IDN Security Issues and Mozilla

Gervase Markham

The Mozilla Foundation

Overview

• Recap problem
• Present solution
• Current Foundation policy
• ICANN Guidelines comments

The Problem: Phishing

• Big problem (follow the money)
• IDN spoofing potentially a new, bigger class of risk
• Key novelty: no visual difference

The Solution

Aim: no two confusable domains registered to different
entities

• Unicode: confusable characters table
• IETF: Standards changes as necessary
• ICANN: Guidelines which enforce standards and achieve aim
• Registries: implement guidelines
• Browsers: enable IDN for those registries implementing guidelines

Interim Mozilla Policy

• Use an inclusion-based approach
• Publish character tables
• Publish a homograph policy if tables have homographs

26 TLDs (including 3 gTLDs) signed up

ICANN Guidelines are a pretty good match

ICANN Guidelines

The risks:

1. Mixed-script spoofing (e.g. paypal.com with Cyrillic a)
2. Single-script spoofing (e.g. scope.ru)
3. Protocol character spoofing (e.g. FRACTION SLASH)

• Deals with 1 - bans mixed scripts
• Doesn't deal with 2 - but this problem is much smaller
• Deals with 3 - if you include homographs of protocol characters in point 4

ICANN Guidelines

Applause for:

• Taking the problem seriously
• Inclusion-based approach
• Near-elimination of punctuation

The End