Re: IDN spoofing

Hans Aberg <haberg at math dot su dot se> wrote:

> The suggestion I made, was to use a function to detect confusables by
> declaring them equivalent, but retaining the full Unicode character
> set for representing the IDN's. If this is used at the registration
> level only, the only thing that happens when somebody enters a
> confusable, is that it is rejected. There is a problem only when an
> authority admits parallel, confusable names to be registered.

Granted.  The problem, as I have said so often, is determining what the
set of "confusables" is.  Don't just say a/а and o/ο, either; that's
only the tip of the iceberg.

-Doug Ewell
 Fullerton, California
 http://users.adelphia.net/~dewell/