Re: upstream and downstream

Adam M. Costello wrote:
>>For example, someone could register a name that looks like
>>"foo.bar.com", where the first dot was really U+0702.  This attack
>>would be equally effective no matter what larger structure (URI, email
>>address, etc) the domain name appeared in.

I may be missing something, but I think this cannot be registered:

 >>> u"foo\u0702bar.com".encode("idna")
Traceback (most recent call last):
   File "<stdin>", line 1, in ?
   File "/usr/local/lib/python2.5/encodings/idna.py", line 160, in encode
     result.append(ToASCII(label))
   File "/usr/local/lib/python2.5/encodings/idna.py", line 75, in ToASCII
     label = nameprep(label)
   File "/usr/local/lib/python2.5/encodings/idna.py", line 50, in nameprep
     raise UnicodeError, "Violation of BIDI requirement 2"
UnicodeError: Violation of BIDI requirement 2

So unless my IDNA implementation is incorrect, this label is banned.
Clients should reject it, but if they fail to, atleast the registry
should reject registration.

> On second thought, the "." homograph attack is less severe than the "/"
> homograph attack.  The former only allows the attacker to spoof names
> in the same domain that the attacker is registered in;

I can't follow this reasoning, either: *if* foo.bar.com was possible,
then I choose foo=www, bar=microsoft, and put an A record for the
resulting label into DNS. The label would *not* be in the domain
microsoft.com.

Regards,
Martin