Message-Id: <6.1.2.0.2.20050209035227.031dfeb0@mail.jefsey.com>
Date: Wed, 09 Feb 2005 04:00:31 +0100
To: "Mark Davis" <mark.davis@jtcsv.com>
From: "JFC (Jefsey) Morfin" <jefsey@jefsey.com>
In-Reply-To: <003a01c50e50$40e68970$6801a8c0@sanjose.ibm.com>
References: <6.1.2.0.2.20050208125802.03622030@pop.online.fr>
	<4208D8EC.6020709@seng.sg>
	<003a01c50e50$40e68970$6801a8c0@sanjose.ibm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"; format=flowed
Content-Transfer-Encoding: quoted-printable
Cc: ietf@ietf.org
Subject: Re: IDN security violation? Please comment
Precedence: list
Sender: ietf-bounces@ietf.org
Errors-To: ietf-bounces@ietf.org

On 03:36 09/02/2005, Mark Davis said:
>I want to also bring the UTR #36 Security Considerations for the
>Implementation of Unicode and Related Technology. Although still draft, =
we
>will be fleshing it out over time. Feedback is welcome.
>http://www.unicode.org/reports/tr36/

Brillant.

I think the danger is in the faked IRI usage. And the first way to protec=
t=20
the IRI is to alert on non permitted codes being used in the IDN part (th=
is=20
is where the spoofing is carried). I do not buy Jon's argument that=20
filtering IRI against ccTLD Tables would be too much expensive: yes for=20
each application, but this is precisely a job for OPES.

Question: what would be the load of a file giving for each code its=20
availability in each ccTLD table for each script? And how does that compa=
re=20
with the 1.5 Meg base of my anti-virus?
jfc


>=E2=80=8EMark
>
>----- Original Message -----
>From: "James Seng" <james@seng.sg>
>To: "JFC (Jefsey) Morfin" <jefsey@jefsey.com>
>Cc: <paf@cisco.com>; <ietf@ietf.org>; <Marc.Blanchet@viagenie.qc.ca>;
><phoffman@imc.org>; <amc@nicemice.net>
>Sent: Tuesday, February 08, 2005 07:21
>Subject: Re: IDN security violation? Please comment
>
>
> > For the 5th time today, it is already documented in RFC 3490.
> >
> > http://james.seng.cc/archives/2005/02/08/idn_and_homographs_spoofing.=
html
> >
> > JFC (Jefsey) Morfin wrote:
> > > May be IDN specialists will want to comment this.
> > > http://www.shmoo.com/idn/homograph.txt
> > > Is this exact? This is urgent as the IRI is based upon IDN and supp=
ort
> > > of multilingualism is a WSIS priority and comments for the WGIG are=
 to
> > > close the day after tomorrow.
> > > Thank you.
> > > jfc
> >
> > _______________________________________________
> > Ietf mailing list
> > Ietf@ietf.org
> > https://www1.ietf.org/mailman/listinfo/ietf
> >


_______________________________________________
Ietf mailing list
Ietf@ietf.org
https://www1.ietf.org/mailman/listinfo/ietf