Subject: RE: [idn] homograph attacks

From: "Kane, Pat" <[email-masked]>
Date: Tue, 15 Feb 2005 14:30:54 -0500

VeriSign does prevent domains with the Russian language tag from commingling
A-Z with the Cyrillic characters.  It does permit 0-9 and the dash to be
used.  This filter also applies to other Cyrillic based languages such as
Belarusian, Ukrainian, Serbian, Macedonian and Bulgarian.  

There are other languages that are listed within ISO 639-2 that today use a
combination of Latin and Cyrillic as they were originally Latin based (Tajik
was Arabic prior to being Latin based), migrated to Cyrillic during the
Soviet era and today are migrating back to Latin.  It is common to use Latin
and Cyrillic characters in Tajik, from what I understand not being a native
speaker.  Granted there are not a lot of registrations in com net that are
Tajik, but this is just the point of an IDN.

Pat Kane

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
"Martin v. Löwis"
Sent: Tuesday, February 15, 2005 2:02 PM
To: tedd
Cc: [email-masked]; [email-masked]
Subject: Re: [idn] homograph attacks

tedd wrote:
> You all knew this was going to happen.
> 
>    http://www.p&1072;ypal.com

Indeed. However, I am somewhat disheartened that this could
happen. IMO, Verisign should have never have registered that
domain - the registrar should have provided a language for
the label, that language should have been "Russian" (or
else &1072; should not have been allowed), and this combination
of Cyrillic and Latin letters should not be allowed for the
Russian language.

Regards,
Martin

---

From: "Martin v. Löwis" <[email-masked]>
Date: Tue, 15 Feb 2005 21:29:04 +0100

Kane, Pat wrote:
> Soviet era and today are migrating back to Latin.

Thanks for the clarification. Is this information publically available
somehow? On

http://www.verisign.com/static/002533.pdf

I can find the language code list (which shows that indeed TGK and RUS
might be treated differently); I wonder whether you somehow list the
constraints implemented for each tag. How did the applicant know that
he would have to use Tajik in order to get a cyrillic letter into an
otherwise latin label?

As for the Tajik writing system: why is it then necessary to allow
mixed scripts? Wouldn't the Tajik users be satisfied if you could
either register all-Latin or all-Cyrillic labels (perhaps allowing
all-Arabic as well)?

Regards,
Martin

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Wed, 16 Feb 2005 01:43:51 +0100

Dear Pat,
I have several questions here.

1. where do you maintain an ASCII list of your language tags? Should it not 
be supported on the IANA server and common to all the gTLDs?
2. is there a list of the permitted UNICODEs codes per languages? For 
example I am interested in the French and Ukrainian sets.
3. did you decide them by yourself, or did you gather a group of lingual 
authorities to assist you. This would be very interesting.
4. would there not be a way to register IDN in using their  "xn--" version? 
It would simplify international management by resellers?

Thank you for your assistance.

---

From: "Martin v. Löwis" <[email-masked]>
Date: Wed, 16 Feb 2005 07:50:49 +0100

I don't speak for Verisign, but I can answer some of the questions:

> 1. where do you maintain an ASCII list of your language tags? 

It is *maintained* probably on some development infrastructure inside
Verisign, it is published atleast at

(found on

http://www.verisign.com/products-services/naming-and-directory-services/naming-services/internationalized-domain-names/idn-standards/idn-character-variants/page_002088.html

)

> Should it not be supported on the IANA server and common to all the gTLDs?

I personally don't see why it should be on a IANA server. It is specific
to the SRS (so I assume it is also described in the SRS documentation).
The only real users of the ASCII list of language tags (what is an
ASCII list, BTW?) are the SRS users, as they need to communicate the
language code to the SRS.

As for "should it be common to all the gTLDs", I honestly believe
the answer should be "no". Each registrar can come up with its own
policy - in particular, the question whether to support IDN or
not alone is the choice of the registrar.

But then, I don't care that much about IDN in .gov and .mil...
For .int, it seems natural to never allow IDN. The other gTLD
registries apparently haven't considered IDN yet.

> example I am interested in the French and Ukrainian sets.

This I wonder myself. The answer to your literal question is certainly
"yes". The corollary question is "can we get it?" to which the answer
might be "if you are a SRS participant", or "no".

> authorities to assist you. This would be very interesting.

See

http://www.verisign.com/products-services/naming-and-directory-services/naming-services/internationalized-domain-names/idn-standards/idn-character-variants/page_001485.html

While working to address the issue of character variants, VeriSign has 
consulted and will continue to work with all interested stakeholders. 
These groups include China Network Information Center (CNNIC) (.cn), 
Taiwan Network Information Center (TWNIC) (.tw), Korea Network 
Information Center (KRNIC) (.kr), Japan Registry Service (JPRS) (.jp), 
the Chinese Domain Name Consortium (CDNC), and the IDN Implementation 
Committee established by ICANN.

> 4. would there not be a way to register IDN in using their  "xn--" 
> version? It would simplify international management by resellers?

Why do you think the SRS currently does not use the xn-- version in
registrations? I believe it does - the registrar has to provide
the xn-- version, but the SRS will *still* perform the language
filters as if a sequence of Unicode characters was provided.

Regards,
Martin