Re: Unicode domain names issue (Encrypting a "fake" domain name)

On 25/04/17 11:28, L. David Baron wrote:
>  * the component before the eTLD consists entirely of characters
>    that are homographs for characters in a single other script, and

(I assume you mean s/eTLD/TLD/ in each case.)

>  * the component before the eTLD is in a different script from the
>    eTLD.

AIUI this is what Chrome did, for Cyrillic only, and they said it
affected 2,800 sites in .com. I don't know if they did more analysis for
other TLDs - .ru, I suspect, would have a large number, and there would
be more if we extended to all possible homographs across all scripts. A
whitelist might solve that, but of course that would grandfather in
existing examples and not allow for businesses not yet existing or not
yet on the net.

One guiding principle I have found useful here is "what if the Internet
were invented by the Russians, and Latin was the script late to the
party?". I am trying to avoid doing anything to Cyrillic that I would
think were unfair were it done to Latin if the boot were on the other foot.

The trouble with Cyrillic in particular is that there are quite a few
clashing letters:
https://en.wikipedia.org/wiki/IDN_homograph_attack#Cyrillic
In Russian, you have a, c, e, o, p, x and y. Add in numbers, and you
have 3, 4 and 6. Cyrillic non-Russian languages add i, j and s, and if
you go rare/archaic (which may or may not be supported in the font
and/or noticeably different) you can add d, h, l and v. And that's just
lowercase. In the worst case, that's 14 of Latin's 26 letters, including
4 of the 5 vowels. It would be a significant crimp on Cyrillic domain
names if all names using only those letters didn't work except in .рф
and the like.

> (I'm assuming we already require each component to be
> single-script.)

Yes, we do. That is what solves 99% of the problem.

Gerv


_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security