.

Fine, get rid of all the examples that involve uppercase.  The problem
is still there:

iι
pρ
uυ
vν
wω
yγ

-Doug Ewell
 Fullerton, California
 http://users.adelphia.net/~dewell/

---

From: "Doug Ewell" <[email-masked]>
Date: Mon, 21 Feb 2005 13:40:40 -0800

Hans Aberg <haberg at math dot su dot se> wrote:

> The suggestion I made, was to use a function to detect confusables by
> declaring them equivalent, but retaining the full Unicode character
> set for representing the IDN's. If this is used at the registration
> level only, the only thing that happens when somebody enters a
> confusable, is that it is rejected. There is a problem only when an
> authority admits parallel, confusable names to be registered.

Granted.  The problem, as I have said so often, is determining what the
set of "confusables" is.  Don't just say a/а and o/ο, either; that's
only the tip of the iceberg.

-Doug Ewell
 Fullerton, California

---

From: "Doug Ewell" <[email-masked]>
Date: Mon, 21 Feb 2005 13:52:06 -0800

Once more from Hans Aberg <haberg at math dot su dot se>:

> ... For example, Latin and Greek "A" are equal. Then this forces
> lowercase "a" and alpha top become equivalent, despite the fact that
> no-one familiar with these scripts will confuse them.

Not everyone is familiar with all these scripts, or expects them to
appear arbitrarily mixed. That's why there's a spoofing problem.

-Doug Ewell
 Fullerton, California