Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

[Dave Crocker <[e-mail]>]

On 7/7/2013 7:27 PM, Matt Simerson wrote:
> <t hangText="Cousin Domain:"> A registered domain name that
>                         is deceptively similar the name of a known entity.  The entity
>                         name is familiar to users and therefore
>                         imparts a degree of trust.  The deceptive similarity can
>                         trick the user by embedding the essential parts of the
>                         entity name in a new string (e.g.,
>                         "companysecurity.example" to attack "company.example"),
>                         or it can use some variant of the entity name, such as
>                         replacing 'i' with '1'.  This latter form is sometimes
>                         known as a "homograph attack". </t>
>
> On Jul 7, 2013, at 7:25 PM, Matt Simerson <[e-mail]> wrote:
>> On Jul 7, 2013, at 12:25 AM, "Murray S. Kucherawy" <[e-mail]> wrote:
>>> How's this, if you'll pardon the XML?
>> I simplified the description by removing the 'target' abstraction. There are legitimate purposes for cousin domains, such as helping poor spellers and heading off typosquatting.
>>
>> I don't think the distinction of end-users is helpful. It implies that some class of users are not susceptible to cousin domain attacks. There's ample evidence that is not the case.


I think the distinction between domain names and other kinds of names 
can be useful to make explicitly.  The use of 'target' is needed for 
referential disambiguation between the attacker's domain name and the 
one that is the basis for the attack.  However I do think "end-" isn't 
as helpful as I had intended; so 'users' should suffice.

Hence a few more tweaks:

<t hangText="Cousin Domain:"> A registered domain name that is
      deceptively similar to a target domain name or other name of a
      known entity.  The target name is familiar to many users, and
      therefore imparts a degree of trust.  The deceptive similarity can
      trick the user by embedding the essential parts of the target name
      in a new string (such as, "companysecurity.example" to attack
      "company.example"), or it can use some variant of the target name,
      such as replacing 'i' with '1', which is known as a "homograph
      attack".  </t>


d/
-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net