Re: [dmarc-ietf] cousin domain definition (was Re: Fwd: Eliot's review of the DMARC spec)

[Matt Simerson <[e-mail]>]

On Jul 7, 2013, at 12:25 AM, "Murray S. Kucherawy" <[e-mail]> wrote:

> How's this, if you'll pardon the XML?
> 
>                     <t hangText="Cousin Domain:"> A registered domain name that   
>                         is deceptively similar to a target name, which can be a   
>                         domain name or the name of a known entity.  The entity target
>                         name is familiar to many end-users, and therefore 
>                         imparts a degree of trust.  The deceptive similarity can  
>                         trick the user by embedding the essential parts of the    
>                         target entity name in a new string (e.g., 
>                         "companysecurity.example" to attack "company.example"),  
>                         or it can use some variant of the target entity name, such as    
>                         replacing 'i' with '1'.  This latter form is sometimes    
>                         known as a "homograph attack".  </t>                      

I simplified the description by removing the 'target' abstraction. There are legitimate purposes for cousin domains, such as helping poor spellers and heading off typosquatting. 

I don't think the distinction of end-users is helpful. It implies that some class of users are not susceptible to cousin domain attacks. There's ample evidence that is not the case. 

Matt