Re: homograph attacks

Dirk-Willem van Gulik wrote:
>>Indeed. However, I am somewhat disheartened that this could
>>happen. IMO, Verisign should have never have registered that
>>domain - the registrar should have provided a language for
>>the label, that language should have been "Russian" (or
>>else &1072; should not have been allowed), and this combination
>>of Cyrillic and Latin letters should not be allowed for the
>>Russian language.
> 
> 
> Which is easier than it sounds - there are thousands of homonyms in
> unicode (depending on the font sometimes even significantly more) and even
> in the easy western european languages you may have a accentgrave dropping
> of in some fonts/cases with lowercase chars.

Please read carefully. I'm not at all suggesting that homo*graphs*
should be used in considering whether registration is allowed.

I'm suggesting that Verisign does what they say they do: define
"language packs" for each language, see

http://verisign.com/products-services/naming-and-directory-services/naming-services/internationalized-domain-names/page_001382.html

> Even in an easy language like dutch - would you see the difference between
> wwww.ijselmeer.nl and www.?selmeer.nl ('i'+'j' or just unicode 0133 (or
> 0133 for uppercase)) ?

By design, IDN normalizes U+0133 as ij, so whether you have "ij"
or "ij" in the URL - IDNA will resolve that as the same machine in
all cases.

> Plus it is not uncommon in some asian company/logo's to see essentially
> two or even three "scripts" combined.

Yes, that's why the language pack needs to define what characters are
acceptable. For example, in the .de zone, you simply cannot register
labels with Cyrillic or Japanese characters - DENIC just won't register
them, by policy. An adequate policy should be in place for .COM as
well. Indeed, the SRS (shared registry system) requires that each
registrar provides a language tag for each IDN label. I'm curious why
this failed for the paypal case.

Regards,
Martin