Re: Unicode domain names issue (Encrypting a "fake" domain name)

Besides the fact lists are hard to maintain.
There isn't anything technical preventing Firefox having one for existing
popular sites that registries have registered and shouldn't have right?
This could just make the punycode show in the browser for sites in this
list.

On Tue, Apr 25, 2017 at 11:48 AM, Gervase Markham <[email protected]> wrote:

> On 25/04/17 11:28, L. David Baron wrote:
> >  * the component before the eTLD consists entirely of characters
> >    that are homographs for characters in a single other script, and
>
> (I assume you mean s/eTLD/TLD/ in each case.)
>
> >  * the component before the eTLD is in a different script from the
> >    eTLD.
>
> AIUI this is what Chrome did, for Cyrillic only, and they said it
> affected 2,800 sites in .com. I don't know if they did more analysis for
> other TLDs - .ru, I suspect, would have a large number, and there would
> be more if we extended to all possible homographs across all scripts. A
> whitelist might solve that, but of course that would grandfather in
> existing examples and not allow for businesses not yet existing or not
> yet on the net.
>
> One guiding principle I have found useful here is "what if the Internet
> were invented by the Russians, and Latin was the script late to the
> party?". I am trying to avoid doing anything to Cyrillic that I would
> think were unfair were it done to Latin if the boot were on the other foot.
>
> The trouble with Cyrillic in particular is that there are quite a few
> clashing letters:
> https://en.wikipedia.org/wiki/IDN_homograph_attack#Cyrillic
> In Russian, you have a, c, e, o, p, x and y. Add in numbers, and you
> have 3, 4 and 6. Cyrillic non-Russian languages add i, j and s, and if
> you go rare/archaic (which may or may not be supported in the font
> and/or noticeably different) you can add d, h, l and v. And that's just
> lowercase. In the worst case, that's 14 of Latin's 26 letters, including
> 4 of the 5 vowels. It would be a significant crimp on Cyrillic domain
> names if all names using only those letters didn't work except in .рф
> and the like.
>
> > (I'm assuming we already require each component to be
> > single-script.)
>
> Yes, we do. That is what solves 99% of the problem.
>
> Gerv
>
>
> _______________________________________________
> dev-security mailing list
> [email protected]
> https://lists.mozilla.org/listinfo/dev-security
>
_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security