Re: Unicode domain names issue (Encrypting a "fake" domain name)

"L. David Baron" <[email protected]> Tue, 18 Apr 2017 22:35:30 +0900

Newsgroups	gmane.comp.mozilla.security
Message-ID	<[email protected]>

On Tuesday 2017-04-18 10:29 +0100, Gervase Markham wrote:
> Neither browsers nor CAs have a database of all domain names, such that
> they can see that one is visually confusable with another. Registries
> have this data, and it is their responsibility to deal with this problem.

So we used to have a whitelist of registries that had sensible
policies for dealing with this, but we stopped using it in
https://bugzilla.mozilla.org/show_bug.cgi?id=843689 .

Should we enable the whitelist approach again?

(One of the big issues with it was that some of the most prominent
domains, like .com, had policies that we saw as unacceptable.)

-David

-- 
𝄞   L. David Baron                         http://dbaron.org/   𝄂
𝄢   Mozilla                          https://www.mozilla.org/   𝄂
             Before I built a wall I'd ask to know
             What I was walling in or walling out,
             And to whom I was like to give offense.
               - Robert Frost, Mending Wall (1914)

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

signature.asc (application/pgp-signature, 801 B)