- UA-discuss - lists.iana.org

Re : Re: UASG Response to WordFence IDN Phishing concerns
by Dr. AJAY D A T A April 27, 2017

April 27, 2017

Exactly Andrie. Thank you for confirming the same. I confirmed with .pyc registry (we enabled EAI on почта.рус) also and they are not allowed (as per agreement) to use any other script other than Cyrillic. So basically it looks like .com problem. Any other examples other than .com ? It narrows down the problem to solve. Thanks. Dr. Ajay DATA | Founder &amp CEO Get email id like अजय(a)xn--c2bd1gb.xn--h2brj9c in your own language,visit www.xgenplus.com From: Andrei Kolesnikov MailId : [68484721]To: Don Hollander Cc: "Dr. AJAY D A T A" ,tan tanakadennis via ua-discuss Subject: Re: [UA-discuss] UASG Response to WordFence IDN Phishing concernsDate: 26 Apr 2017 02:16:05 PM Don, there is no such thing as IDN at .RU - only ascii allowed - we understood the problem long time ago due to similarity of many Cyrillic letters with Latin. In IDN .РФ in Russia only Cyrillic allowed. This definitely must be the rule for registries. Or some kind of immediate mitigation service to bring down dangerous domains. --andrei 2017-04-26 11:34 GMT+03:00 Don Hollander don.hollander(a)icann.org>: Hi Andrei: What about at the ccTLD? idn.ru? Does .ru also allow ASCII? Does the .ru registry, for example, do anything to address homoglyphs between ascii and cyrillic? D On 26/04/2017, at 8:30 PM, Andrei Kolesnikov andrei(a)rol.ru> wrote: most use of idn.ascii gTLD as far as I know is .com for example http://путин.com/[xn--h1akeme.com] Basically most of the confusing cases discussed above are from .com --andrei 2017-04-26 10:35 GMT+03:00 Dr. AJAY D A T A ajay(a)data.in>: Hello Don, Which all registries are allowed to register mix of scripts domain while registering an IDN. I checked .pyc (Cyrillic) and .भारत (Devanagiri) do not allow mix of scripts. I think we address those registries through ICANN by modifying the registry agreement, major problem can be solved. Thanks. Dr. Ajay DATA | Founder &amp CEO Get email id like अजय(a)xn--c2bd1gb.xn--h2brj9c in your own language,visit www.xgenplus.com[xgenplus.com] From: "Tan Tanaka,Dennis via UA-discuss" ua-discuss(a)icann.org> MailId : [68456683]To: Don Hollander don.hollander(a)icann.org>,"ua-discuss(a)icann.org" ua-discuss(a)icann.org>Subject: Re: [UA-discuss] UASG Response to WordFence IDN Phishing concernsDate: 25 Apr 2017 06:28:22 PM Don, my comments enclosed Thanks -Dennis From: ua-discuss-bounces(a)icann.org> on behalf of Don Hollander don.hollander(a)icann.org> Date: Monday, April 24, 2017 at 5:40 PM To: "UA-discuss(a)icann.org" ua-discuss(a)icann.org> Subject: [EXTERNAL] [UA-discuss] UASG Response to WordFence IDN Phishing concerns Further to recent discussion on this list, we have drafted a document that we plan on posting as a Blog Post to the UASG Web site that can be referenced by others . We want to get feedback from the community on this document by Thursday UTC . So, here it is &ndash pasted below and as a word document in case you want to enable tracking and make amendments. If you have comments or suggestions, please share them to this group . Don IDNs and Phishing: What You Need to Know By TBD at UASG Internationalized Domain Names[icann.org] (IDNs) are growing in popularity, a testament to their role in the expansion of the global Internet and the value they provide in connecting non-English speakers to the Web. However, you may have noticed a renewed focus over the past week of a script mixing technique that phishing scammers could potentially use to trick Internet users into visiting malicious websites. This phishing method takes advantage of the fact that characters from various languages and scripts are sometimes visually similar to each other. For example, the Cyrillic &ldquoа&rdquo and the ASCII[en.wikipedia.org] &ldquoa&rdquo look virtually identical. This technique is known as a homograph attack. Homographic phishing efforts associated with IDNs are not new. In fact, they date back to the early 2000s. Registries have since implemented policies that preclude mixing scripts[1] within a domain name label . While this issue should be taken seriously and serves as an important reminder of consumer safety, various IDN and anti-abuse groups are actively working to mitigate potential threats, and there are already certain browser-set protections in place. In the meantime, Internet users should practice the same basic security hygiene that is always recommended: avoid clicking suspicious links, and use a good password manager that will only enter login credentials on trusted sites. Equally important is to recognize the benefits of IDNs and avoid disabling them, which could lead to an unpredictable user experience and eventually a decrease in adoption. IDNs are essential in bringing non-English speakers &ndash the majority of the world&rsquos population &ndash online, and allowing those users to create their own highly relevant online identities as well as navigate the Internet in their native languages. In addition to the social and cultural benefits of IDNs, they also represent a significant economic opportunity a recent report[uasg.tech] commissioned by the Universal Acceptance Steering Group (UASG) found that online spending from new IDN users could start at USD 6.2 billion per year. The UASG&rsquos mission is to help software developers and website owners keep pace with the evolving Domain Name System (DNS) &ndash and this includes issues around the adoption and acceptance of IDNs. If you&rsquod like to get involved in helping work toward a solution to this and other IDN-related issues, please visit https://uasg.tech/[uasg.tech] or get in touch[uasg.tech] to learn more. [1] Exceptions are practiced for languages with established orthographies and conventions that require the commingled use of multiple scripts, e.g. the Japanese writing system . Do not Remove:[HID]20170425182821379[-HID] -- Andrey Kolesnikov RIPN.NET[RIPN.NET] Don Hollander Universal Acceptance Steering Group Skype: don_hollander -- Andrey Kolesnikov RIPN.NET

12 11

ICANN's Draft FY18 Operating Plan and Budget, and Five-Year Operating Plan Update Follow Updates
by Don Hollander April 27, 2017

April 27, 2017

Just a reminder, that the deadline for making comments on ICANN's Draft FY18 Operating Plan and Budget, and Five-Year Operating Plan Update, where you might want to show support for Universal Acceptance, closes tomorrow. The link to the document and a place for comments is at https://www.icann.org/public-comments/fy18-budget-2017-03-08-en <https://www.icann.org/public-comments/fy18-budget-2017-03-08-en> Just saying… Don Don Hollander Universal Acceptance Steering Group Skype: don_hollander

1 0

UASG - Linkification Review
by Don Hollander April 27, 2017

April 27, 2017

A follow-on call to the review of the Quick Guide to Linkification and the Help Wanted advertisement. Link to document for editing is https://docs.google.com/document/d/1RLkRtjku2Yz5oyjUk1vsRnCr7LtdjUmVRTgx2MA… Link to relevant documents are below: Quick Guide to Linkification<https://community.icann.org/download/attachments/56990805/UASG010%20Quick%2…> Linkification in UASG007 <https://uasg.tech/wp-content/uploads/2016/05/UASG007-version-9-2017-02-02.p…> Help Wanted Ad - Evaluation <https://uasg.tech/wp-content/uploads/2016/11/Help-Wanted...-Linkification-E…> Thank you. Don

1 0

Notes from UASG Linkification Document Review call
by Don Hollander April 27, 2017

April 27, 2017

Attached are the draft notes from today’s call that reviewed the Quick Guide to Linkification. Don Don Hollander Universal Acceptance Steering Group Skype: don_hollander

1 0

UASG Response to WordFence IDN Phishing concerns
by Don Hollander April 26, 2017

April 26, 2017

Further to recent discussion on this list, we have drafted a document that we plan on posting as a Blog Post to the UASG Web site that can be referenced by others. We want to get feedback from the community on this document by Thursday UTC. So, here it is – pasted below and as a word document in case you want to enable tracking and make amendments. If you have comments or suggestions, please share them to this group. Don IDNs and Phishing: What You Need to Know By TBD at UASG Internationalized Domain Names (IDNs) are growing in popularity, a testament to their role in the expansion of the global Internet and the value they provide in connecting non-English speakers to the Web. However, you may have noticed a renewed focus over the past week of a script mixing technique that phishing scammers could potentially use to trick Internet users into visiting malicious websites. This phishing method takes advantage of the fact that characters from various languages and scripts are sometimes visually similar to each other. For example, the Cyrillic “а” and the ASCII “a” look virtually identical. This technique is known as a homograph attack. Homographic phishing efforts associated with IDNs are not new. In fact, they date back to the early 2000s. Registries have since implemented policies that preclude mixing scripts[1] within a domain name label. While this issue should be taken seriously and serves as an important reminder of consumer safety, various IDN and anti-abuse groups are actively working to mitigate potential threats, and there are already certain browser-set protections in place. In the meantime, Internet users should practice the same basic security hygiene that is always recommended: avoid clicking suspicious links, and use a good password manager that will only enter login credentials on trusted sites. Equally important is to recognize the benefits of IDNs and avoid disabling them, which could lead to an unpredictable user experience and eventually a decrease in adoption. IDNs are essential in bringing non-English speakers – the majority of the world’s population – online, and allowing those users to create their own highly relevant online identities as well as navigate the Internet in their native languages. In addition to the social and cultural benefits of IDNs, they also represent a significant economic opportunity; a recent report commissioned by the Universal Acceptance Steering Group (UASG) found that online spending from new IDN users could start at USD 6.2 billion per year. The UASG’s mission is to help software developers and website owners keep pace with the evolving Domain Name System (DNS) – and this includes issues around the adoption and acceptance of IDNs. If you’d like to get involved in helping work toward a solution to this and other IDN-related issues, please visit https://uasg.tech/ or get in touch to learn more. [1] Exceptions are practiced for languages with established orthographies and conventions that require the commingled use of multiple scripts, e.g. the Japanese writing system.

3 3

Re : Re: UASG Response to WordFence IDN Phishing concerns
by Dr. AJAY D A T A April 26, 2017

April 26, 2017

Hello Don, Which all registries are allowed to register mix of scripts domain while registering an IDN. I checked .pyc (Cyrillic) and .भारत (Devanagiri) do not allow mix of scripts. I think we address those registries through ICANN by modifying the registry agreement, major problem can be solved. Thanks. Dr. Ajay DATA | Founder &amp CEO Get email id like अजय(a)xn--c2bd1gb.xn--h2brj9c in your own language,visit www.xgenplus.com From: "Tan Tanaka,Dennis via UA-discuss" MailId : [68456683]To: Don Hollander ,"ua-discuss(a)icann.org" Subject: Re: [UA-discuss] UASG Response to WordFence IDN Phishing concernsDate: 25 Apr 2017 06:28:22 PM v\:* {behavior:url(#default#VML)} o\:* {behavior:url(#default#VML)} w\:* {behavior:url(#default#VML)} .shape {behavior:url(#default#VML)} Don, my comments enclosed Thanks -Dennis From: on behalf of Don Hollander Date: Monday, April 24, 2017 at 5:40 PM To: "UA-discuss(a)icann.org" Subject: [EXTERNAL] [UA-discuss] UASG Response to WordFence IDN Phishing concerns Further to recent discussion on this list, we have drafted a document that we plan on posting as a Blog Post to the UASG Web site that can be referenced by others . We want to get feedback from the community on this document by Thursday UTC . So, here it is &ndash pasted below and as a word document in case you want to enable tracking and make amendments. If you have comments or suggestions, please share them to this group . Don IDNs and Phishing: What You Need to Know By TBD at UASG Internationalized Domain Names (IDNs) are growing in popularity, a testament to their role in the expansion of the global Internet and the value they provide in connecting non-English speakers to the Web. However, you may have noticed a renewed focus over the past week of a script mixing technique that phishing scammers could potentially use to trick Internet users into visiting malicious websites. This phishing method takes advantage of the fact that characters from various languages and scripts are sometimes visually similar to each other. For example, the Cyrillic &ldquoа&rdquo and the ASCII &ldquoa&rdquo look virtually identical. This technique is known as a homograph attack. Homographic phishing efforts associated with IDNs are not new. In fact, they date back to the early 2000s. Registries have since implemented policies that preclude mixing scripts[1] within a domain name label . While this issue should be taken seriously and serves as an important reminder of consumer safety, various IDN and anti-abuse groups are actively working to mitigate potential threats, and there are already certain browser-set protections in place. In the meantime, Internet users should practice the same basic security hygiene that is always recommended: avoid clicking suspicious links, and use a good password manager that will only enter login credentials on trusted sites. Equally important is to recognize the benefits of IDNs and avoid disabling them, which could lead to an unpredictable user experience and eventually a decrease in adoption. IDNs are essential in bringing non-English speakers &ndash the majority of the world&rsquos population &ndash online, and allowing those users to create their own highly relevant online identities as well as navigate the Internet in their native languages. In addition to the social and cultural benefits of IDNs, they also represent a significant economic opportunity a recent report commissioned by the Universal Acceptance Steering Group (UASG) found that online spending from new IDN users could start at USD 6.2 billion per year. The UASG&rsquos mission is to help software developers and website owners keep pace with the evolving Domain Name System (DNS) &ndash and this includes issues around the adoption and acceptance of IDNs. If you&rsquod like to get involved in helping work toward a solution to this and other IDN-related issues, please visit https://uasg.tech/ or get in touch to learn more. [1] Exceptions are practiced for languages with established orthographies and conventions that require the commingled use of multiple scripts, e.g. the Japanese writing system . Do not Remove:[HID]20170425182821379[-HID]

9 13

IDN guidelines comment
by Vittorio Bertola April 26, 2017

April 26, 2017

Hi all, I'd like to share the comment that we sent to ICANN's ongoing IDN guidelines consultation (closing on May 2): http://mm.icann.org/pipermail/comments-idn-guidelines-03mar17/2017-April/00… It would be good if others who think the same way could submit similar comments :-) Regards, -- Vittorio Bertola Research & Innovation Engineer Cell: +39 348 7015022 Skype: in-skype-ox(a)bertola.eu Email: vittorio.bertola(a)open-xchange.com mailto:vittorio.bertola@open-xchange.com Twitter: @openexchange http://twitter.com/openexchange - Facebook: OpenXchange https://www.facebook.com/OpenXchange - Web: www.open-xchange.com http://www.open-xchange.com Open-Xchange AG, Rollnerstr. 14, 90408 Nuremberg, District Court Nuremberg HRB 24738 Managing Board: Rafael Laguna de la Vera, Carsten Dirks, Uwe Reumuth Chairman of the Board: Richard Seibt European Office: Open-Xchange GmbH, Olper Huette 5f, D-57462 Olpe, Germany, District Court Siegen, HRB 8718 Managing Directors: Frank Hoberg, Martin Kauss US Office: Open-Xchange. Inc., 530 Lytton Avenue, Palo Alto, CA 94301, USA Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.

4 3

Mail Send / Receive Tool ( https://eai.xgenplus.com/ )
by Dr. AJAY D A T A April 26, 2017

April 26, 2017

Dear All,Try out https://eai.xgenplus.com/MailDeliveryTest.jsp for sending and receiving email from your ascii/EAI enabled server to other EAI / ASCII email account. Just to make the life bit easier. To ensure whether emails are getting delivered and received at recipient mail box. This tool we used while developing the EAI platform, now made it available for everyone. Regards Dr. Ajay DATA | Founder &amp CEO Get email id like अजय(a)xn--c2bd1gb.xn--h2brj9c in your own language,visit www.xgenplus.com Do not Remove: [HID]20170426161241503[-HID]

1 0

News on Indic - Indian languages crosses English users
by Dr. AJAY D A T A April 26, 2017

April 26, 2017

Sharing insights from the joint report "Indian Languages- Defining India`s Internet by Google and KPMG India, Rajan Anandan, VP, India &amp South East Asia, Google, said that most important aspect of making the web more useful and meaningful for all of India is to make India`s Internet more representative of the India we live in. India today has 234 million Indian language users who`re online, compared to 175 Million English web users, we expect another 600 million Indian language users to come online in the next four years. With today`s launches, we are taking a huge step forward to being down the barriers that stop Indian language users to get results out of the internet and also help the industry to solve for the needs of billion Indians."Read more at: http://www.oneindia.com/india/googles-indian-bonanza-support-to-22-indian-l… Do not Remove: [HID]20170425182821379[-HID]

1 0

Re: [UA-discuss] UASG Response to WordFence IDN Phishing concerns
by Tan Tanaka, Dennis April 25, 2017

April 25, 2017

Don, my comments enclosed Thanks -Dennis From: <ua-discuss-bounces(a)icann.org> on behalf of Don Hollander <don.hollander(a)icann.org> Date: Monday, April 24, 2017 at 5:40 PM To: "UA-discuss(a)icann.org" <ua-discuss(a)icann.org> Subject: [EXTERNAL] [UA-discuss] UASG Response to WordFence IDN Phishing concerns Further to recent discussion on this list, we have drafted a document that we plan on posting as a Blog Post to the UASG Web site that can be referenced by others. We want to get feedback from the community on this document by Thursday UTC. So, here it is – pasted below and as a word document in case you want to enable tracking and make amendments. If you have comments or suggestions, please share them to this group. Don IDNs and Phishing: What You Need to Know By TBD at UASG Internationalized Domain Names<https://www.icann.org/resources/pages/idn-2012-02-25-en> (IDNs) are growing in popularity, a testament to their role in the expansion of the global Internet and the value they provide in connecting non-English speakers to the Web. However, you may have noticed a renewed focus over the past week of a script mixing technique that phishing scammers could potentially use to trick Internet users into visiting malicious websites. This phishing method takes advantage of the fact that characters from various languages and scripts are sometimes visually similar to each other. For example, the Cyrillic “а” and the ASCII<https://en.wikipedia.org/wiki/ASCII> “a” look virtually identical. This technique is known as a homograph attack. Homographic phishing efforts associated with IDNs are not new. In fact, they date back to the early 2000s. Registries have since implemented policies that preclude mixing scripts[1] within a domain name label. While this issue should be taken seriously and serves as an important reminder of consumer safety, various IDN and anti-abuse groups are actively working to mitigate potential threats, and there are already certain browser-set protections in place. In the meantime, Internet users should practice the same basic security hygiene that is always recommended: avoid clicking suspicious links, and use a good password manager that will only enter login credentials on trusted sites. Equally important is to recognize the benefits of IDNs and avoid disabling them, which could lead to an unpredictable user experience and eventually a decrease in adoption. IDNs are essential in bringing non-English speakers – the majority of the world’s population – online, and allowing those users to create their own highly relevant online identities as well as navigate the Internet in their native languages. In addition to the social and cultural benefits of IDNs, they also represent a significant economic opportunity; a recent report<https://uasg.tech/whitepaper/> commissioned by the Universal Acceptance Steering Group (UASG) found that online spending from new IDN users could start at USD 6.2 billion per year. The UASG’s mission is to help software developers and website owners keep pace with the evolving Domain Name System (DNS) – and this includes issues around the adoption and acceptance of IDNs. If you’d like to get involved in helping work toward a solution to this and other IDN-related issues, please visit https://uasg.tech/ or get in touch<https://uasg.tech/contact/> to learn more. ________________________________ ________________________________ [1] Exceptions are practiced for languages with established orthographies and conventions that require the commingled use of multiple scripts, e.g. the Japanese writing system.

1 0