Je cite cette dernière RFC : To help prevent confusion between characters that are visually similar, it is suggested that implementations provide visual indications where a domain name contains multiple scripts. Such mechanisms can also be used to show when a name contains a mixture of simplified and traditional Chinese characters, or to distinguish zero and one from O and l. DNS zone adminstrators may impose restrictions (subject to the limitations in section 2) that try to minimize homographs.
Et la partie du blog sur Verisign : Even though we have been asking Verisign registry to implement RFC 3743 (aka JET Guidelines) or to follow ICANN IDN Guidelines (specifically on language tag) for many years, they have not done so, and instead opt to allow any IDN strings to be registered.
lamentable non ?
Surtout que apparemment (toujours sur le même article), la "faille" des IDN est connue depuis... 2002.
[^] # Re: Tous sauf IE...
Posté par iznogoud . En réponse au journal 01info, mon amour. Évalué à 8.
à propos de la RFC3743 sur les IDN :
http://james.seng.cc/archives/000347.html(...)
à propos de Verisign (encore eux) qui refusent de respecter la RFC3490 :
http://james.seng.cc/archives/2005/02/08/idn_and_homographs_spoofin(...)
Je cite cette dernière RFC :
To help prevent confusion between characters that are visually similar, it is suggested that implementations provide visual indications where a domain name contains multiple scripts. Such mechanisms can also be used to show when a name contains a mixture of simplified and traditional Chinese characters, or to distinguish zero and one from O and l. DNS zone adminstrators may impose restrictions (subject to the limitations in section 2) that try to minimize homographs.
Et la partie du blog sur Verisign :
Even though we have been asking Verisign registry to implement RFC 3743 (aka JET Guidelines) or to follow ICANN IDN Guidelines (specifically on language tag) for many years, they have not done so, and instead opt to allow any IDN strings to be registered.
lamentable non ?
Surtout que apparemment (toujours sur le même article), la "faille" des IDN est connue depuis... 2002.