Re: Unicode and Security

From: Barry Caplan (bcaplan@i18n.com)
Date: Fri Feb 08 2002 - 12:52:27 EST


>At 15:53 -0500 2002-02-07, Elliotte Rusty Harold wrote:
>>For text files, probably not. But for the domain name system the world
>>very well might. Indeed, maybe it should unless this problem can be dealt
>>with. I suspect it can be dealt with by prohibiting script mixing in
>>domain names (e.g. each component of the name must be entirely Greek or
>>entirely Cyrillic or entirely Latin etc. Note:
>>something_Cyrillic.something_greek.com is OK.) Does anybody really need
>>mixed Latin and Greek domain names?

Not only that, why limit the alleged security risks to domain names? Why
not the part of an email address before the @? the allowed characters for
that are specified in a different RFC than that for domain names, and has
nothing to do at all with DNS.

And how many variations of numerals are there in Unicode? After all, every
place you could use a domain name, you could use the actual IP address too.
How many ways might that be spoofed?

Barry



This archive was generated by hypermail 2.1.2 : Fri Feb 08 2002 - 12:18:30 EST