Re: [idn] Mac OS X Safari and IDN spoofing

[Erik van der Poel <erik@vanderpoel.org>]

Gervase Markham wrote:
> James Seng wrote:
> > choose the scripts you use most often that you like to display 
> > normally but otherwise, will display in punycode.
>
> What sort of effect do you think it will have on IDN acceptance and use 
> if companies using IDN domains know that their domain name will display 
> as gobbledygook in an unknown percentage of their customer's browsers?

Companies, organizations and individuals are permitted to register more 
than one domain name. Companies that operate all over the world may wish 
to register domain names using their local names. It remains to be seen 
whether we will ever reach the point where a large percentage of users 
can view domain names containing characters from their "own" character 
set, but some registrants may wish to register their names now anyway, 
just in case. (Anyone willing to guess what that percentage is at the 
moment?)

I just went to Coca-Cola's site and navigated to their Chinese site to 
try to find out how they "spell" their name in Chinese. I don't know if 
this email is going to work, but here it is: åååä

Then I used IBM's IDN demo to convert it to Punycode: xn--fjqs9k9ab. 
Then I tried the CN and COM domains, and found that the CN one was a 
totally unrelated site, probably a squatter. The COM site was another 
squatter, with "money & sex" in large letters, and "domain names ... for 
sale".

I also tried to find the Taiwanese version of Coca-Cola. Again, this may 
not work: åååæ

The Punycode for this is xn--6orxab817t. I tried this name in the TW 
domain and reached Taiwan's NIC, where the Coca-Cola company can now 
register their name for a reasonable price (hopefully). The COM domain 
had another squatter.

So, while we are talking about technical details, squatters are taking 
action...

Erik

PS If I got the Chinese name for Coca-Cola wrong, or the Punycode is 
incorrect, please let me know. This was just an experiment...