Re: homograph attacks

Erik van der Poel wrote:
> I think it would be good to consider mapping homographs in the 
> application too.

I strongly disagree. First of all, the algorithm used in IDN*A*
is already defined, changing it in any way or form will take decades,
and likely not happen in our lifetime.

 > For example, what if a user finds a domain name (or
> URI) in a magazine and then wants to type that into a Web browser's URI 
> field? The most natural keyboard input language to choose is the user's 
> (main) language.

Wrong. The most natural keyboard input in this case is the apparent
script of the label. The user should see the script from reading
it - in some cases, even just from hearing it spoken.

> If one of the characters in the domain name is a 
> homograph, then the user might type the "wrong" character, i.e. the 
> wrong character code. She might type Cyrillic small 'a' instead of Latin 
> small 'a'.

By the same reasoning, you might want to map "mikrosovt.com" to
"microsoft.com", because the sound of them is the same.

> Wouldn't it then be the responsibility of the browser to map the "wrong" 
> character code to the right one before sending it to a DNS server? 

Not it all. It is the responsibility of the "system" (including browser
and DNS server) to report an error that the domain cannot be found if
it is spelled incorrectly.

> Otherwise, DNS would not be able to find the right domain name.

And that would be a good thing.

Regards,
Martin