- comments-idn-guidelines-19oct17@icann.org

[Comments-idn-guidelines-19oct17] Fwd: [NCSG-PC] Fwd: [NCSG-Discuss] Second Public Comment on IDN Guidelines
by Rafik Dammak Dec. 16, 2017

Dec. 16, 2017

Hi, please, find attached the NCSG comment on IDN guidelines. Best Regards, Rafik

1 0

[Comments-idn-guidelines-19oct17] Registries Stakeholder Group (RySG) comments on Internationalized Domain Name (IDN) Implementation Guidelines – Second Public Comment
by svg＠milathan.ltd Dec. 11, 2017

Dec. 11, 2017

Please find attached, in PDF format, the Registries Stakeholder Group (RySG) comments on Internationalized Domain Name (IDN) Implementation Guidelines – Second Public Comment. In the interest of time, the RySG did not conduct a formal vote on these comments. They were circulated and debated on our mailing list, with no member expressing opposition to their submission. Please do not hesitate to contact me or any member of the RySG Executive Committee should you have any questions. Best regards, Stéphane Van Gelder RySG Vice Chair (Policy)

1 0

[Comments-idn-guidelines-19oct17] IDNs have potential for a lot more homoglyphs than is neccessary
by Anton Bershanskiy Dec. 10, 2017

Dec. 10, 2017

Dear IDN Implementation guidelines Working Groop, Thank you for all the great work you are doing. I got interested in IDN homoglyphs and would like to share a few observations that I made (while IDN homoglyph generator based on IDN Tables and Unicode Technical Standard #39). Also, I made a proof-of-concept attack using an IDN homoglyph to do a man-in-the-middle attack on a website with mixed content to make an illusion of HTTPS-secured connection. 1. IDN Tables are more numerous then necessary and are sometimes redundant. Consider the following example: TLD .קום has 97 active IDN Tables, most of which are from entirely unrelated languages and even different continents. Note that two of these tables is Ukrainian and Cyrillic. 1.1. First of all, Ukrainian table is entirely unnecessary from usability perspective, since no Ukrainian would ever use this TLD as we have a completely different script system: Cyrillic. I can not even imagine how someone would even type this address. 1.2. Secondly, Ukrainian is entirely included in Cyrillic, thus does not really require a separate table. It might be a good idea to recommend registrars to remove (retire) IDN tables that are proper subsets of other tables or, better yet, not use overly permissive tables. 1.2. More importantly, Cyrillic contains a few code points similar to Latin, thus might allow homoglyphs for some of non-IDN second-level labels, that are recorded in in the DNS as usual ASCII strings (not Punycode). 2. I made a proof-of-concept man-in-the-middle attack with a Homoglyph. 2.1. Unsurprisingly, I was able to register a whole-script Cyrillic homoglyph (in COM space) for a usual ASCII domain and 2.2. got a valid TLS certificate for it. 2.3. Then, I proxied all HTTP traffic on my computer via a server that would redirect all HTTP for that specific domain to the homoglyph with HTTPS. 3.3. This simple system allowed me to visit "secure" HTTPS original site and then click an HTTP link to another page and be redirected to HTTP://original -> my local server -> HTTPS://homoglyph, resulting in visually undetectable man-in-the-middle attack. Sincerely, University of Illinois at Urbana-Champaign student Anton Bershanskiy.

1 0

[Comments-idn-guidelines-19oct17] Business Constituency (BC) comment on Internationalized Domain Name (IDN) Implementation Guidelines
by Steve DelBianco Dec. 10, 2017

Dec. 10, 2017

The ICANN Business Constituency (BC) submits the attached comment on Internationalized Domain Name (IDN) Implementation Guidelines. ( ICANN comment page at https://www.icann.org/public-comments/idn-guidelines-2017-10-19-en ) This comment was drafted by Andy Abrams, Paul Mitchell, and Olga Yaguez. It was approved in accord with the BC Charter. — Steve DelBianco Vice chair for policy coordination ICANN Business Constituency

1 0

[Comments-idn-guidelines-19oct17] JPRS comment on the Internationalised Domain Name Implementation Guidelines
by yoshitaka＠jprs.co.jp Dec. 8, 2017

Dec. 8, 2017

Dear ICANN, Thank you for giving us the oppotunity to submit the comments on the Guidelines for the Implementation of Internationalized Domain Names 4.0. Please find our comments as follows. Comments to paragraph 15 and 16, "2.5.2 Commingling of cross-script code points in a single label": As you describe about the exemption about the commingled use of multiple scripts in these paragraphs, it is an important point of view whether such multiple scripts are used exclusively in relevant linguistic area or not. For example, while Japanese characters are technically devided into 3 scripts (Han, Hiragana and Katakana), the official language of Japan is only Japanese and these 3 scripts are not the exclusive with each other. An example of mixed scripts in Japanese: Most of Japanese people write the phrase "registration of .jp domain name" as "jpドメイン名の登録" in Japanese. <><------><><><--> 1 2 3 4 5 This short phrase consists of Latin(1), Katakana(2), Han(3,5) and Hiragana(4) scripts. #If you can not display it, please see the attached file. That is, Japanese language user always uses Han, Hiragana and Katakana all together in the strings that configure the words in Japanese writing system, and Japanese characters are actually treated as 1 script in Japanese daily life. In fact, people in Japan are allowed to use Han, Hiragana, Katakana and ASCII characters all together as the person's names, the trademarks(*1), the trade names(*2), and/or the words including noun. (*1) The list of standard characters for trademarks (Japan Patent Office, written in Japanese) http://www.jpo.go.jp/shiryou/kijun/kijun2/pdf/syouhyoubin/shiryou_1_1.pdf (*2) About using ASCII characters for the trade names (Ministry of Justice, written in Japanese) http://www.moj.go.jp/MINJI/minji44.html In other words, the actual conditions of Japanese characters are treated as 1 script, but they are only devided into 3 scripts technically. We think that they have completely different degrees of risk between commingling Japanese characters (Han, Hiragana and Katakana) and commingling other scripts that must be used exclusively. Therefore, the Guidelines should clearly express that "the case of any exceptions made allowing mixing of scripts" means the case of commingling the scripts that are used exclusively. Best regards, -- Yoshitaka Okuno Manager, Services Development Department Japan Registry Services Co., Ltd.

1 0

[Comments-idn-guidelines-19oct17] Reserve .hom .home domain names
by John Gutierrez Nov. 30, 2017

Nov. 30, 2017

Please include the .hom and .home domain in the list of reserve domain names not available for registration. I use the .hom or the .home domain names for all of the computers in my home network which I use as a testing site. I would hope that these domain names never be available for registration. John Gutierrez jtgutier(a)earthlink.net

1 0

[Comments-idn-guidelines-19oct17] Comments
by Dusan Stojicevic Oct. 27, 2017

Oct. 27, 2017

Dear all, Overall, I found the guidelines good and comprehensive, but still have some doubts, regarding two different worlds that you are struggling to level up in this doc. 1. Section 2.3, point 7-9 I expect a help from ICANN, or some active role. In practice, cc's are collaborating on basic level, and g's are calling Patrick Falstrom or someone similar expert J In other words, nice - but nothing crucial here and I don't see any practical value. 2. Section 2.3, point 10 ".must be made directly available online by the registry." - Every must have these questions: who is checking is it made? What are the sanctions if it's not? Define that explicitly. 3. Section 2.2, point 6b Understandable, the usage of terms such as "encouraged to" is expected. But, then - it's not an obligation, so - they may not doing it a toll. How about to level up here and try with ALL IDN TLDs must fulfill? 4. Section 2.2, point 6a Does it works with cc's? If so, who is going to check? If we know who and how are making the checks, then X months is very easy to nominate. Community can ask for some exact number of months, but it's a speculation. Let say - 6. Why - I don't know, if you understand me. My two cents. Dusan Stojicevic Cyrillic GP, chair --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

[Comments-idn-guidelines-19oct17] EURid comment on the Internationalised Domain Name Implementation Guidelines
by Giovanni Seppia Oct. 24, 2017

Oct. 24, 2017

Guidelines for the Implementation of Internationalized Domain Names 4.0 - EURid comment EURid welcomes the opportunity to comment on the updated version of the Guidelines for the Implementation of Internationalised Domain Names, v. 4.0. EURid introduced IDNs at the second level in December 2009 to support the all characters of the official 24 European Union languages. Furthermore, in June 2016 EURid launched the .ею TLD, which is .eu in Cyrillic script, with a detailed plan to facilitate the move to .ею of existing domain names registered at the second level under .eu in Cyrillic script. This action is designed to minimise the risk of cybersequatting and customer confusion, and to ensure full script consistency at the top and second level. At international level, since 2011 EURid in partnership with UNESCO, Verisign and with the collaboration of the ccTLD regional organisations has been publishing the IDN World Report on IDN deployment (www.idnworldreport.eu<http://www.idnworldreport.eu/>). The Report investigates IDN penetration at the worldwide level from the perspectives of both domain name registration and usage. It also features an extensive assessment of the barriers that are currently impeding a broader adoption of IDNs - notably, a lack of so-called universal acceptance. Therefore, EURid looks forward to engaging in a possible "consortium to coordinate contact with external communities, elicit the assistance of support groups, and establish global fora to address common current and emerging challenges in the development and use of IDNs". In this context and considering the following recommendation about the registry' publication of IDN policies - "The registry should also encourage its registrars to call attention to these policies for all IDN registrants." - EURid wishes to suggest any consortium/forum about IDNs be as inclusive as possible of the various stakeholders in the domain chain, including registrars and registrants. Only by enabling those interested parties to join such bodies registries will have a better and more sound perception of the challenges around IDNs. Giovanni Seppia External Relations Manager EURid Woluwelaan 150 1831 Diegem - Belgium TEL: +32 (0) 2 401 2750 giovanni.seppia(a)eurid.eu<mailto:giovanni.seppia@eurid.eu> http://www.eurid.eu<http://www.eurid.eu/> Please consider the environment before printing this email. Disclaimer: This email and any attachment hereto is intended solely for the person to which it is addressed and may contain confidential and/or privileged information. If you are not the intended recipient or if you have received this email in error, please delete it and immediately contact the sender by telephone or email, and destroy any copies of this information. You should not use or copy it, nor disclose its content to any other person or rely upon this information. Please note that any views presented in the email and any attachment hereto are solely those of the author and do not necessarily represent those of EURid. While all care has been taken to avoid any known viruses, the recipient is advised to check this email and any attachment for presence of viruses. http://www.eurid.eu/en/legal-disclaimer

1 0