On Sat, 11 Feb 2012 09:09:25 PST, Randy Bush said: > >>>> My $0.02 on this issue is if the message is rich text I hover over the > >>>> link > >>>> and see where it actually sends me. > >>> idn has made this unsafe > > Techniques to deal with this sort of spoofing already exist: see > > http://www.mozilla.org/projects/security/tld-idn-policy-list.html > > for one quite effective approach.
Nice. Basically, unless the TLD registrar has a public policy that basically says "We don't allow names with cyrillic C to collide with MICROSOFT", their hostnames all get displayed as xn--gobbledygook. (The actual policy for the .UA registrar is more subtle. They *do* in fact allow "U+0441 Cyrillic Small Letter ES" which is visually a C to us Latin-glyph users. However, they require at least one character that's visually unique to Cyrillic in the domain name. They also don't allow mixed Cyrillic/Latin scripts in one domain name). Or so http://www.hostmaster.ua/idn/ tells me after Google Translate gets done with it. ;) > and grandma is gonna use this? with internet exploder or safari? If the manufacturers of IE and Safari can't come up with a similar policy, then the people at Mozilla can use "We protect you from malicious names" as a marketing diffferentiation feature.
pgp2ZWlIcg6HH.pgp
Description: PGP signature
