Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

[Matt Simerson <[e-mail]>]

On Jul 6, 2013, at 11:41 AM, Dave Crocker <[e-mail]> wrote:

> On 7/6/2013 11:18 AM, Matt Simerson wrote:
>>>    A cousin domain is a registered domain name that is deceptively
>>> similar to a target domain name.  <snip> The deceptive similarity can trick the user by embedding the
>>> essential parts of the target name, in a new string, or it can use
>>> some variant of the target name, such as replacing 'i' with '1'.
>> 
>> I inserted the word 'usually'.
> 
> That's a kind of careful phrasing that makes sense for precise specification, but I think is actually distracting for the usage here.
> 
> That is, I think that extra qualifiers in definitions are, ummmm... usually distracting...
> 
> It's not that it's wrong; it's that I doubt it's as helpful as we'd like.

Why not remove the domain familiarity part entirely? The essence of a cousin domain is not in the victims familiarity with the target domain name (which is less common than technophiles would hope) but in the victims familiarity with the organizational name in the domain.

Matt