Subject: Re: [idn] IDN spoofing

From: "Doug Ewell" <[email-masked]>
Date: Sat, 19 Feb 2005 13:17:56 -0800

Hans Aberg <haberg at math dot su dot se> wrote:

>>> Of cause we should minimize the risks for internet users of being
>>> mislead. This could be done by equializing similar characters,
>>> like Latin, Cyrillic and greek A, 0 and O, 1 and 1 etc, so that no
>>> visual misleading should be possible.
>>
>> OK, now fill in the "et cetera," now that you've got the obvious ones
>> out of the way.
>>
>> As long as Erik has already mentioned it (thank you very much), see
>> my post from 3 years ago to see how this task quickly goes from
>> simple to tricky to impossible:
>>
>> http://ops.ietf.org/lists/idn/idn.2002/msg00498.html
>
> If one does it that way, one quickly gets into trouble. But one
> defines a map, which merges some characters for separating IDN's,
> while retaining the original Unicode character set on the user level
> on the input. Take a character set C, which might be a subset of
> Unicode, and send the Unicode characters (or a suitable subset
> thereof) into the set of finite sequence of C. Two IDN's will be
> declared equal if mapped to the same character sequence. This map is
> only used define which IDN's are viewed as equal. But one is still
> free to use whatever Unicode sequences one wants. The map is used to
> define an equivalence relation on the set of Unicode character
> sequences, but does not in itself affect which Unicode sequences which
> are admissible.

That isn't the point.  It doesn't matter if the mapping takes place at
the character-encoding level or at some other level.  The problem of
determining which pairs of characters are confusable and should be
folded together, and which pairs aren't and shouldn't, still remains to
be solved.

The point is that there is a large set of "semi-confusable" characters,
for which it simply cannot be said conclusively that they "look alike"
or "don't look alike."  It depends on font, size, medium (paper vs.
screen), and sometimes context.  This is one of those problems for which
a partial solution simply isn't good enough.

And for something like IDNs, once you have decided on a mapping, you can
never, ever change it.  Otherwise you will have a domain name available
for registration by customer A today, but a similar one not available to
customer B six months later (or vice versa, A can't get it but B can).
Either way, you have a lawsuit.

-Doug Ewell
 Fullerton, California
 http://users.adelphia.net/~dewell/

---

From: Erik van der Poel <[email-masked]>
Date: Sat, 19 Feb 2005 14:21:43 -0800

Doug,

I agree with a lot of what you are saying (particularly, the 
"semi-confusables"), but please allow me to counter you argument below, 
just for the sake of the argument. I am not saying that this is my 
"final" opinion. (People will have noticed that I change my opinion a 
lot. Sorry about that. :-)

Doug Ewell wrote:
> This is one of those problems for which

Maybe this is one of those problems for which *no* solution simply isn't 
good enough?

I mean, I'll start with the Arial font found in Windows. Isn't it true 
that its cmap maps some characters to the same glyph index? And, even if 
someone tries to point out that Arial is a commercial product that 
someone may have been trying to get out the door quickly, thereby taking 
unjustified shortcuts, I'll point out that Michel Suignard himself 
(long-time Unicoder) already admitted that:

# No languages used in the former soviet union should require a mix of
# latin and cyrillic in a single dns label.
# Unicode contains many latin homographs in the Cyrillic block exactly for
# that reason, to avoid mixing the two scripts in a single word. It is
# unfortunate that the exact visual match is now haunting us. However it
# should not be used as a rationale to accept registration of mixed
# Cyrillic/Latin labels by tld registries.

This is from:

ftp://ops.ietf.org/pub/lists/idn.current

Am I now going to see some senior Unicoders try to backpedal on these 
comments? :-)

I hope not. A couple of senior Unicoders have already indicated that 
they are seriously considering this homograph issue, and kudos to them!

> Either way, you have a lawsuit.

And that's how it should be. PayPal should sue those that registered 
fake paypal.com names! :-)

Well, PayPal will notice that some or all of them are just there to 
start this very discussion, and hopefully won't sue those poor engineers...

More to the point, this ACE thing (ASCII Compatible Encoding) has a long 
history of incompatible prefixes. See section 5 of:

http://ietf.org/rfc/rfc3490.txt

As is the case in any network protocol migration endeavor, you may be 
able to take advantage of such incompatibilities to assist in (indeed, 
*allow*) migration. The critical thing is to have the systems support 
both the old and the new during the transition period. For example, a 
registry might support lookups from both old and new clients during the 
transition.

But of course, it will be very difficult (if not impossible) to delete 
some of the names that are determined to be (deliberate or accidental) 
spoofs of other (hopefully legitimate) names. Some of these parties have 
the resources to sue each other, but others are just, say, individuals 
who happen to be caught in the crossfire. Is it fair to delete their 
registrations? And even if it is, will the registries even bother to go 
through all this work? Finally, am I answering my own questions? :-)

Erik

---

From: "Doug Ewell" <[email-masked]>
Date: Sat, 19 Feb 2005 15:42:17 -0800

Erik van der Poel <erik at vanderpoel dot org> wrote:

> Maybe this is one of those problems for which *no* solution simply
> isn't good enough?

Maybe.

> that its cmap maps some characters to the same glyph index?

I wouldn't know.  Maybe one of the font guys does.

> ... I'll point out that Michel Suignard himself
> ...
> # Unicode contains many latin homographs in the Cyrillic block exactly
> # for that reason, to avoid mixing the two scripts in a single word...
> ...

I doubt it.  Having Cyrillic text be all-Cyrillic and not
Cyrillic-mixed-with-Latin is a good thing.  Being able to surf to the
Web site you expect and not to some spoofed variant is also a good
thing.  Reconciling these two is not necessarily an easy thing.

> start this very discussion, and hopefully won't sue those poor

Some PayPal people (say that five times fast) will probably resent the
fact that PayPal was chosen as an example.  Others, probably more
astute, will see it as a testament to their high profile and success.

> Finally, am I answering my own questions? :-)

Maybe, but at least they're being asked.

-Doug Ewell
 Fullerton, California