Subject: [idn] Mac OS X Safari and IDN spoofing

From: Paul Hoffman <[email-masked]>
Date: Tue, 22 Mar 2005 13:19:05 -0800

Another browser vendor's solution: 
<http://docs.info.apple.com/article.html?artnum=301116>.

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Gervase Markham <[email-masked]>
Date: Tue, 22 Mar 2005 21:43:27 +0000

> <http://docs.info.apple.com/article.html?artnum=301116>.

I suspect that this is also an interim solution, like the one 
mozilla.org came up with. I would hope they can find a better way than 
freezing out the Greeks, Cherokee Indians and Russians permanently. :-)

Gerv

---

From: James Seng <[email-masked]>
Date: Wed, 23 Mar 2005 06:45:13 +0800

i thought the ideas they have was pretty interesting

choose the scripts you use most often that you like to display normally 
but otherwise, will display in punycode.

a good short term solution so i expect them to evolve over time as we 
gain more experience.

now, do we want to standard "this" or do we want apps people to 
continue to evolve the mechanism to deal with spoofing? i prefer the 
latter.

james

---

From: Erik van der Poel <[email-masked]>
Date: Wed, 23 Mar 2005 11:34:07 -0800

Opera addressed the IDN spoofing issue with a number of changes:

In 8.0 beta 2, they introduced a whitelist of TLDs that they consider 
safe because they appear to have good policies in place: no, jp, de, se, 
kr, tw, cn, at, dk, ch, and li. TLDs not on this list have their domain 
labels checked for characters outside Latin-1 (ISO 8859-1, Unicodes up 
to U+00FF). If there are characters outside Latin-1, the label is 
displayed in Punycode.

In 8.0 beta 3, they added hu and museum to the TLD whitelist, and they 
allowed the user to switch to a blacklist using the tilde (~), e.g. 
~:com:tw:. The character checking now allows a single script or specific 
script combinations in each domain label or sublabel, separated by dot 
(.) and hyphen (-). This allows e.g. xml-ccccccc where xml is ASCII and 
cccccc is the Russian word for "documents" in Cyrillic (I think).

I have added links to Opera's 8.0 beta 2 and 3 release notes and IDN 
Security Advisory to my Related Work section:

http://nameprep.org/#related-work

Another idea that I mentioned a while ago in a couple of forums is to 
check for characters used in the user's languages, which can be found in 
the browser localization and HTTP Accept-Language list. There are many 
different ways to display these labels, e.g. Punycode for labels with 
characters outside the user's languages. Another idea is to use pale 
green for characters in the user's main language, pale yellow for those 
in the user's secondary languages, and pale red for characters outside 
those languages. These colors are based on traffic lights.

James Seng wrote:

> now, do we want to standard "this" or do we want apps people to continue 
> to evolve the mechanism to deal with spoofing? i prefer the latter.

I agree that the IETF should not standardize these types of UI policies, 
though it might be a good idea to have some recommendations in an 
informative appendix or something.

However, the IETF may wish to consider standardizing a limited set of 
characters in IDN. For example, we may wish to extend RFC 952's host 
name rules (LDH = Letters, Digits and Hyphen) to a Unicode equivalent, 
thereby disallowing such characters as the slash homographs (e.g. math 
symbol for division).

As I wrote this email, Mark Davis sent a very relevant email to the 
Unicode list:

http://www.unicode.org/mail-arch/

Click the first link, user unicode-ml, password unicode.

Erik

---

From: Gervase Markham <[email-masked]>
Date: Fri, 25 Mar 2005 15:11:03 +0000

> but otherwise, will display in punycode.

What sort of effect do you think it will have on IDN acceptance and use 
if companies using IDN domains know that their domain name will display 
as gobbledygook in an unknown percentage of their customer's browsers?

Gerv

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Fri, 25 Mar 2005 17:01:10 +0100

At 16:11 25/03/2005, Gervase Markham wrote:
>What sort of effect do you think it will have on IDN acceptance and use if 
>companies using IDN domains know that their domain name will display as 
>gobbledygook in an unknown percentage of their customer's browsers?

They will not if they are "babel names", ie names registered for their 
punycode display, such as "xn--cocacola.com".

I made a list in using Simon Josefsson oline tool and a small funycode 
program for Adam to test them. What he did. I do not remember the names I 
gave: I tried a few like xn--adam-costello.com, xn--vint-cerf.ibm, 
xn--gw-bush.com, etc. Many worked. If I am right the most brillant was 
xn--ibm.com which called for a single character IDN. The main issue is that 
if you TM the Unicode name there is nothing to be done.
jfc

---

From: Erik van der Poel <[email-masked]>
Date: Fri, 25 Mar 2005 11:16:39 -0800

Gervase Markham wrote:
> James Seng wrote:
>> choose the scripts you use most often that you like to display 
>> normally but otherwise, will display in punycode.
> 

Companies, organizations and individuals are permitted to register more 
than one domain name. Companies that operate all over the world may wish 
to register domain names using their local names. It remains to be seen 
whether we will ever reach the point where a large percentage of users 
can view domain names containing characters from their "own" character 
set, but some registrants may wish to register their names now anyway, 
just in case. (Anyone willing to guess what that percentage is at the 
moment?)

I just went to Coca-Cola's site and navigated to their Chinese site to 
try to find out how they "spell" their name in Chinese. I don't know if 
this email is going to work, but here it is: 可口可乐

Then I used IBM's IDN demo to convert it to Punycode: xn--fjqs9k9ab. 
Then I tried the CN and COM domains, and found that the CN one was a 
totally unrelated site, probably a squatter. The COM site was another 
squatter, with "money & sex" in large letters, and "domain names ... for 
sale".

I also tried to find the Taiwanese version of Coca-Cola. Again, this may 
not work: 可口可樂

The Punycode for this is xn--6orxab817t. I tried this name in the TW 
domain and reached Taiwan's NIC, where the Coca-Cola company can now 
register their name for a reasonable price (hopefully). The COM domain 
had another squatter.

So, while we are talking about technical details, squatters are taking 
action...

Erik

PS If I got the Chinese name for Coca-Cola wrong, or the Punycode is 
incorrect, please let me know. This was just an experiment...

---

From: Erik van der Poel <[email-masked]>
Date: Fri, 25 Mar 2005 15:39:44 -0800

> as gobbledygook in an unknown percentage of their customer's browsers?

Punycode is gobbledygook to everybody, but Japanese is gobbledygook to a 
lot of Englishmen, too. I realize that you don't want to balkanize the 
Net, but to some extent, the world already is. We don't understand each 
other's languages, nor should we, really. If we are very lucky, we may 
eventually get to the point where we can display every IDN in Unicode 
form, no matter which TLD it is in.

The Japanese have been pushing very hard for IDN. If you take a look at 
jprs.jp, you will see many Japanese domain names. You will also see that 
Opera is listed in their news on March 1st since it has reenabled IDNs 
in 8.0 beta 2. And Microsoft was mentioned on Jan. 26th since the IRI 
spec (RFC 3987) was published, thereby clearing the way for IDN support 
in MSIE 7:

http://news.zdnet.co.uk/software/windows/0,39020396,39191671,00.htm
http://jprs.jp/whatsnew/

JPRS also has a page listing the various browsers, mobile phone apps and 
other Internet apps that support IDNs. The browsers are listed in the 
order MSIE, Netscape, Mozilla Suite, Mozilla Firefox, Opera and Safari. 
(It's not alphabetical order.) The Mozilla entries also describe how to 
reenable IDNs.

http://jdna.jp/jdn/browsers/

The following page also talks about the pain of installing a plug-in and 
that users might not even know that they need to install one (i.e. 
VeriSign's plug-in for MSIE):

http://xn--wgv71a119e.jp/access/

It will be interesting to see what MSIE and .com do in the IDN space.

Erik