Re: [Idna-update] emoji and security

[John C Klensin <[e-mail]>]

--On Monday, March 12, 2018 09:48 -0700 Asmus Freytag
<[e-mail]> wrote:

> All,
> 
> there's a general consensus that emoji and secure IDNs do not
> go together.
> 
> This is clearly not something that's taken for granted by
> others.

Possibly true, but your example below has nothing to do with the
issue.

> Read down a few messages in this thread on the Unicode list:

> https://www.unicode.org/mail-arch/unicode-ml/y2018-m03/0075.ht
> ml

> to find the suggestion of translating security hash codes into
> strings of emoji ostensible for easier verification:
 
> "So that makes me wonder which one would be quicker for a
> human to verify on average? Also, which one is more accurate
> for a human to verify? I have no idea. For accuracy, it seems
> like a lot of thought was put into the visual uniqueness of
> Unicode emojis. "

> Discuss.

First, whether emoji are a good idea for encoding hashes or not
has nothing to do with whether they are appropriate for domain
names.  My guess is that they are not as useful for encoding
hashes as the messages I look at seem to believe until and
unless (1) the presentation forms for the various emoji code
points are standardized sufficiently that they differ no more
from one platform to the next than conventional, not extremely
artistic, type styles do for modern letter or digit display
forms and (2) names of emoji and emoji sequences in popular use
are standardized sufficiently that text to speech programs
pronounce (or describe) them in ways that are consistent across
platforms.  Whether that hypothesis is correct or not, I would
encourage those who are interested in the question of how easily
one string of emoji can be compared to each other to find and
real Herman Chernoff's original "faces" paper about the
representation of multidimensional data.  

However, those are just my not-very-educated guesses.  As far as
IDNs and this discussion is concerned, the bottom line is that
the are Invalid for use in domain and that, IMO, those who are
anxious to see IANA's tables updated to Unicode 10 or 11 in the
relatively near future should probably understand that, with the
current level of activity and enthusiasm in the IETF for i18n
work generally and IDN work in particular, the last thing they
wand to do is to get the table update effort blocks behind a
substantive IDNA revision.

More important, I agree with Patrik that people are, once again,
confusing his three-way distinction among IETF work, ICANN
policy work, and compliance issues and my earlier,
not-quite-orthogonal, earlier distinction among protocol (DNS
and IDNA) constraints, general guidance about how policies
should be developed about registration in arbitrary zones, and
ICANN policies for the root.  If people want to make progress, I
think it would be helpful to have those distinctions more
strongly in mind... and to avoid the emoji and non-IDN uses of
code points issue entirely except as compliance issues that are
probably discussed in ICANN, legal, and regulatory contexts
rather than here.

best,
   john