<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hi Bill.
<div class="">My comments below.</div>
<div class=""><br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On 08.01.2020, at 01:22, Bill Jouris via CPWG <<a href="mailto:cpwg@icann.org" class="">cpwg@icann.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">
<div class="ydp74f63badyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">
<div class=""></div>
<div dir="ltr" data-setdir="false" class="">Hi Roberto, </div>
<div dir="ltr" data-setdir="false" class=""><br class="">
</div>
<div dir="ltr" data-setdir="false" class="">I don't know specifically what tables of potential problems you are referring to.</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Ooopss - reading again your previous message I realise that when you spoke about 6 months from publication of the tables you meant that it will be 6 months in the future, not 6 months ago.</div>
<div>I stand corrected.</div>
<div><br class="">
</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">
<div class="ydp74f63badyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">
<div dir="ltr" data-setdir="false" class=""> But since I'm on the Latin Generation Panel (that is, the part of IDN working on the Latin alphabet based scripts) I do know that we haven't published our lists/tables yet. </div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Indeed, see above.</div>
<div>I know you are active in this field, if I remember correctly we had a couple of exchanges on the UA mailing lists.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">
<div class="ydp74f63badyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">
<div dir="ltr" data-setdir="false" class=""><br class="">
</div>
<div dir="ltr" data-setdir="false" class="">As for why these particular issues are getting raised, I would not that for the most part scripts are used by one, or at most a half dozen, different languages. The Latin script is used by over 2
<i class="">hundred</i>. Because on the way it evolved, what that script has is 26 letters modified by a couple dozen diacritics. Some of which are essentially indistinguishable. By the time the various combinations are gathered, we are over 200 symbols. </div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>I know that, but thanks for pointing it out.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">
<div class="ydp74f63badyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">
<div dir="ltr" data-setdir="false" class=""><br class="">
</div>
<div dir="ltr" data-setdir="false" class="">Any given language (and it's users) maybe involved a half dozen of those diacritics. Users have trouble identifying the others simply because they have never encountered them and don't realize that there might be
something to look for. You may be familiar with the cedilla under the letter C used in French. But would it even occur to you to look for one under a letter M? You may be familiar with the acute accent used over some vowels. But if the dot over a letter
I was replaced by one, would you realize it meant you had a different character? </div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>OK, so now I am getting a better picture. I was speaking of confusing similarity of diacritics (or chars in different scripts) with plain ASCII chars. You are raising the issue of confusing similarity between diacritics.</div>
<div>You get another point here, because in this case solutions like the simple display of the punycode together with the visual rendering would not solve the problem (I assume that users would not distinguish between two different punycode strings).</div>
<div><br class="">
</div>
<blockquote type="cite" class="">
<div class="">
<div class="">
<div class="ydp74f63badyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">
<div dir="ltr" data-setdir="false" class=""><br class="">
</div>
<div dir="ltr" data-setdir="false" class="">To date, we have seen criminal activity involving a relatively small number of symbols. (I believe there was mention in Montreal of a scam involving replacing the J in EasyJet's name with an I.) But criminals have
the same challenges other users have: they just aren't aware (yet!) of all the possibilities that await. So it may not be unreasonable to foresee a surge in problems when ICANN's handy list of variants and confusables (focused on TLDs, but work anywhere in
the name) is published. , </div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Here I start keeping my points, so we still disagree.</div>
<div>IMHO, criminals do this as their job, so they get aware much in advance of the potential pitfalls. Although I might agree that in time more criminals could get involved in exploiting these kinds of opportunities, I would be seriously surprised in learning
that many of these individuals and organizations are not already acting as “early adopters”.</div>
<div>In short, were I Citi Bank - or a similar organization potentially under attack - I would have started already taking countermeasures - including defensive registrations - if that was our defensive strategy. My personal opinion is that we have sufficient
evidence that this is not happening - at least not on a large scale. I can, however, concede that the situation might evolve and getting worse in the future - but this not really to the extent that we can use the defensive registrations as an argument against
raising prices.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">
<div class="ydp74f63badyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">
<div dir="ltr" data-setdir="false" class=""> </div>
<div dir="ltr" data-setdir="false" class="">I suppose we could reduce the problem by forcing users to use the actual IP address, rather than domain names. If nothing else, people would have to pay more attention in order to make sure that they hadn't accidentally
gotten the wrong address. Of course, that loses the ease of use that domain names provide....</div>
<div dir="ltr" data-setdir="false" class=""><br class="">
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>I assume you are using this as a straw man - if not as a joke altogether. We obviously need to figure out a solution - or at least a mitigation of the impact.</div>
<div><br class="">
</div>
<div>What prompted me to react to this thread was the temptation to see the introduction of IDNs as evil because its could encourage criminal activities. My personal opinion is that, if we take a global view, the benefits of IDNs for users whose native languages
do not use latin script overcome by far the potential problems it raises. Secondly, that a solution to the problem of fake web sites pretending to be something else should be found acting on the browsers and not on the DNS.</div>
<div><br class="">
</div>
<div>Happy to continue the discussion - but can also do that offline or in other contexts should this be of no interest to this group.</div>
<div><br class="">
</div>
<div>Cheers,</div>
<div>Roberto</div>
<div><br class="">
</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="">
<div class="ydp74f63badyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">
<div dir="ltr" data-setdir="false" class="">Bill</div>
<div class=""><br class="">
</div>
</div>
<div id="yahoo_quoted_8713191854" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;" class="">
<div class="">On Tuesday, January 7, 2020, 04:07:43 PM PST, Roberto Gaetano <<a href="mailto:roberto_gaetano@hotmail.com" class="">roberto_gaetano@hotmail.com</a>> wrote:
</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
</div>
<div class="">
<div id="yiv4449767514" class="">
<div class="">
<div class="yiv4449767514" style="word-wrap:break-word;">Hi Bill.</div>
<div class="yiv4449767514" style="word-wrap:break-word;">Thanks for answering my question.<br clear="none" class="yiv4449767514">
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514">The reason why I was asking for data is that I am very suspicious about analyses based only on suppositions, in particular when suppositions are addressed in one direction only.</div>
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514">Since we are in the domain (pun not intended) of hypotheses, I will propose mine - supported, when possible, by observation - going in a different direction.</div>
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514">IDNs are being deployed for years now. Had reputable organizations felt the risk of registrations of IDNs that are confusingly similar (personally I find the qualification of “indistinguishable” factually incorrect) as a serious risk,
we would have witnessed a spike in defensive registrations. To me, the fact that it did not happen is, if not a proof, at least an indication that the vast majority of these organizations do not see this as a serious threat.</div>
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514">As you say, ICANN has produced a few months ago tables of the potential threats. My observation is that crime normally acts fast - generally before the potential pitfall is brought to the general public. Why would this case be different?</div>
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514">My observation is that a cure that limits the effects of a problem without addressing the root cause is seldom effective. In this case the root cause is, IMHO, that the “real” url is not the displayed one, therefore potentially inducing
the user in error. Maybe to solve this problem is not trivial, but it seems to me that addressing the behaviour of the browsers will produce far better results in the long term than creating blacklists, regulating the domain name market, forcing defensive
registrations, or whatever else. Unless, of course, the objective is not solving the problem but influencing the domain name market.</div>
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514">I would like to conclude with a provocative question. How come that the potential problems supposedly originated by the introduction and deployment of IDNs are raised only by people and interest groups that are operating in a plain
ASCII environment - and more often than not of English mother tongue?</div>
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514">Cheers,</div>
<div class="yiv4449767514">Roberto</div>
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
<div class=""><br clear="none" class="yiv4449767514">
<blockquote class="yiv4449767514" type="cite">
<div class="yiv4449767514yqt7281697343" id="yiv4449767514yqtfd76939">
<div class="yiv4449767514">On 07.01.2020, at 18:45, Bill Jouris via CPWG <<a rel="nofollow" shape="rect" class="yiv4449767514" ymailto="mailto:cpwg@icann.org" target="_blank" href="mailto:cpwg@icann.org">cpwg@icann.org</a>> wrote:</div>
<br clear="none" class="yiv4449767514Apple-interchange-newline">
<div class="yiv4449767514">Hi Roberto,
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578418733518">
<br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578418733749">
I don't work for Citi Bank, and am not aware of knowing anyone who does. So I have no idea. </div>
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578418794157">
<br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578418794348">
I would note that, at this moment, we are probably 6 months from ICANN publishing the IDN effort's tables of all the variations on the Latin alphabet. Having that readily available will make coming up with indistinguishable domain names much easier for bad
actors. And thus the need for defensive registrations. </div>
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578418998369">
<br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578418998557">
In short, the problem wrt the need for defensive registrations is still at the readily foreseeable stage, rather than the already exploding in our face stage. </div>
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578418805613">
<br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578419092575">
Bill<br clear="none" class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578418714462">
<br clear="none" class="yiv4449767514">
<div class="yiv4449767514" id="yiv4449767514ymail_android_signature"><a rel="nofollow" shape="rect" class="yiv4449767514" id="yiv4449767514ymail_android_signature_link" target="_blank" href="https://go.onelink.me/107872968?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature">Sent
from Yahoo Mail on Android</a></div>
<br clear="none" class="yiv4449767514">
<blockquote class="yiv4449767514" style="margin:0 0 20px 0;">
<div class="yiv4449767514" style="font-family:Roboto, sans-serif;color:#6D00F6;">
<div class="yiv4449767514">On Tue, Jan 7, 2020 at 2:16 AM, Roberto Gaetano</div>
<div class="yiv4449767514"><<a rel="nofollow" shape="rect" class="yiv4449767514" ymailto="mailto:roberto_gaetano@hotmail.com" target="_blank" href="mailto:roberto_gaetano@hotmail.com">roberto_gaetano@hotmail.com</a>> wrote:</div>
</div>
<div class="yiv4449767514" style="padding:10px 0 0 20px;margin:10px 0 0 0;border-left:1px solid #6D00F6;">
<div class="yiv4449767514" id="yiv4449767514">
<div class="yiv4449767514">Hi Bill.
<div class="yiv4449767514">Just a couple of questions wrt:<br clear="none" class="yiv4449767514">
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
<blockquote class="yiv4449767514" type="cite">
<div class="yiv4449767514">
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578328607437" style="font-family:Helvetica;font-size:14px;font-style:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;">
<br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578328607640" style="font-family:Helvetica;font-size:14px;font-style:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;">
The only obvious defense, for registrants who want their customers to arrive reliably at their website, will be defensive registrations. Lots of defensive registrations. (I did a quick calculation for Citi Bank. 4 letter domain name. Close to 300 readily
confusable variations. Longer names would have more, of course.)</div>
<div class="yiv4449767514" id="yiv4449767514yMail_cursorElementTracker_1578328394126" style="font-family:Helvetica;font-size:14px;font-style:normal;font-weight:normal;letter-spacing:normal;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;">
<br clear="none" class="yiv4449767514">
</div>
</div>
</blockquote>
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514">How many actual defensive registrations has Citi Bank?</div>
<div class="yiv4449767514yQTDBase yiv4449767514yqt6734340698" id="yiv4449767514yqtfd69431">
<div class="yiv4449767514"><br clear="none" class="yiv4449767514">
</div>
<div class="yiv4449767514">Thanks,</div>
</div>
<div class="yiv4449767514">R.</div>
<div class="yiv4449767514yQTDBase yiv4449767514yqt6734340698" id="yiv4449767514yqtfd32682">
</div>
</div>
<div class="yiv4449767514yQTDBase yiv4449767514yqt6734340698" id="yiv4449767514yqtfd67916">
<br clear="none" class="yiv4449767514">
</div>
</div>
<div class="yiv4449767514yQTDBase yiv4449767514yqt6734340698" id="yiv4449767514yqtfd09347">
</div>
</div>
</div>
</div>
</blockquote>
</div>
_______________________________________________<br clear="none" class="yiv4449767514">
CPWG mailing list<br clear="none" class="yiv4449767514">
<a rel="nofollow" shape="rect" class="yiv4449767514" ymailto="mailto:CPWG@icann.org" target="_blank" href="mailto:CPWG@icann.org">CPWG@icann.org</a><br clear="none" class="yiv4449767514">
<a href="https://mm.icann.org/mailman/listinfo/cpwg" class="">https://mm.icann.org/mailman/listinfo/cpwg</a><br clear="none" class="yiv4449767514">
<br clear="none" class="yiv4449767514">
_______________________________________________<br clear="none" class="yiv4449767514">
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy" class="">https://www.icann.org/privacy/policy</a>)
and the website Terms of Service (<a href="https://www.icann.org/privacy/tos" class="">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style
delivery or disabling delivery altogether (e.g., for a vacation), and so on.</div>
</div>
</blockquote>
<div class="yiv4449767514yqt7281697343" id="yiv4449767514yqtfd93797"></div>
</div>
<div class="yiv4449767514yqt7281697343" id="yiv4449767514yqtfd77329"><br clear="none" class="yiv4449767514">
</div>
</div>
<div class="yiv4449767514yqt7281697343" id="yiv4449767514yqtfd82408"></div>
</div>
<div class="yiv4449767514yqt7281697343" id="yiv4449767514yqtfd50200"></div>
</div>
</div>
</div>
</div>
</div>
</div>
_______________________________________________<br class="">
CPWG mailing list<br class="">
<a href="mailto:CPWG@icann.org" class="">CPWG@icann.org</a><br class="">
https://mm.icann.org/mailman/listinfo/cpwg<br class="">
<br class="">
_______________________________________________<br class="">
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (https://www.icann.org/privacy/policy) and the website Terms of Service (https://www.icann.org/privacy/tos).
You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>