Re: [idn] homograph attacks

[Erik van der Poel <erik@vanderpoel.org>]

Martin v. Löwis wrote:
> Erik van der Poel wrote:
> > StringPrep and NamePrep are great, but I wonder if it might be good to 
> > take their ideas one step further to solve the IDN spoofing problem. 
> > I.e. to "normalize" the homographs by mapping the similar-looking 
> > characters to "base" characters.
>
> Only by means of blocking registration. A registration can be blocked
> not only because it violates static rules, but also because it is
> (or could be) a homograph for a different, already registered, label.

I think it would be good to consider mapping homographs in the 
application too. For example, what if a user finds a domain name (or 
URI) in a magazine and then wants to type that into a Web browser's URI 
field? The most natural keyboard input language to choose is the user's 
(main) language. If one of the characters in the domain name is a 
homograph, then the user might type the "wrong" character, i.e. the 
wrong character code. She might type Cyrillic small 'a' instead of Latin 
small 'a'.

Wouldn't it then be the responsibility of the browser to map the "wrong" 
character code to the right one before sending it to a DNS server? 
Otherwise, DNS would not be able to find the right domain name.

Erik