Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

[Dave Crocker <[e-mail]>]

Thanks for the quick feedback.

some additional thoughts...


On 7/6/2013 11:18 AM, Matt Simerson wrote:
>>     A cousin domain is a registered domain name that is deceptively
>> similar to a target domain name.  The target domain is *usually
>> *familiar to many end-users, and therefore imparts a degree of trust.
>>  The deceptive similarity can trick the user by embedding the
>> essential parts of the target name, in a new string, or it can use
>> some variant of the target name, such as replacing 'i' with '1'.
>
> I inserted the word 'usually'.

That's a kind of careful phrasing that makes sense for precise 
specification, but I think is actually distracting for the usage here.

That is, I think that extra qualifiers in definitions are, ummmm... 
usually distracting...

It's not that it's wrong; it's that I doubt it's as helpful as we'd like.


> In addition to providing basic examples, perhaps include the well
> defined and recognized terms: typosquatting, and IDN homographs?
>
> https://en.wikipedia.org/wiki/Typosquatting
> https://en.wikipedia.org/wiki/IDN_homograph_attack

yeah, and probably cite the dhs.gov text, to show some history to the 
key phrase.

d/


-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net