Mozilla Foundation Response to IDN Homograph Spoofing Attack
Mozilla Foundation: "...the problem is mostly the fault of domain name registries and registrars that let people register homographic variants of existing domain names."
Yup. Sounds almost right.
More specifically, this is what you get when test-beds and immature specs are run against production systems. IDN isn't baked yet - not from a policy perspective. Any registry running these things in production systems isn't doing anyone any favors.
Yes, I know Tucows has been selling IDNs since the initial NSI test-bed was announced. It was a bad idea then and I'd be much happier now if we hadn't jumped in as quickly as we did. With that being said, we've got a huge install base to support, so its not like we can simply turn off these domains...that would turn off the internet for a lot of people. Also, we've got a pretty good track record of being very conservative when it comes to implementations like this. I'll have to check with James to specifically find out whether or not we fall on the side of the street that's doing favors for Mozilla or not... :)
See this post as it first appeared on Blogware.
1 comment
Comments are closed - these are kept exactly as they were left.
thxrehab, May 16, 2007
The Mozilla team said that domain registrars are ignoring ICANN guidelines on IDN, and have developed a list of problematic Unicode characters that could be banned in domain names to limit homographic attacks.