Re: [idn] upstream and downstream

["Martin v. Löwis" <martin@v.loewis.de>]

Adam M. Costello wrote:
> > For example, someone could register a name that looks like
> > "foo.bar.com", where the first dot was really U+0702.  This attack
> > would be equally effective no matter what larger structure (URI, email
> > address, etc) the domain name appeared in.

I may be missing something, but I think this cannot be registered:

>>> u"foo\u0702bar.com".encode("idna")
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
  File "/usr/local/lib/python2.5/encodings/idna.py", line 160, in encode
    result.append(ToASCII(label))
  File "/usr/local/lib/python2.5/encodings/idna.py", line 75, in ToASCII
    label = nameprep(label)
  File "/usr/local/lib/python2.5/encodings/idna.py", line 50, in nameprep
    raise UnicodeError, "Violation of BIDI requirement 2"
UnicodeError: Violation of BIDI requirement 2

So unless my IDNA implementation is incorrect, this label is banned.
Clients should reject it, but if they fail to, atleast the registry
should reject registration.

> On second thought, the "." homograph attack is less severe than the "/"
> homograph attack.  The former only allows the attacker to spoof names
> in the same domain that the attacker is registered in;

I can't follow this reasoning, either: *if* foo.bar.com was possible,
then I choose foo=www, bar=microsoft, and put an A record for the
resulting label into DNS. The label would *not* be in the domain
microsoft.com.

Regards,
Martin