Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

[Elizabeth Zwicky <[e-mail]>]

I would say that the target domain is familiar to the users under attack.

	Elizabeth

On 7/6/13 11:41 AM, "Dave Crocker" <[e-mail]> wrote:

>Thanks for the quick feedback.
>
>some additional thoughts...
>
>
>On 7/6/2013 11:18 AM, Matt Simerson wrote:
>>>     A cousin domain is a registered domain name that is deceptively
>>> similar to a target domain name.  The target domain is *usually
>>> *familiar to many end-users, and therefore imparts a degree of trust.
>>>  The deceptive similarity can trick the user by embedding the
>>> essential parts of the target name, in a new string, or it can use
>>> some variant of the target name, such as replacing 'i' with '1'.
>>
>> I inserted the word 'usually'.
>
>That's a kind of careful phrasing that makes sense for precise
>specification, but I think is actually distracting for the usage here.
>
>That is, I think that extra qualifiers in definitions are, ummmm...
>usually distracting...
>
>It's not that it's wrong; it's that I doubt it's as helpful as we'd like.
>
>
>> In addition to providing basic examples, perhaps include the well
>> defined and recognized terms: typosquatting, and IDN homographs?
>>
>> https://en.wikipedia.org/wiki/Typosquatting
>> https://en.wikipedia.org/wiki/IDN_homograph_attack
>
>yeah, and probably cite the dhs.gov text, to show some history to the
>key phrase.
>
>d/
>
>
>-- 
>Dave Crocker
>Brandenburg InternetWorking
>bbiw.net
>_______________________________________________
>dmarc mailing list
>[e-mail]
>https://www.ietf.org/mailman/listinfo/dmarc