Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

I don't think it is just that the target domain is familiar to the users under attack. It is the "brand identity". That is, the users under attack may be familiar with the brand but not necessarily familiar with the exact domain that the brand/organization uses.

Mike

> -----Original Message-----
> From: dmarc-bounces@ietf.org [mailto:dmarc-bounces@ietf.org] On Behalf
> Of Elizabeth Zwicky
> Sent: Saturday, July 06, 2013 2:52 PM
> To: Dave Crocker; Matt Simerson
> Cc: SM; dmarc@ietf.org; Murray S. Kucherawy; Eliot Lear
> Subject: Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's
> review of the DMARC spec)
> 
> 
> I would say that the target domain is familiar to the users under attack.
> 
> 	Elizabeth
> 
> On 7/6/13 11:41 AM, "Dave Crocker" <dcrocker@gmail.com> wrote:
> 
> >Thanks for the quick feedback.
> >
> >some additional thoughts...
> >
> >
> >On 7/6/2013 11:18 AM, Matt Simerson wrote:
> >>>     A cousin domain is a registered domain name that is deceptively
> >>> similar to a target domain name.  The target domain is *usually
> >>> *familiar to many end-users, and therefore imparts a degree of trust.
> >>>  The deceptive similarity can trick the user by embedding the
> >>> essential parts of the target name, in a new string, or it can use
> >>> some variant of the target name, such as replacing 'i' with '1'.
> >>
> >> I inserted the word 'usually'.
> >
> >That's a kind of careful phrasing that makes sense for precise
> >specification, but I think is actually distracting for the usage here.
> >
> >That is, I think that extra qualifiers in definitions are, ummmm...
> >usually distracting...
> >
> >It's not that it's wrong; it's that I doubt it's as helpful as we'd like.
> >
> >
> >> In addition to providing basic examples, perhaps include the well
> >> defined and recognized terms: typosquatting, and IDN homographs?
> >>
> >> https://en.wikipedia.org/wiki/Typosquatting
> >> https://en.wikipedia.org/wiki/IDN_homograph_attack
> >
> >yeah, and probably cite the dhs.gov text, to show some history to the
> >key phrase.
> >
> >d/
> >
> >
> >--
> >Dave Crocker
> >Brandenburg InternetWorking
> >bbiw.net
> >_______________________________________________
> >dmarc mailing list
> >dmarc@ietf.org
> >https://www.ietf.org/mailman/listinfo/dmarc
> 
> _______________________________________________
> dmarc mailing list
> dmarc@ietf.org
> https://www.ietf.org/mailman/listinfo/dmarc