Re: upstream and downstream

Adam M. Costello wrote:
> Display time is independent of lookup time.

Good point. I did consider that, but I deliberately left it out of my 
"big picture". Perhaps I should have included it...

> Also, names that get transported
> in ACE form and converted back to Unicode for display would probably
> take on a ransom-note appearance when single-script strings get
> nameprepped into mixed-script strings.

Over the years, the fonts seem to have grown, to include more and more 
of Unicode. A long time ago, in X Windows, it would definitely have 
looked like a ransom note. But these days, in Windows and even X Windows 
with larger fonts, it looks a lot better. So good, in fact, that it's 
hard to tell the difference between the homographs. (I was the chief 
architect of the multilingual font engines for the Windows and Unix 
versions of Mozilla. This is one area I'm really familiar with.)

Re: nameprep spec change:
>>I don't really know whether this kind of change is realistic.
> 
> I think not.

Would you care to elaborate?

> You might as well ask why they should see domain names at all.
> Maybe there's a way to abstract domain names out of the users' view
> altogether, but until then, if users are going to see domain names, they
> want to be able to tell whether the name they see is the name they think
> they see.

But then don't you think it's at least a little unfortunate that (a) 
Unicode chose to include duplicates and/or (b) nameprep chose to use 
Unicode? Previously, users only had to squint at ASCII 1 vs l. Now, with 
IDN, it has been taken to a whole different level. They have to endure 
colored letters that look identical but have been colored to indicate 
that their character codes are different. Most users don't even 
understand what character codes are. So I still feel that it's 
unfortunate that we now end up having to confuse users.

Of course, it's not clear that there will be very many of these phishing 
attempts, in which case the user will almost never see these colors. We 
may be blowing this issue out of proportion. Real phishers may find 
other, more devious ways to fool the user.

>>Can't we solve the problem upstream?
> 
> We don't know how many misleading names have already been registered
> under .com and .net, so I don't see how we can completely solve the
> problem upstream.

Actually, I've been thinking that one could write a program that 
determines which pairs of Unicode characters have been assigned the same 
glyph index in TrueType fonts on Windows. A registry could then check 
all the IDNs in their set to see which ones contain only ASCII 
homographs and ASCIIs. If there are only a few misleading names, they 
might be able to delete them by contacting their owners, etc. If there 
are many, well, I don't know.

But one thing these registries could do now or quite soon is to install 
some heuristic filters to try to stem the influx of bogosities. One can 
only hope...

Erik