April 2017 - UA-discuss - lists.iana.org

FW: I-D Action: draft-klensin-idna-rfc5891bis-00.txt
by Mark Svancarek July 6, 2017

July 6, 2017

FYI, too much stuff from John for me to dig into this a.m. -----Original Message----- From: Idna-update [mailto:idna-update-bounces@alvestrand.no] On Behalf Of John C Klensin Sent: Saturday, March 11, 2017 8:25 AM To: idna-update(a)alvestrand.no Subject: FWD: I-D Action: draft-klensin-idna-rfc5891bis-00.txt Hi. For the information of those who may be watching this list but not the IETF announcement one... Asmus Freytag and I have started to put together a draft that addresses a problem with the IDNA2008 specs, specifically that we failed to make the responsibility of registries to define code point and label acceptability rules that were considerably more narrow (and better understood by them) than the full set of labels allowed by RFC 5891-5893. It doesn't actually change anything because that requirement is in the existing specs; it just makes (or tries to make) the requirements painfully clear to those who have been missing or misreading them. It also provides an explicit link between IDNA2008 requirements and ICANN work on repertoires and label generation rules without endorsing that work as more than one thoughtful approach that might be examined for either reference or inspiration. Comments (obviously) welcome. For anyone who might wonder, this document avoids the more controversial IDNA2008 issues including: * Multiple suggestions that we should add emoji, a subset of code points with General Category "So", to the list of code points allowed by IDNA. There are many reasons to not do that but it seems clear that, at some point, the IETF will need to either document those reasons or make the change. Volunteers to put together or work on a document would be welcome. * The non-decomposing code point problem, formerly (and incorrectly) known as the Hamza problem. There has been no discernable activity on this since the IAB Statement and LUCID BOF almost exactly two years ago. I've further updated the working copy of draft-klensin-idna-5892upd-unicode70 to cover additional cases and issues, but, in part because it is clearly inappropriate for a quick-patch individual submission, have been advised to not post it until we have a plan to make progress. So far, there is no such plan. * The (IMO, growing) problem of multiple and inconsistent specifications for IDNs and IDN handling, with different ones being used in different higher-level protocols and areas of the Internet. The use of different specifications and definitions creates opportunities for user and implementer confusion, interoperability difficulties, domain names that cannot be resolved under some circumstances, and various sorts of attacks. The specifications involved include IDNA2008, IDNA2003, assorted local "updates" to IDNA2003 that use versions of Stringprep locally updated to assorted versions of Unicode, and the various versions of UTR#46. The latest version of the latter explicitly allows emoji along with other symbols. A few months ago, I suggested to the IAB I18N program that a document be produced that at least pointed out the problems associated with multiple divergent specifications, but the idea got no traction. It appears to me that, although almost everyone agrees that IDNs, and well- and clearly-functional IDNs, are important, virtually no one is willing to do the hard work, at least unless they are being supported by ICANN (disclosure: I am not) or organizations whose interests lie in selling names, preferably as many of them as possible (I have no support from any of them either). Until and unless that changes, I don't see much prospect for getting those other issues addressed in a way that might lead to consensus documents. john ---------- Forwarded Message ---------- Date: Saturday, March 11, 2017 07:22 -0800 From: internet-drafts(a)ietf.org To: i-d-announce(a)ietf.org Subject: I-D Action: draft-klensin-idna-rfc5891bis-00.txt A New Internet-Draft is available from the on-line Internet-Drafts directories. Title : Internationalized Domain Names in Applications (IDNA): Registry Restrictions and Recommendations Authors : John C Klensin Asmus Freytag Filename : draft-klensin-idna-rfc5891bis-00.txt Pages : 10 Date : 2017-03-11 Abstract: The IDNA specifications for internationalized domain names combine rules that determine the labels that are allowed in the DNS without violating the protocol itself and an assignment of responsibility, consistent with earlier specifications, for determining the labels that are allowed in particular zones. Conformance to IDNA by registries and other implementations requires both parts. Experience strongly suggests that the language describing those responsibility was insufficiently clear to promote safe and interoperable use of the specifications and that more details and some specific examples would have been helpful. This specification updates the earlier ones to provide that guidance and to correct some technical errors in the descriptions. It does not alter the protocols and rules themselves in any way. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-klensin-idna-rfc5891bis/ There's also a htmlized version available at: https://tools.ietf.org/html/draft-klensin-idna-rfc5891bis-00 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ I-D-Announce mailing list I-D-Announce(a)ietf.org https://www.ietf.org/mailman/listinfo/i-d-announce Internet-Draft directories: http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt ---------- End Forwarded Message ---------- _______________________________________________ Idna-update mailing list Idna-update(a)alvestrand.no http://www.alvestrand.no/mailman/listinfo/idna-update

8 10

Are Washington Companies Ready for the Next Billion Internet Users? | WTIA
by Don Hollander April 28, 2017

April 28, 2017

This Guest Blogpost for the Washington State Tech companies is a by product of our recent UASG Coordination Group meeting in Redmond. We encourage UASG members to make themselves equally famous (more famous) with their local tech groups by doing something similar. The UASG is happy to help with the words if you need it. Don > > https://www.washingtontechnology.org/washington-companies-ready-next-billio… <https://www.washingtontechnology.org/washington-companies-ready-next-billio…> > > Are Washington Companies Ready for the Next Billion Internet Users? > Don Hollander <https://www.washingtontechnology.org/author/don-hollander/>April 27, 2017 > > Washington is home to some of the world’s biggest technology companies, as well as start-ups reinventing the way we work, live, and play. While these companies are on the cutting edge of digital transformation, there is one component of their digital strategy that many have overlooked: the issue of Universal Acceptance (UA). Let me explain. > > Universal Acceptance (UA), Defined > > In recent years, the Domain Name System (DNS) has expanded dramatically, fueling increased competition, choice and innovation, and helping the Internet become truly global. There are now more than 1,200 generic top-level domains (gTLDs), many of which are longer than the traditional three-character domains (e.g. .com, .edu, and .org) or are in non-Latin based scripts – such as Arabic, Cyrillic and Hindi. > > The expansion allows organizations and individuals worldwide to claim a domain name that best reflects their sense of identity. While this expansion is critical in bringing the next billion people online and growing the global Internet economy, the incorporation of these new domains across the global Internet is not an entirely automatic process. > > Universal Acceptance is the concept that all domain names, including the newer, non-traditional ones, should be treated equally. However, many organizations and businesses have not updated their systems to accommodate the new domains, or, in other words, become UA-ready. For example, problems may arise when a user enters a domain name or related email address into an online form on a website and it is rejected. When this happens, it not only frustrates the user and reduces the opportunities for the organization to win a new customer, but it also lessens the cultural, social, and economic benefits made possible by the Internet. > > Benefits of UA-Readiness > > The Universal Acceptance Steering Group <https://uasg.tech/> (UASG), a global consortium of organizations including Washington-based Microsoft, Amazon, and domain registry company Donuts, recently commissioned an independent report <https://uasg.tech/whitepaper/> that highlights the qualitative and quantitative benefits of UA. The report conservatively estimates that there is a potential $9.8 billion annual revenue growth opportunity from both existing users using the new domain names and from new Internet users coming online through Internationalized Domain Names (IDNs). <https://www.icann.org/resources/pages/idn-2012-02-25-en> > From a qualitative perspective, the report also showed that when governments and non-governmental organizations (NGOs) become UA-ready, they are better able to engage with their citizens and communities who want to choose their own identity with their own domain name, whether in English or non-English scripts. > > Steps You Can Take to Become UA-Ready > > While the issue of UA can seem daunting at first, the good news is it can be addressed quite easily through what can be described as a “bug fix” or routine update to online systems. The report found that the efforts for software and application owners to implement UA are not particularly onerous, and are outweighed by the benefits that could be realized by doing so. > > To help you get started, the UASG has developed a number of helpful guides and resources, which are available at https://uasg.tech/documents <https://uasg.tech/documents>. Of particular note is the Quick Guide to Universal Acceptance <https://uasg.tech/wp-content/uploads/2016/06/UASG005-160302-en-quickguide-d…> (UASG005), which is available in multiple languages, as well as the Introduction to Universal Acceptance (UASG 007) <https://community.icann.org/download/attachments/56990805/UASG007-version-8…>, a comprehensive technical document on Universal Acceptance and the key issues that developers and system architects need to know. We encourage you to visit our website and view these useful materials, and also to get involved with the UASG (you can join the mailing list at https://uasg.tech/subscribe <https://uasg.tech/subscribe>). CIOs, web administrators, application developers and others have an important role to play in making sure their applications work in harmony with the evolved Internet infrastructure – and this is a critical issue where Washington companies can lead the way. > > Subscribe to the Blog <http://www.washingtontechnology.org/subscribe-wtias-weekly-blog-digest/> > Don Hollander is the Secretary General of the Universal Acceptance Steering Group (www.UASG.tech) The UASG is committed to getting all software applications to accept all domain names and email addresses – including new top-level domains and domain names in non-English characters. Don has served as CIO, CEO and Chair of technology organizations in New Zealand and the Pacific. He has been working for decades to raise awareness of ICT issues for economic, social, cultural and individual prosperity. Don and his wife own Book Haven, a second-hand bookshop in Wellington, New Zealand. > Don Hollander Universal Acceptance Steering Group Skype: don_hollander

1 0

IDN Response Blog
by Don Hollander April 28, 2017

April 28, 2017

Thanks to all for the contributions to the IDN Response blog and the generally associated discussion. Good stuff indeed. Attached is the final result that will be published in the morning UTC. There has been enough other good material shared to make several other interesting blog posts in different forums, so I encourage you to do so and make yourself famous. Don

4 3

Latin+Cyrillic — .com .닷컴 .コム
by Andre Schappo April 28, 2017

April 28, 2017

Some thoughts, having now caught up with all the UA emails on phishing. ① Over the years there has been much discussion about Cyrillic being used to masquerade as ASCII domain names. I wonder if the Russian speaking community have been having similar discussions with respect to ASCII being used to masquerade as Cyrillic domain names. ② You are all aware that many different human language scripts can be used with the .com TLD. Until today I had not thought about which scripts can be used with .닷컴 (.com in Korean Hangeul) and .コム (.com in Japanese Katakana). If you look at https://www.iana.org/domains/idn-tables you will see that many different human language scripts can be used with .닷컴 and .コム. What is really cool is that Egyptian Hieroglyphs is listed as one of the scripts. André Schappo

5 5

Re : Re: UASG Response to WordFence IDN Phishing concerns
by Dr. AJAY D A T A April 27, 2017

April 27, 2017

Exactly Andrie. Thank you for confirming the same. I confirmed with .pyc registry (we enabled EAI on почта.рус) also and they are not allowed (as per agreement) to use any other script other than Cyrillic. So basically it looks like .com problem. Any other examples other than .com ? It narrows down the problem to solve. Thanks. Dr. Ajay DATA | Founder &amp CEO Get email id like अजय(a)xn--c2bd1gb.xn--h2brj9c in your own language,visit www.xgenplus.com From: Andrei Kolesnikov MailId : [68484721]To: Don Hollander Cc: "Dr. AJAY D A T A" ,tan tanakadennis via ua-discuss Subject: Re: [UA-discuss] UASG Response to WordFence IDN Phishing concernsDate: 26 Apr 2017 02:16:05 PM Don, there is no such thing as IDN at .RU - only ascii allowed - we understood the problem long time ago due to similarity of many Cyrillic letters with Latin. In IDN .РФ in Russia only Cyrillic allowed. This definitely must be the rule for registries. Or some kind of immediate mitigation service to bring down dangerous domains. --andrei 2017-04-26 11:34 GMT+03:00 Don Hollander don.hollander(a)icann.org>: Hi Andrei: What about at the ccTLD? idn.ru? Does .ru also allow ASCII? Does the .ru registry, for example, do anything to address homoglyphs between ascii and cyrillic? D On 26/04/2017, at 8:30 PM, Andrei Kolesnikov andrei(a)rol.ru> wrote: most use of idn.ascii gTLD as far as I know is .com for example http://путин.com/[xn--h1akeme.com] Basically most of the confusing cases discussed above are from .com --andrei 2017-04-26 10:35 GMT+03:00 Dr. AJAY D A T A ajay(a)data.in>: Hello Don, Which all registries are allowed to register mix of scripts domain while registering an IDN. I checked .pyc (Cyrillic) and .भारत (Devanagiri) do not allow mix of scripts. I think we address those registries through ICANN by modifying the registry agreement, major problem can be solved. Thanks. Dr. Ajay DATA | Founder &amp CEO Get email id like अजय(a)xn--c2bd1gb.xn--h2brj9c in your own language,visit www.xgenplus.com[xgenplus.com] From: "Tan Tanaka,Dennis via UA-discuss" ua-discuss(a)icann.org> MailId : [68456683]To: Don Hollander don.hollander(a)icann.org>,"ua-discuss(a)icann.org" ua-discuss(a)icann.org>Subject: Re: [UA-discuss] UASG Response to WordFence IDN Phishing concernsDate: 25 Apr 2017 06:28:22 PM Don, my comments enclosed Thanks -Dennis From: ua-discuss-bounces(a)icann.org> on behalf of Don Hollander don.hollander(a)icann.org> Date: Monday, April 24, 2017 at 5:40 PM To: "UA-discuss(a)icann.org" ua-discuss(a)icann.org> Subject: [EXTERNAL] [UA-discuss] UASG Response to WordFence IDN Phishing concerns Further to recent discussion on this list, we have drafted a document that we plan on posting as a Blog Post to the UASG Web site that can be referenced by others . We want to get feedback from the community on this document by Thursday UTC . So, here it is &ndash pasted below and as a word document in case you want to enable tracking and make amendments. If you have comments or suggestions, please share them to this group . Don IDNs and Phishing: What You Need to Know By TBD at UASG Internationalized Domain Names[icann.org] (IDNs) are growing in popularity, a testament to their role in the expansion of the global Internet and the value they provide in connecting non-English speakers to the Web. However, you may have noticed a renewed focus over the past week of a script mixing technique that phishing scammers could potentially use to trick Internet users into visiting malicious websites. This phishing method takes advantage of the fact that characters from various languages and scripts are sometimes visually similar to each other. For example, the Cyrillic &ldquoа&rdquo and the ASCII[en.wikipedia.org] &ldquoa&rdquo look virtually identical. This technique is known as a homograph attack. Homographic phishing efforts associated with IDNs are not new. In fact, they date back to the early 2000s. Registries have since implemented policies that preclude mixing scripts[1] within a domain name label . While this issue should be taken seriously and serves as an important reminder of consumer safety, various IDN and anti-abuse groups are actively working to mitigate potential threats, and there are already certain browser-set protections in place. In the meantime, Internet users should practice the same basic security hygiene that is always recommended: avoid clicking suspicious links, and use a good password manager that will only enter login credentials on trusted sites. Equally important is to recognize the benefits of IDNs and avoid disabling them, which could lead to an unpredictable user experience and eventually a decrease in adoption. IDNs are essential in bringing non-English speakers &ndash the majority of the world&rsquos population &ndash online, and allowing those users to create their own highly relevant online identities as well as navigate the Internet in their native languages. In addition to the social and cultural benefits of IDNs, they also represent a significant economic opportunity a recent report[uasg.tech] commissioned by the Universal Acceptance Steering Group (UASG) found that online spending from new IDN users could start at USD 6.2 billion per year. The UASG&rsquos mission is to help software developers and website owners keep pace with the evolving Domain Name System (DNS) &ndash and this includes issues around the adoption and acceptance of IDNs. If you&rsquod like to get involved in helping work toward a solution to this and other IDN-related issues, please visit https://uasg.tech/[uasg.tech] or get in touch[uasg.tech] to learn more. [1] Exceptions are practiced for languages with established orthographies and conventions that require the commingled use of multiple scripts, e.g. the Japanese writing system . Do not Remove:[HID]20170425182821379[-HID] -- Andrey Kolesnikov RIPN.NET[RIPN.NET] Don Hollander Universal Acceptance Steering Group Skype: don_hollander -- Andrey Kolesnikov RIPN.NET

12 11

ICANN's Draft FY18 Operating Plan and Budget, and Five-Year Operating Plan Update Follow Updates
by Don Hollander April 27, 2017

April 27, 2017

Just a reminder, that the deadline for making comments on ICANN's Draft FY18 Operating Plan and Budget, and Five-Year Operating Plan Update, where you might want to show support for Universal Acceptance, closes tomorrow. The link to the document and a place for comments is at https://www.icann.org/public-comments/fy18-budget-2017-03-08-en <https://www.icann.org/public-comments/fy18-budget-2017-03-08-en> Just saying… Don Don Hollander Universal Acceptance Steering Group Skype: don_hollander

1 0

UASG - Linkification Review
by Don Hollander April 27, 2017

April 27, 2017

A follow-on call to the review of the Quick Guide to Linkification and the Help Wanted advertisement. Link to document for editing is https://docs.google.com/document/d/1RLkRtjku2Yz5oyjUk1vsRnCr7LtdjUmVRTgx2MA… Link to relevant documents are below: Quick Guide to Linkification<https://community.icann.org/download/attachments/56990805/UASG010%20Quick%2…> Linkification in UASG007 <https://uasg.tech/wp-content/uploads/2016/05/UASG007-version-9-2017-02-02.p…> Help Wanted Ad - Evaluation <https://uasg.tech/wp-content/uploads/2016/11/Help-Wanted...-Linkification-E…> Thank you. Don

1 0

Notes from UASG Linkification Document Review call
by Don Hollander April 27, 2017

April 27, 2017

Attached are the draft notes from today’s call that reviewed the Quick Guide to Linkification. Don Don Hollander Universal Acceptance Steering Group Skype: don_hollander

1 0

UASG Response to WordFence IDN Phishing concerns
by Don Hollander April 26, 2017

April 26, 2017

Further to recent discussion on this list, we have drafted a document that we plan on posting as a Blog Post to the UASG Web site that can be referenced by others. We want to get feedback from the community on this document by Thursday UTC. So, here it is – pasted below and as a word document in case you want to enable tracking and make amendments. If you have comments or suggestions, please share them to this group. Don IDNs and Phishing: What You Need to Know By TBD at UASG Internationalized Domain Names (IDNs) are growing in popularity, a testament to their role in the expansion of the global Internet and the value they provide in connecting non-English speakers to the Web. However, you may have noticed a renewed focus over the past week of a script mixing technique that phishing scammers could potentially use to trick Internet users into visiting malicious websites. This phishing method takes advantage of the fact that characters from various languages and scripts are sometimes visually similar to each other. For example, the Cyrillic “а” and the ASCII “a” look virtually identical. This technique is known as a homograph attack. Homographic phishing efforts associated with IDNs are not new. In fact, they date back to the early 2000s. Registries have since implemented policies that preclude mixing scripts[1] within a domain name label. While this issue should be taken seriously and serves as an important reminder of consumer safety, various IDN and anti-abuse groups are actively working to mitigate potential threats, and there are already certain browser-set protections in place. In the meantime, Internet users should practice the same basic security hygiene that is always recommended: avoid clicking suspicious links, and use a good password manager that will only enter login credentials on trusted sites. Equally important is to recognize the benefits of IDNs and avoid disabling them, which could lead to an unpredictable user experience and eventually a decrease in adoption. IDNs are essential in bringing non-English speakers – the majority of the world’s population – online, and allowing those users to create their own highly relevant online identities as well as navigate the Internet in their native languages. In addition to the social and cultural benefits of IDNs, they also represent a significant economic opportunity; a recent report commissioned by the Universal Acceptance Steering Group (UASG) found that online spending from new IDN users could start at USD 6.2 billion per year. The UASG’s mission is to help software developers and website owners keep pace with the evolving Domain Name System (DNS) – and this includes issues around the adoption and acceptance of IDNs. If you’d like to get involved in helping work toward a solution to this and other IDN-related issues, please visit https://uasg.tech/ or get in touch to learn more. [1] Exceptions are practiced for languages with established orthographies and conventions that require the commingled use of multiple scripts, e.g. the Japanese writing system.

3 3

Re : Re: UASG Response to WordFence IDN Phishing concerns
by Dr. AJAY D A T A April 26, 2017

April 26, 2017

Hello Don, Which all registries are allowed to register mix of scripts domain while registering an IDN. I checked .pyc (Cyrillic) and .भारत (Devanagiri) do not allow mix of scripts. I think we address those registries through ICANN by modifying the registry agreement, major problem can be solved. Thanks. Dr. Ajay DATA | Founder &amp CEO Get email id like अजय(a)xn--c2bd1gb.xn--h2brj9c in your own language,visit www.xgenplus.com From: "Tan Tanaka,Dennis via UA-discuss" MailId : [68456683]To: Don Hollander ,"ua-discuss(a)icann.org" Subject: Re: [UA-discuss] UASG Response to WordFence IDN Phishing concernsDate: 25 Apr 2017 06:28:22 PM v\:* {behavior:url(#default#VML)} o\:* {behavior:url(#default#VML)} w\:* {behavior:url(#default#VML)} .shape {behavior:url(#default#VML)} Don, my comments enclosed Thanks -Dennis From: on behalf of Don Hollander Date: Monday, April 24, 2017 at 5:40 PM To: "UA-discuss(a)icann.org" Subject: [EXTERNAL] [UA-discuss] UASG Response to WordFence IDN Phishing concerns Further to recent discussion on this list, we have drafted a document that we plan on posting as a Blog Post to the UASG Web site that can be referenced by others . We want to get feedback from the community on this document by Thursday UTC . So, here it is &ndash pasted below and as a word document in case you want to enable tracking and make amendments. If you have comments or suggestions, please share them to this group . Don IDNs and Phishing: What You Need to Know By TBD at UASG Internationalized Domain Names (IDNs) are growing in popularity, a testament to their role in the expansion of the global Internet and the value they provide in connecting non-English speakers to the Web. However, you may have noticed a renewed focus over the past week of a script mixing technique that phishing scammers could potentially use to trick Internet users into visiting malicious websites. This phishing method takes advantage of the fact that characters from various languages and scripts are sometimes visually similar to each other. For example, the Cyrillic &ldquoа&rdquo and the ASCII &ldquoa&rdquo look virtually identical. This technique is known as a homograph attack. Homographic phishing efforts associated with IDNs are not new. In fact, they date back to the early 2000s. Registries have since implemented policies that preclude mixing scripts[1] within a domain name label . While this issue should be taken seriously and serves as an important reminder of consumer safety, various IDN and anti-abuse groups are actively working to mitigate potential threats, and there are already certain browser-set protections in place. In the meantime, Internet users should practice the same basic security hygiene that is always recommended: avoid clicking suspicious links, and use a good password manager that will only enter login credentials on trusted sites. Equally important is to recognize the benefits of IDNs and avoid disabling them, which could lead to an unpredictable user experience and eventually a decrease in adoption. IDNs are essential in bringing non-English speakers &ndash the majority of the world&rsquos population &ndash online, and allowing those users to create their own highly relevant online identities as well as navigate the Internet in their native languages. In addition to the social and cultural benefits of IDNs, they also represent a significant economic opportunity a recent report commissioned by the Universal Acceptance Steering Group (UASG) found that online spending from new IDN users could start at USD 6.2 billion per year. The UASG&rsquos mission is to help software developers and website owners keep pace with the evolving Domain Name System (DNS) &ndash and this includes issues around the adoption and acceptance of IDNs. If you&rsquod like to get involved in helping work toward a solution to this and other IDN-related issues, please visit https://uasg.tech/ or get in touch to learn more. [1] Exceptions are practiced for languages with established orthographies and conventions that require the commingled use of multiple scripts, e.g. the Japanese writing system . Do not Remove:[HID]20170425182821379[-HID]

9 13