Re: [idn] Chinese Domain Name Consortium (CDNC)Declaration

[John C Klensin <klensin@jck.com>]

Dave,

I agree that there is no new risk here.  The question is whether
or not it is desirable to expand that risk, perhaps into
populations that are less sensitive to it because they would,
naturally, be more trusting of texts that appear to be written
in their own languages (after not having seen those before).
And the answer to that question, I believe, must involve
weighing the tradeoffs between the value of the expanded name
space and the costs of the expanded risk.  Believing that
question/ tradeoff is easy or obvious, is, I believe, naive,
regardless of the conclusion on reaches about the question
itself.

And I would hope that relevant documents coming out of the WG
would explicitly alert people to these risks.

    john


--On Monday, 04 February, 2002 07:40 -0800 Dave Crocker
<dhc@dcrocker.net> wrote:

> Steve,
> 
> At 09:35 PM 2/3/2002 -0500, Steven M. Bellovin wrote:
>> There'a a good discussion of the security risks of the code
>> point problem at
>> http://www.csl.sri.com/users/neumann/insiderisks.html#140
> 
> homographic attacks are not new with the IDN effort.
> 
> for example, MICROS0FT.COM was done.
> 
> For that matter, choice of different top-level domains permits
> a degree of homographic attack.  Try looking at dnso.com,
> rather than dnso.org.  (No, this approach does not qualify
> precisely as homographic, but it takes advantage of a small
> difference from the real name, hoping that users will not
> notice.  And it does work.)
> 
> Hence, the IDN work does not introduce a new risk.
> 
> d/