[UA-EAI] JFYI: IDN homograph attack in roundcube

[Dmitry Belyavsky]

On Tue, Aug 20, 2019 at 3:22 PM Arnt Gulbrandsen <arnt at gulbrandsen.priv.no>
wrote:

>
> > Common sense suggests that
> > 1. We have to provide a human-readable representation to the user and
> > 2. make him know that the name is IDN in fact.
>
> 1, We do, and it doesn't require any occurence of xn-- anywhere in an
> email
> message.
>
> 2, Why, exactly? Looking for homographs doesn't help with impostors like
> samsung-support.com (relies on non-homographic similarity), swapping е
> and
> ё in the cases where humans are inconsistent, registering м     іст.ru
> <http://xn--q1ac2d.ru> to
> attack міст.ua <http://xn--l1akd2f.ua>, etc. There are decent ways to
> protect against the general
> threat, why bother with the special case?
>

Finally got it.
Many thanks!


-- 
SY, Dmitry Belyavsky
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mm.icann.org/mailman/private/ua-eai/attachments/20190820/beaf6c6f/attachment.html>