Re: Unicode domain names issue (Encrypting a "fake" domain name)

On 18/04/17 14:35, L. David Baron wrote:
> On Tuesday 2017-04-18 10:29 +0100, Gervase Markham wrote:
>> Neither browsers nor CAs have a database of all domain names, such that
>> they can see that one is visually confusable with another. Registries
>> have this data, and it is their responsibility to deal with this problem.
> 
> So we used to have a whitelist of registries that had sensible
> policies for dealing with this, but we stopped using it in
> https://bugzilla.mozilla.org/show_bug.cgi?id=843689 .
> 
> Should we enable the whitelist approach again?

The reason we stopped using a whitelist is that it didn't scale when the
gTLD explosion happened. This is still the case - no-one has the time or
energy to keep tracking of 1000+ anti-spoofing policies.

We could perhaps have a blacklist, but see below.

> (One of the big issues with it was that some of the most prominent
> domains, like .com, had policies that we saw as unacceptable.)

The new mechanism has the advantage of allowing IDN domains in .com,
which users both want and use. If we returned to a white or blacklist,
would we whitelist .com? If so, we are no further forward. If not, we
break all those domains.

The newly-authored https://wiki.mozilla.org/IDN_Display_Algorithm_FAQ
sets out the position in what is hopefully a clear fashion.

Gerv