Dear RIPE: Please don't encourage phishing

Valdis.Kletnieks at vt.edu Valdis.Kletnieks at vt.edu
Sat Feb 11 18:28:57 UTC 2012


On Sat, 11 Feb 2012 09:09:25 PST, Randy Bush said:
> >>>> My $0.02 on this issue is if the message is rich text I hover over the link
> >>>> and see where it actually sends me.
> >>> idn has made this unsafe
> > Techniques to deal with this sort of spoofing already exist: see
> > http://www.mozilla.org/projects/security/tld-idn-policy-list.html
> > for one quite effective approach.

Nice.  Basically, unless the TLD registrar has a public policy that basically says
"We don't allow names with cyrillic C to collide with MICROSOFT", their hostnames
all get displayed as xn--gobbledygook.

(The actual policy for the .UA registrar is more subtle. They *do* in fact
allow "U+0441 Cyrillic Small Letter ES" which is visually a C to us Latin-glyph
users.  However, they require at least one character that's visually unique to
Cyrillic in the domain name.  They also don't allow mixed Cyrillic/Latin
scripts in one domain name).  Or so http://www.hostmaster.ua/idn/
tells me after Google Translate gets done with it. ;)

> and grandma is gonna use this?  with internet exploder or safari?

If the manufacturers of IE and Safari can't come up with a similar policy,
then the people at Mozilla can use "We protect you from malicious names"
as a marketing diffferentiation feature.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 865 bytes
Desc: not available
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20120211/851e32f4/attachment.sig>


More information about the NANOG mailing list