Update to the mitigation tools for IDN security problems

re: Update to the mitigation tools for IDN security problems

Rosyna — Mon, 17 Jul 2006 04:47:44 GMT

I still think IE's handling of IDNs is flawed. For example, there's no way to go to http://sailor月.com/japan/Japan.html without getting some kind of error in IE. Even if Japanese is in the list of languages.

re: Update to the mitigation tools for IDN security problems

Dean Harding — Mon, 17 Jul 2006 09:15:42 GMT

I don't think it's flawed. Just because you can point out examples of URLs which fail the test, but are still "meaningful" doesn't make it a flawed algorithm. It's just a heuristic after all.

I mean, how do you draw the line between "sailor月.com" and "mybanksitе.com" (where the last "е" is a Cryllic letter), especially if Cryllic is in the list of languages, just like Japanese is in the list of languages for "sailor月.com"?

re: Update to the mitigation tools for IDN security problems

Rosyna — Mon, 17 Jul 2006 11:02:47 GMT

Quite easily actually. Some web browsers (like Safari) have a list of scripts in which there are not confusingly similar characters. I've heard some lame excuses claiming things like イ and i look alike, yet they look nothing alike. Especailly when windows renders the fonts completely differently (CJK fonts not being antialiased). Some scripts have no confusingly similar characters such as:

Arabic
Armenian
Bopomofo
Canadian_Aboriginal
Devanagari
Deseret
Gujarati
Gurmukhi
Hangul
Han
Hebrew
Hiragana
Katakana_Or_Hiragana
Katakana
Latin
Tamil
Thai
Yi

The IE7 method is flawed as it gives an error message with a solution that does not work.

re: Update to the mitigation tools for IDN security problems

Rosyna — Mon, 17 Jul 2006 11:06:26 GMT

I mean confusingly similar characters at different code points. Notice how Cyrillic is *not* on that list?

The download you requested is unavailable.

Sorting It All Out — Fri, 28 Jul 2006 14:23:29 GMT

Remember earlier this month when I was talking about the Update to the mitigation tools for IDN security...