Re: [idn] homograph attacks

["Martin v. Löwis" <martin@v.loewis.de>]

Erik van der Poel wrote:
> It seems to me that a registry should not allow the registration of an 
> IDN domain name under a particular language if that registry does not 
> have a table for that language.

I strongly agree. It is fine that Verisign was employing a IDN testbed,
and people have learned a lot of technology from that. But now, in the
operational phase, registrars need to be really careful, and err on the
side of restrictiveness as opposed to openess. If people find the rules
too restrictive, there is always the possibility to weaken the rules.

> After that, they could continue to gather or compile tables.

Precisely so. IDN is driven by market needs. So if there is a strong
need for registering, say, Tajik labels in .com, Tajik users will work
with national bodies to establish a language filter for Tajik that
gTLD registrars can use.

At the moment, it looks like the missing tables can be used for phishing
*only* - something I doubt is in the commercial interest of a gTLD
registrar.

Regards,
Martin