Opera addressed the IDN spoofing issue with a number of changes:
In 8.0 beta 2, they introduced a whitelist of TLDs that they consider safe because they appear to have good policies in place: no, jp, de, se, kr, tw, cn, at, dk, ch, and li. TLDs not on this list have their domain labels checked for characters outside Latin-1 (ISO 8859-1, Unicodes up to U+00FF). If there are characters outside Latin-1, the label is displayed in Punycode.
In 8.0 beta 3, they added hu and museum to the TLD whitelist, and they allowed the user to switch to a blacklist using the tilde (~), e.g. ~:com:tw:. The character checking now allows a single script or specific script combinations in each domain label or sublabel, separated by dot (.) and hyphen (-). This allows e.g. xml-ccccccc where xml is ASCII and cccccc is the Russian word for "documents" in Cyrillic (I think).
I have added links to Opera's 8.0 beta 2 and 3 release notes and IDN Security Advisory to my Related Work section:
http://nameprep.org/#related-work
Another idea that I mentioned a while ago in a couple of forums is to check for characters used in the user's languages, which can be found in the browser localization and HTTP Accept-Language list. There are many different ways to display these labels, e.g. Punycode for labels with characters outside the user's languages. Another idea is to use pale green for characters in the user's main language, pale yellow for those in the user's secondary languages, and pale red for characters outside those languages. These colors are based on traffic lights.
James Seng wrote:
now, do we want to standard "this" or do we want apps people to continue to evolve the mechanism to deal with spoofing? i prefer the latter.
I agree that the IETF should not standardize these types of UI policies, though it might be a good idea to have some recommendations in an informative appendix or something.
However, the IETF may wish to consider standardizing a limited set of characters in IDN. For example, we may wish to extend RFC 952's host name rules (LDH = Letters, Digits and Hyphen) to a Unicode equivalent, thereby disallowing such characters as the slash homographs (e.g. math symbol for division).
As I wrote this email, Mark Davis sent a very relevant email to the Unicode list:
http://www.unicode.org/mail-arch/
Click the first link, user unicode-ml, password unicode.
Erik
