Subject: [idn] a way toward homograph resolution ? (was "improving WG operation")

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Wed, 11 May 2005 06:08:18 +0200

On 04:43 11/05/2005, Randy Presuhn said:
>From: "JFC (Jefsey) Morfin" <[email-masked]>
> > To: "Hallam-Baker, Phillip" <[email-masked]>
> > Cc: <[email-masked]>
> > Sent: Tuesday, May 10, 2005 5:29 PM
> > Subject: RE: improving WG operation
>...
> > They do not not only delete. I suggest you just come to the WG-ltru where
> > they have decided to document RFC 2277 charsets into RFC 3066 langtags. So
> > you can enjoy charset conflicts, something you never though about, I
> > presume. You cannot stop progress.
>...
>
>I guess Jefsey is upset because the WG rejected his proposal
>to expand our scope to include charsets.  The ltru WG is most
>emphatically *not* confusing charsets with language tags.

I am not upset :-). To the countrary I find extremely interesting that some 
people were able to rename charsets "scripts" in order to insert charsets 
into languages descriptions while claiming they dont (cf. above). Obviously 
they are unhappy when I expose the trick. Anyway the result is great fun: 
people will be prevented from accessing a page they know to read, if they 
do not know the language.

This cacologic however might be a good way to solve the IDN homograph issue 
and the phishing problem.

If we revert from those famous "scripts" to what they are, i.e. unicode 
partitions, hence stable and well documented charsets 
(http://www.unicode.org/Public/4.1.0/ucd/Scripts.txt) , using them browsers 
can expose the homographs not related to the page charset in IDNs, and kill 
the risks of phishing.

This only calls for the browsers to extract the charset, I mean the script 
name from the langtag, call this file, read the list of codes points in the 
charset/associated to the script, and display the URL accordingly, 
indicating the characters which are no part of the script/charset. This 
relieves the ccTLD/TLD Manager from responsibilities he cannot fulfil at 
3+level.

There are howver still (minor) points to address:
- there are some minor disparities between the "script" name in the 
langtag, and the script name in the script.txt file should be reduced over 
time. I suppose that if this is a major issue, there will be help.
- the script.txt file is currently supported on the Unicode site. Even in 
caching it (92 K) it will be called everytime people will start their 
browser. This may therefore represent several billions of access a day.
- the WG-ltru only realy wants to address XML issues, related to old XML 
libraries. Some coordination with other WGs or interests could be fruitful. 
They plan the language tags registry to extend to scripts and to register 
them. I suppose other WGs could benefit from this (all those involved in a 
way or another with internationalisation and languages).

jfc

---

From: "JFC (Jefsey) Morfin" <[email-masked]>
Date: Wed, 11 May 2005 16:21:01 +0200

On 15:29 11/05/2005, Hallam-Baker, Phillip said:
> > This cacologic however might be a good way to solve the IDN
> > homograph issue and the phishing problem.
>
>I have been spending most of my time on the phishing problem for three
>years. I have yet to see a phishing gang use the DNS IDN loophole for a
>phishing attack.

Dear Allan,
I am afraid you are right due to the low interest in the IDN solution 
(however punycode is of interest). Why not to document your experience to 
ccTLDs? We are very concerned about this because we can do nothing about it 
and people believe we can.

What what "techies" say is "don't worry" we know the problem for a long 
:-). True this is one of the reason why I objected to IDNA. But IDNA is 
still here? Help welcome!

>This is probably because the issue was an administrative one, the cert
>should never have issued and in the wake of the paper the CAs I have
>talked to have all corrected the issue.

CA?

>The lookalike DNS name problem was known before the design of SSL
>started, remember Micros0ft.com?
>
>Today the phishing gangs use bigbank-security.com or bigbank-corp.com or
>something similar. They are not going to use IDN DNS names until the
>application support is much much more comprehensive by which time the
>strategy will have changed.
>
>So in summary no, 'solving' the homolog issue is irrelevant to current
>phishing issues and by the time it is relevant I hope

:-) Hope? In security?
I am afraid we cannot take that risk.

>that we would no longer think it is a good idea to try to train users to 
>recognise DNS or X.500 names as security indicata. We need to make 
>security much more informative and usable if we want it to be used.

Agreed. But how?
Unless you forget about the DNS?
Do you have specific ideas?
jfc