[dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

[Dave Crocker <[e-mail]>]

On 7/5/2013 1:34 AM, Murray S. Kucherawy wrote:
> On Thu, May 23, 2013 at 2:55 AM, SM <[e-mail]
> <mailto:[e-mail]>> wrote:
>     The terminology section mentions terms such as "cousin domains",
>     "domain owner", etc.  Although such terms may be popular I don't
>     think that it is a good idea to use them in a protocol document as
>     they can be ambiguous.
>
>
> Can you make other suggestions?  I think the first one is not ambiguous
> in general, but we're very clear on defining and using the second.

I'm astonished to discover that google does not readily produce major 
listings of a definition of cousin domain. (Interestingly, the dmarc 
base draft showed up pretty high in the search...)

Anyhow, I think that means a) we have to create our own definition, and 
b) it's worth being fairly careful about the text of the definition, 
since there's a chance it will become popular...


First listing I found strikes me as logical but wholly inadequate, in 
terms of interesting attacks:

      http://www.informit.com/articles/article.aspx?p=1190114

      "we defined a cousin domain name as one that contains the 
candidate domain name in its entirety, with additional words either 
prefixed or appended to the candidate domain name."


A squib from the book gets the idea, but isn't quite sufficient as a 
'definition':

      Phishing and Countermeasures: Understanding the Increasing Problem
      of ...;  edited by Markus Jakobsson, Steven Myers

      "phisher regisers a domain name similar to the targeted domain, 
such as 'commerceflaw.com' instead of 'commerceflow.com'."

A variant of this one shows up in a dhs.gov document:

      http://www.cyber.st.dhs.gov/docs/phishing-dhs-report.pdf

      "domain name controlled by a phisher that isdeceptively similar to
       a legitimate domain name, such as
       www.commerceflowsecurity.cominstead of www.commerceflow.com."


So in looking these over, I find myself liking the phrase "deceptively 
similar".  Hence I'll propose:

      A cousin domain is a registered domain name that is deceptively 
similar to a target domain name.  The target domain is familiar to many 
end-users, and therefore imparts a degree of trust.  The deceptive 
similarity can trick the user by embedding the essential parts of the 
target name, in a new string, or it can use some variant of the target 
name, such as replacing 'i' with '1'.


d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net