Re: [Lucid] FW: [[e-mail]: Re: Non-normalizable diacritics - new property]

[Andrew Sullivan <[e-mail]>]

On Thu, Mar 19, 2015 at 06:29:06PM +0000, Shawn Steele wrote:

> This discussion seems to be about lots of things, but "reasonably mnemonic" would limit the problem hugely.  That implies that I can see it and remember what it was to type it later.  However that scenario doesn't hit any of the security concerns being raised as I'm going to type it using the appropriate keyboard for my language.

No, because it's reasonably mnemonic _for someone_, not for everyone.
You're assuming that localization is the only relevant parameter, but
it's not: the problem with identifiers for Internet-wide use is that
they're supposed to be both internationalized and localized at the
same time. 

For instance, CAs are supposed to be doing validation on these names
and nailing them to organizations.  We've already had problems with
invalid issuance of certificates (as you may be aware, since your
apparent employer has been one of the targets), and this issue opens
that door more widely.  CAs are not going to be experts in every
writing system, and the same-script registration rules won't help
anything here because they're ineffective.

Similar issues might be expected for other kinds of identifiers in
Internet-scope use.

I think if you read the I-D carefully, you'll discover that this point
is made in section 3.1.

> That's digressing from my point.  I was trying to say that, if we consider the problem without any human factors, we already have unique IDs.

And as I said before, this is tautologically true or false, depending
on what you mean by "ID".  It seems you're devoted to "tautologically
true", but I fail to understand why you think that's a remotely
interesting point in this discussion.  Everyone already agrees that
there's a human factors issue here.

> Fix that, and then we can talk about whether it's worth fixing a couple esoteric code points.  There are FAR easier exploits for any serious attacker to attack.

"There is that problem over there, so this problem isn't worth
fixing."  I'm not suggesting that the other problem is not an issue,
but this one turns out to be an in-principle misunderstanding on the
part of the IETF about how it was going to construct internationalized
identifiers.  In principle misunderstandings are the sort of things
that one must address (even to conclude "not worth fixing") if one is
going to write protocols that are worth anything at all.

Best regards,

A

-- 
Andrew Sullivan
[e-mail]