Domains Delayed

[Venolus]

Non-English domains are likely to be delayed as reported by forbes.com
http://www.forbes.com/business/energy/feeds/ap/2005/07/15/ap2141340.html
I definitely dont agree with the problems they raise.

 

[worldstar]

Non-English Domain Names Likely Delayed

07.15.2005, 01:34 PM

Concerns about "phishing" e-mail scams will likely delay the expansion of domain names beyond non-English characters, the chairman of the Internet's key oversight agency said Friday.

Vint Cerf, head of the Internet Corporation for Assigned Names and Numbers, would not speculate on when such characters might appear but said Internet engineers must now spend time "trying to winnow down, frankly, the number of character (sets) that are allowed to be registered."

Demand for non-English domain names is high outside the United States and a U.N. panel studying Internet governance said in a report Thursday that "insufficient progress has been made toward multilingualization." It cited the lack of international coordination and technical hurdles as among the problems.

Officially, the Internet's Domain Name System supports only 37 characters - the letters of the Latin alphabet, 10 numerals and a hyphen.

But in recent years, in response to a growing Internet population worldwide, engineers have been working on ways to trick the system into understanding other languages, such as Arabic, Chinese and Japanese.

Engineers have rallied around a character system called Unicode.

But security experts warned earlier this year of a potential exploit that takes advantage of the fact that characters that look alike can have two separate codes in Unicode and thus appear to the computer as different. For example, Unicode for "a" is 97 under the Latin alphabet, but 1072 in Cyrillic.

Subbing one for the other can allow a scammer to register a domain name that looks to the human as "paypal.com," tricking users into giving passwords and other sensitive information at what looks like a legitimate site. It's much like how scammers now use the numeral "1" sometimes instead of the letter "l" to trick users.

"In some of the early tests, ... it became clear we had opened up the opportunity for registering very misleading names," Cerf said in a conference call wrapping up ICANN's meetings this week in Luxembourg. "This kind of potential confusion leads to parties going to what they think are valid Web sites."

Cerf said it may be possible to proceed with character sets that aren't at risk of confusion as the standards-setting Internet Engineering Task Force tackles the broader security concerns with non-English names.

Tests of non-English characters have been going on for years, and in a few cases they are fully operational. Last year, operators of the German ".de" domain began offering 92 accented and other special characters, including the umlaut common in German names.

But ICANN has yet to approve domain names entirely in another language; all addresses now must end with an English string such as ".com."

 

[Venolus]

Thanks for quoting the entire message

 

[primacomputer]

Non-English domains are likely to be delayed as reported by forbes.com
http://www.forbes.com/business/energy/feeds/ap/2005/07/15/ap2141340.html
I definitely dont agree with the problems they raise.

What don't you agree with? The fact that letters in other character sets look like certain letters in the ASCII character set or the fact that scammers will use this to try to scam people?

 

[Venolus]

That the unicode format will be a problem to the idea as well as that scammers will use it like they have pointed in the case of paypal.com

 

[primacomputer]

Well unicode will result in similar looking characters with different codes. You can't really disagree with that. It's a fact and they gave an example of one such character in the article. As far as scammers using it, to think they wouldn't take advantage of this is just naive. To date they have used every URL spoofing method discovered. There have already been proof of concept examples of URL spoofing using IDNs and you can be sure that once they are supported and displayed properly in all browsers you will see them in the wild.

Personally I would prefer to see the naming system upgraded to support unicode instead of everything being tweaked to support punycode. Fact remains that no matter what system is used it is going to be exploited because there are characters that look similar to, or even the same as others in another language.

It doesn't even take a different language. Try some of these:
MICROS0FT.COM
M1CROSOFT.COM
vvellsfargo.com
32I.com

 

[Venolus]

Personally I would prefer to see the naming system upgraded to support unicode instead of everything being tweaked to support punycode. Fact remains that no matter what system is used it is going to be exploited because there are characters that look similar to, or even the same as others in another language.

I definitely agree

 

[abdulmueid]

what if someone registers namepros.com but using different character-set. There will be major confusions all over and not to mention the amount of monetary loss that will be involved...