Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

[Matt Simerson <[e-mail]>]

On Jul 6, 2013, at 10:50 AM, Dave Crocker <[e-mail]> wrote:

> On 7/5/2013 1:34 AM, Murray S. Kucherawy wrote:
>> On Thu, May 23, 2013 at 2:55 AM, SM <[e-mail]
>> <mailto:[e-mail]>> wrote:
>>    The terminology section mentions terms such as "cousin domains",
>>    "domain owner", etc.  Although such terms may be popular I don't
>>    think that it is a good idea to use them in a protocol document as
>>    they can be ambiguous.
>> 
>> Can you make other suggestions?  I think the first one is not ambiguous
>> in general, but we're very clear on defining and using the second.
> 
> IAnyhow, I think that means a) we have to create our own definition, and b) it's worth being fairly careful about the text of the definition, since there's a chance it will become popular...

+1

> So in looking these over, I find myself liking the phrase "deceptively similar".

+1

> Hence I'll propose:
> 
>     A cousin domain is a registered domain name that is deceptively similar to a target domain name.  The target domain is usually familiar to many end-users, and therefore imparts a degree of trust.  The deceptive similarity can trick the user by embedding the essential parts of the target name, in a new string, or it can use some variant of the target name, such as replacing 'i' with '1'.

I inserted the word 'usually'. 

In addition to providing basic examples, perhaps include the well defined and recognized terms: typosquatting, and IDN homographs?

https://en.wikipedia.org/wiki/Typosquatting
https://en.wikipedia.org/wiki/IDN_homograph_attack

Matt