Re: [Idna-update] emoji and security

[Michel Suignard <[e-mail]>]

PS: the reason I forwarded this is that many people find something
familiar and  accessible about emoji and will not understand why there
should be more security concerns about them than about a bunch
of bewilderingly similar and complex Chinese ideographs or a bunch
of "dawn-of-time-emoji" aka Hieroglyphics, both of which are PVALID.
I could not resist commenting on this, because unlike emoji, Egyptian Hieroglyphs, while looking often like colorful pictures, are the expression of a fully formed writing system with ideograms and phonograms and all the usual attributes of such a system in term of sentence structure. Jokingly I have sometimes said that doom would be near if people realized that you could mix Emoji with hieroglyphs and result in a fully formed writing system.

Jokes aside, the 100s Egyptian hieroglyphs contains hundreds of semantic and phonetic variants and are totally unsuited for any identifier usage and are still fully IDN 2008 PVALID (unless of course you limit the scope using variant sets). And to make matter worse, there is a plan to add few more thousands to cover Ptolemaic era (which would all become PVALID as well if the synchronization is re-enabled). At the same time, we are quite careful at not encoding Hieroglyphs homoglyphs (still most people would not know the difference). (Saying ‘we’ because I am the author of one of these extensions proposal).

Finally, I share many of Asmus’s considerations on the status of IDNA and lack of synchronization with Unicode (we are both on the ICANN Integration Panel, so we do a lot of LGR work together). I am currently at ICANN 61 with some decent free time and willing to do something to make progress.

Best

Michel

From: IDNA-UPDATE <[e-mail]> On Behalf Of Asmus Freytag
Sent: Monday, March 12, 2018 9:48 AM
To: [e-mail]
Subject: [Idna-update] emoji and security


All,

there's a general consensus that emoji and secure IDNs do not go together.

This is clearly not something that's taken for granted by others.

Read down a few messages in this thread on the Unicode list:

https://www.unicode.org/mail-arch/unicode-ml/y2018-m03/0075.html

to find the suggestion of translating security hash codes into strings
of emoji ostensible for easier verification:

"So that makes
me wonder which one would be quicker for a human to verify on average?
Also, which one is more accurate for a human to verify? I have no idea. For
accuracy, it seems like a lot of thought was put into the visual uniqueness
of Unicode emojis. "

Discuss.

A./

PS: the reason I forwarded this is that many people find something
familiar and  accessible about emoji and will not understand why there
should be more security concerns about them than about a bunch
of bewilderingly similar and complex Chinese ideographs or a bunch
of "dawn-of-time-emoji" aka Hieroglyphics, both of which are PVALID.