Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

["Murray S. Kucherawy" <[e-mail]>]

On Sat, Jul 6, 2013 at 11:04 PM, Murray S. Kucherawy <[e-mail]>wrote:

> On Sat, Jul 6, 2013 at 10:50 AM, Dave Crocker <[e-mail]> wrote:
>
>> So in looking these over, I find myself liking the phrase "deceptively
>> similar".  Hence I'll propose:
>>
>>      A cousin domain is a registered domain name that is deceptively
>> similar to a target domain name.  The target domain is familiar to many
>> end-users, and therefore imparts a degree of trust.  The deceptive
>> similarity can trick the user by embedding the essential parts of the
>> target name, in a new string, or it can use some variant of the target
>> name, such as replacing 'i' with '1'.
>>
>>
> Seems a reasonable starting point.  Might also include a reference to
> "homograph (literally, one appearance) attack".
>
>
How's this, if you'll pardon the XML?

                    <t hangText="Cousin Domain:"> A registered domain name
that
                        is deceptively similar to a target name, which can
be a
                        domain name or the name of a known entity.  The
target
                        name is familiar to many end-users, and therefore
                        imparts a degree of trust.  The deceptive
similarity can
                        trick the user by embedding the essential parts of
the
                        target name in a new string (e.g.,
                        "companysecurity.example" to attack
"company.example"),
                        or it can use some variant of the target name, such
as
                        replacing 'i' with '1'.  This latter form is
sometimes
                        known as a "homograph attack".
</t>