<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Candara;
panose-1:2 14 5 2 3 3 3 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Dear IP,<span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm;margin-bottom:.0001pt">Please find enclosed the response of Latin GP to your letter
<span style="color:black">“Diacritics below a security risk?”.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Latin GP cannot give the direct answer to your letter in this turn. Latin GP will appreciate very much if you could help us to clarify the questions we are discussing in our document sent as attachment in this message.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We shall have face to face meeting in Brussels from October the 1<sup>st</sup> for three days. Your response to this document could help us to be more efficient and finalize our work.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:black;background:white"> It would also help us to provide a better response to your question about diacritics.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best regards<o:p></o:p></p>
<p class="MsoNormal">Mirjana Tasic<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Latin GP <latingp-bounces@icann.org> on behalf of Sarmad Hussain <sarmad.hussain@icann.org><br>
<b>Date: </b>Wednesday, August 29, 2018 at 08:58<br>
<b>To: </b>Latin GP <latingp@icann.org><br>
<b>Subject: </b>[Latingp] From IP: Diacritics below a security risk?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">Dear Latin GP members <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Kindly find below some feedback from IP for your consideration.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Regards <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Sarmad <o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><br>
TO: LatinGP<br>
FROM: IP<br>
<br>
There are recent and widely published examples of phishing attacks using Latin IDNs in which the key features involved were diacritics below the letter. Here is an example:<o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif"><img width="438" height="286" style="width:4.5625in;height:2.9791in" id="_x0000_i1028" src="cid:image001.png@01D4512C.E2702C00" alt="cid:part1.E6E9F88C.32B00687@ix.netcom.com"></span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">Of all diacritics, diacritics below can be difficult to distinguish or be prone to clipping -- there is less space below the baseline than between the typical lowercase glyph and the top of the line.</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">The example given above shows a further interaction with URL underlining - and not all display engines actually do as nice a job interrupting the underline as in the screen shot above. For example, here is how
one system will render this (using a designated UI font - Segoe UI):</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif"><img width="185" height="32" style="width:1.927in;height:.3333in" id="_x0000_i1027" src="cid:image002.png@01D4512C.E2702C00" alt="cid:part2.59964F92.16B1BC0B@ix.netcom.com"></span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">Note, this code point (U+1E33) is in the MSR as is (U+1E35 LATIN SMALL K WITH LINE BELOW).</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif"><img width="197" height="47" style="width:2.052in;height:.4895in" id="_x0000_i1026" src="cid:image003.png@01D4512C.E2702C00" alt="cid:part3.99B9649E.C3C335FC@ix.netcom.com"></span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">The second example contains U+1E35 -- while the effect does not show equally at all type sizes, from 12pt and below the LINE BELOW is reliably hidden. Here are the two examples at 10pt</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif"><img width="101" height="56" style="width:1.052in;height:.5833in" id="_x0000_i1025" src="cid:image004.png@01D4512C.E2702C00" alt="cid:part4.B43CE3FD.8C84EACF@ix.netcom.com"></span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">The issue is not limited to "K". We see "B", "D", "L" and "N" with both DOT and LINE BELOW and "M" and "H" with DOT BELOW, all on the same page in the MSR.</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">It can be argued users have no working understanding of typography and would not reliably interpret small gaps or bulges in the underline as being related to an unfamiliar code point. This appears to make all
diacritics below security-sensitive, however, the initial determination belongs to the relevant GPs.</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">Note by the way that the Devanagari LGR treats sequences containing NUKTA (a dot below) as variants in at least some cases and recent community comments for that script are calling for more variant sequences.
However, while the feature is graphically analog (dot below), each script works differently and there is no single a-priori solution.</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">The IP would like to encourage the LatinGP (and any other GP facing cases like this) to explicitly examine this example and other cases like it, where code points can become indistinguishable in common usage
scenarios for IDNs, and formally conclude whether and how to take these into account when designing their LGR.</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">At this point, the IP would expect the GP to:</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">* explicitly discuss this and other scenarios like it</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">* evaluate whether they constitute a security risk to the Root Zone</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">* come up with a reasoned decision as to whether and how to address them in the design of the Latin GP; and finally</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">* document both the decision and its rationale.</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">In coming to a decision, the GP may resolve:</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">1) to make them variants</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">2) to list them for attention as confusable</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">3) to take no action, because the GP feels that they do not represent a special security risk.</span><o:p></o:p></p>
<p><span style="font-family:"Candara",sans-serif">As part of the review of the Latin LGR, the IP will look at the background and rationale offered by the Latin GP in coming to its conclusion; note that if the IP feels that the facts considered and rationale
documented do not support the conclusion reached by the GP it may raise objections at that time.</span><o:p></o:p></p>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>