IDN Forums - Internationalized Domain Names  
Home | Advertise on idnforums | Premium Membership

Go Back   IDN Forums - Internationalized Domain Names > IDN Discussions > General Discussion

General Discussion Feel free to talk about anything and everything in this board.

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 5th March 2011, 12:33 AM
DktoInc's Avatar
Senior Member
 
Join Date: Dec 2009
Location: Land of the Loon
Posts: 1,583
iTrader: (2)
Rep Power: 2171
DktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura about
Why you should avoid Internationalized Domain Names

http://www.zigpress.com/2011/03/02/w...uld-avoid-idn/




gets my vote for the funniest blog of 2011.

my-secure-bаnk-website.com lol.

Total of votes so far this year:
1) a vote for Tina (person of the year award 2011)
2) a vote for (Funniest) blog award 2011

Last edited by DktoInc; 5th March 2011 at 12:49 AM..
Reply With Quote
  #2 (permalink)  
Old 5th March 2011, 01:12 AM
Member
 
Join Date: Jul 2009
Location: The Golden West
Posts: 921
iTrader: (0)
Rep Power: 3243
Avtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the rough
Re: Why you should avoid Internationalized Domain Names

Actually, the article, though wrong-headed, points to a problem.

The author discusses the dreaded "IDN homograph attack" (putting a cyrillic 'а' in bаnk.com, for instance), and refers to the Wikipedia article on the subject: http://en.wikipedia.org/wiki/IDN_homograph_attack.

I read the Wikipedia article, and was surprised to discover that nowhere in the article is there any mention of the fact that major registries (.com and .net for example) forbid mixing alphabets, and have done so for years. If you read the article, you would think that the only defense against homograph attacks is at the browser level.

From the Wikipedia article:

Quote:
With the advent of internationalized country codes spoofing will be minimized. For example, the Russian TLD .рф only accepts Cyrillic names, forbidding the mix with Latin characters. However the problem in .com and other gTLDs remains open.
So the blog post is wrong about IDN homograph attacks, but only because Wikipedia is also wrong.

Avtal
Reply With Quote
  #3 (permalink)  
Old 5th March 2011, 01:22 AM
Ryu's Avatar
Ryu Ryu is offline
Moderator
 
Join Date: Nov 2007
Posts: 1,158
iTrader: (14)
Rep Power: 979
Ryu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished road
Re: Why you should avoid Internationalized Domain Names

Quote:
Originally Posted by Avtal View Post
I read the Wikipedia article, and was surprised to discover that nowhere in the article is there any mention of the fact that major registries (.com and .net for example) forbid mixing alphabets, and have done so for years. If you read the article, you would think that the only defense against homograph attacks is at the browser level.

From the Wikipedia article:



So the blog post is wrong about IDN homograph attacks, but only because Wikipedia is also wrong.

Avtal
I believe Wikipedia is correct. At the moment, .com and .net allow mixing of different languages. That's why Firefox always displays punycode in its address bar for IDN.com and IDN.net.

Last edited by Ryu; 5th March 2011 at 01:23 AM..
Reply With Quote
  #4 (permalink)  
Old 5th March 2011, 01:25 AM
jose's Avatar
Veteran
 
Join Date: Jan 2006
Posts: 8,719
iTrader: (49)
Rep Power: 5417
jose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nice
Re: Why you should avoid Internationalized Domain Names

Wrong about PHP, WordPress and Facebook. (Or maybe not up-to-date, as it used to be true ~2007).

http://php.net/manual/en/ref.intl.idn.php
__________________
Looking for the perfect, still free .com domain name, for your next endeavor? Ask me. $5 only. Here's my most recent, 101th story of success: CarRealtime.com

Last edited by jose; 5th March 2011 at 01:27 AM..
Reply With Quote
  #5 (permalink)  
Old 5th March 2011, 01:36 AM
Ryu's Avatar
Ryu Ryu is offline
Moderator
 
Join Date: Nov 2007
Posts: 1,158
iTrader: (14)
Rep Power: 979
Ryu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished road
Re: Why you should avoid Internationalized Domain Names

Quote:
Originally Posted by jose View Post
Wrong about PHP, WordPress and Facebook. (Or maybe not up-to-date, as it used to be true ~2007).

http://php.net/manual/en/ref.intl.idn.php
I've never tested an IDN with Facebook. Does it actually work fine now? If you place an IDN link on FB, does it get automatically hyper-linked?
Reply With Quote
  #6 (permalink)  
Old 5th March 2011, 01:37 AM
Member
 
Join Date: Jul 2009
Location: The Golden West
Posts: 921
iTrader: (0)
Rep Power: 3243
Avtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the roughAvtal is a jewel in the rough
Re: Why you should avoid Internationalized Domain Names

Quote:
Originally Posted by Ryu View Post
I believe Wikipedia is correct. At the moment, .com and .net allow mixing of different languages. That's why Firefox always displays punycode in its address bar for IDN.com and IDN.net.
Here is what Verisign says, in http://verisigninc.com/en_US/product...ts/index.xhtml:

Quote:
As a rule, the .com, .net, .name, .tv, and .cc registries reject the commingling of code points from different Unicode scripts. That is, if an IDN contains code points from any two or more Unicode scripts, then that IDN registration is rejected. For example, a letter from the Latin alphabet cannot be used in the same IDN with any Cyrillic letter. All code points within an IDN must come from the same Unicode script. This is done to prevent confusable code points from appearing in the same IDN.
A later paragraph discusses exceptions; Korean and Latin scripts can be commingled, for instance.

My understanding is that Firefox's policy is due to the fact that Verisign has never formally explained their policy to the Mozilla organization. I'm not sure why.

Avtal
Reply With Quote
  #7 (permalink)  
Old 5th March 2011, 01:39 AM
jose's Avatar
Veteran
 
Join Date: Jan 2006
Posts: 8,719
iTrader: (49)
Rep Power: 5417
jose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nicejose is just really nice
Re: Why you should avoid Internationalized Domain Names

Quote:
Originally Posted by Ryu View Post
I've never tested an IDN with Facebook. Does it actually work fine now? If you place an IDN link on FB, does it get automatically hyper-linked?
It does.
__________________
Looking for the perfect, still free .com domain name, for your next endeavor? Ask me. $5 only. Here's my most recent, 101th story of success: CarRealtime.com
Reply With Quote
  #8 (permalink)  
Old 5th March 2011, 01:43 AM
Wot's Avatar
Wot Wot is offline
Senior Member
 
Join Date: May 2006
Posts: 3,588
iTrader: (30)
Rep Power: 1669
Wot will become famous soon enoughWot will become famous soon enoughWot will become famous soon enoughWot will become famous soon enoughWot will become famous soon enoughWot will become famous soon enoughWot will become famous soon enough
Re: Why you should avoid Internationalized Domain Names

Quote:
Originally Posted by Ryu View Post
I believe Wikipedia is correct. At the moment, .com and .net allow mixing of different languages. That's why Firefox always displays punycode in its address bar for IDN.com and IDN.net.

Lat year I tried to register cyrillic with "latin" e prefix character in .com but failed, I had been able to do it in Chinese.
__________________
红旗.com
Reply With Quote
  #9 (permalink)  
Old 5th March 2011, 02:24 AM
bumblebee man's Avatar
Senior Member
 
Join Date: Jan 2010
Location: Germany
Posts: 1,620
iTrader: (16)
Rep Power: 2876
bumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura aboutbumblebee man has a spectacular aura about
Re: Why you should avoid Internationalized Domain Names

Quote:
If I want to build a german online bookstore, I could register www.bücher.de – but I would stay with www.bucher.de.
FAIL.

The ascii equivalent for bücher.de is buecher.de. Good luck trying to register either one.
__________________
These are my principles. If you don't like them, I have others. - Groucho Marx

Last edited by bumblebee man; 5th March 2011 at 02:25 AM..
Reply With Quote
  #10 (permalink)  
Old 5th March 2011, 02:32 AM
Ryu's Avatar
Ryu Ryu is offline
Moderator
 
Join Date: Nov 2007
Posts: 1,158
iTrader: (14)
Rep Power: 979
Ryu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished roadRyu is on a distinguished road
Re: Why you should avoid Internationalized Domain Names

Quote:
Originally Posted by Avtal View Post
Here is what Verisign says, in http://verisigninc.com/en_US/product...ts/index.xhtml:

A later paragraph discusses exceptions; Korean and Latin scripts can be commingled, for instance.

My understanding is that Firefox's policy is due to the fact that Verisign has never formally explained their policy to the Mozilla organization. I'm not sure why.

Avtal
Thanks for the link, Avtal. This is news to me. I wonder how long Verisign has been implementing this. Firefox should definitely start accepting IDN.com and IDN.net in its address bar.

Quote:
Originally Posted by jose View Post
It does.
Thanks. Didn't know that at all.

Quote:
Originally Posted by Wot View Post
Lat year I tried to register cyrillic with "latin" e prefix character in .com but failed, I had been able to do it in Chinese.
So, you can't actually register my-secure-bаnk-website.com? Dynadot and Name.com show the names are available. That's misleading.

I wonder then what would happen to those funny mixed-language IDN.com people use to register.
Reply With Quote
  #11 (permalink)  
Old 5th March 2011, 04:15 AM
DktoInc's Avatar
Senior Member
 
Join Date: Dec 2009
Location: Land of the Loon
Posts: 1,583
iTrader: (2)
Rep Power: 2171
DktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura aboutDktoInc has a spectacular aura about
Re: Why you should avoid Internationalized Domain Names

my-secure-bаnk-website.com shows available on godaddy as well, but it doesn't allow to register itbecause of mixed script.
Reply With Quote
  #12 (permalink)  
Old 5th March 2011, 05:05 AM
Veteran
 
Join Date: Feb 2006
Posts: 7,495
iTrader: (65)
Rep Power: 2679
blastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enough
Re: Why you should avoid Internationalized Domain Names

Quote:
Originally Posted by Avtal View Post
My understanding is that Firefox's policy is due to the fact that Verisign has never formally explained their policy to the Mozilla organization. I'm not sure why.
Mozilla is a developer that needs to conform to a standard. Verisign is the registry. They set which standards .com will follow. Mozilla is the one who should be reading up about Verisign standards, not the other way around.
Reply With Quote
  #13 (permalink)  
Old 5th March 2011, 10:26 AM
Rubber Duck's Avatar
Veteran
 
Join Date: Sep 2005
Location: Czech Republic (For those of you from USA = Chechnya)
Posts: 15,929
iTrader: (59)
Rep Power: 4510
Rubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura aboutRubber Duck has a spectacular aura about
Re: Why you should avoid Internationalized Domain Names

Does it matter how confused the Americans are about this?

I don't suppose most potential users have or will give it a second thought.
__________________
All offers to sell are void.
Reply With Quote
  #14 (permalink)  
Old 5th March 2011, 10:33 AM
yanni's Avatar
Senior Member
 
Join Date: Feb 2006
Posts: 2,220
iTrader: (34)
Rep Power: 1152
yanni is on a distinguished roadyanni is on a distinguished roadyanni is on a distinguished roadyanni is on a distinguished roadyanni is on a distinguished roadyanni is on a distinguished road
Send a message via AIM to yanni Send a message via Skype™ to yanni
Re: Why you should avoid Internationalized Domain Names

It's not just the Americans who are confused about this, unfortunately.
Reply With Quote
  #15 (permalink)  
Old 9th March 2011, 10:20 PM
Kent99's Avatar
Premium User
 
Join Date: Nov 2009
Location: Calgary
Posts: 703
iTrader: (30)
Rep Power: 1522
Kent99 will become famous soon enoughKent99 will become famous soon enoughKent99 will become famous soon enoughKent99 will become famous soon enoughKent99 will become famous soon enoughKent99 will become famous soon enoughKent99 will become famous soon enoughKent99 will become famous soon enough
Re: Why you should avoid Internationalized Domain Names

Quote:
Originally Posted by blastfromthepast View Post
Mozilla is a developer that needs to conform to a standard. Verisign is the registry. They set which standards .com will follow. Mozilla is the one who should be reading up about Verisign standards, not the other way around.
Exactly correct, but the person answering this question on the Mozilla support forum doesn't seem to think so.

http://support.mozilla.com/ta-LK/questions/790574
Reply With Quote
  #16 (permalink)  
Old 9th March 2011, 10:56 PM
Veteran
 
Join Date: Feb 2006
Posts: 7,495
iTrader: (65)
Rep Power: 2679
blastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enoughblastfromthepast will become famous soon enough
Re: Why you should avoid Internationalized Domain Names

Quote:
Originally Posted by Kevin99 View Post
Exactly correct, but the person answering this question on the Mozilla support forum doesn't seem to think so.
The solution for them is simple: follow IDNA2008 only.
Reply With Quote
  #17 (permalink)  
Old 10th March 2011, 12:03 PM
domainguru's Avatar
Senior Member
 
Join Date: Mar 2006
Posts: 3,835
iTrader: (14)
Rep Power: 2517
domainguru has a spectacular aura aboutdomainguru has a spectacular aura aboutdomainguru has a spectacular aura aboutdomainguru has a spectacular aura aboutdomainguru has a spectacular aura aboutdomainguru has a spectacular aura aboutdomainguru has a spectacular aura aboutdomainguru has a spectacular aura aboutdomainguru has a spectacular aura about
Re: Why you should avoid Internationalized Domain Names

If anyone is posting there, might like to mention that most of the links to alleged security policies actually point to 404 pages e.g:

http://www.iana.org/assignments/idn/th-thai.html
http://www.iana.org/assignments/idn/jp-japanese.html

And other links simply go to registry home pages etc. The whole thing is a joke. Somebody might like to challenge Mozilla on where all these alleged security documents are....
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT. The time now is 08:05 AM.

Site Sponsors
Your ad here
buy t-shirt
מחיר הזהב

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.
Search Engine Friendly URLs by vBSEO 3.3.0
Copyright idnforums.com 2005

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54