Re: [idn] nameprep2 and the slash homograph issue

[Gervase Markham <gerv@mozilla.org>]

Erik van der Poel wrote:
> Perhaps I was wrong to use the word "tool". There is a fundamental 
> tension between security and user-friendliness. 

Well, maybe. I'm not convinced the tension is absolute, but I agree you 
need to work very hard indeed to get both.

> A couple of questions/comments: It might be nice to have this 
> domain-only display even for non-secure sites (http).

We are probably going to change this for 1.1. It takes some careful 
thought so as not to confuse people.

> Also, do you know 
> what happens if the domain name is very long? 

It just gets very long, currently.

> Finally, do you have any 
> thoughts about the slash homograph problem? Thanks.

Well, the current domain indicator will show the domain, slash 
homographs and all. We're still developing our response, but it's likely 
that we'll have to blacklist this character. Opera's new beta already 
has a small set of characters it doesn't allow.

Ideally, we wouldn't be acting unilaterally on this one, and would be 
doing the restrictions based on consensus. But before we can go there, 
we need to figure out what we think is needed first. That process is 
still going on.

> Indeed, why wait? I filed a bug a while ago:
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=282079

Thanks :-)

> My feeling is that a sans-serif font (such as Arial) places the 
> characters too close to each other and does not have the serifs that 
> often serve to distinguish the characters better. How about a fixed 
> width font with serifs, such as Courier New?

The issue, of course, is that the font designation we use has to produce 
a good font on all platforms. This isn't fundamentally impossible, it 
just requires work and testing.

Gerv