Re: [idn] IDNs in email message bodies

[John C Klensin <klensin@jck.com>]

--On Monday, 26 March, 2001 12:34 +0800 William Tan
<william.tan@i-dns.net> wrote:

> I agree that everything in the message body (after the
> headers) should not be touched.
> I envisage the following sending process:
> 
> 1. User compose a message to an IDN email address.
> 2. MUA converts the IDN email address to ACE
> 3. MUA uses the ACE for RFC821 MAIL and RCPT commands
> 4. MUA uses the ACE in RFC822 From: and To: headers (as
> recommended in idn-mua I-D)
> 5. MUA leaves the message body untouched.

Be careful here; this gets really hard (independent of the
"other header and imbedded information" problem that Eric points
out).  Suppose you send me a message, following the above rules.
So far, so good.  But I now want to send some third party who
uses English, a note that summarizes your note and suggests that
he contact you for further information (variations on this are
_very_ common).  So I copy and paste your address from the RFC
822 From: field, in ACE form, into the message body I'm about to
send, with 
   Content-type: text/plain; charset=us-ascii

My recipient now has your address in ACE form in a message body.
If she replies directly to you, and pastes that address back
into the headers of the outgoing message, all is still well, as
long as her MUA is smart enough to not try to apply your "step
1" conversion to something that is already in ACE form.   But
suppose that, instead, she translates my message into Arabic or
Chinese and then sends it, especially if she does so using a
non-Unicode charset (permissible, and, indeed, common in message
bodies) or, worse, has that translation performed by an
automatic translator that has not been "taught" to detect ACE
strings in running text (note that, in the general case, they
cannot be detected and discriminated from discussions of ACE
with perfect accuracy).  

Care to guess the odds on your address surviving?  

Also note that these sorts of scenarios implies that ACE strings
are going to be in the faces of users quite a lot, rather than,
as has been argued, only when the use is operating with an
old-style MUA.

    john