Whit Diffie does the Can Can

In Not so sunny for Whit Diffie I briefly posted on his unexpected exit from Sun soon after their acquisition by Oracle, and taking up a visiting academic position in the UK. Computerworld recently reported that Diffie has now landed a new position as vice president at ICANN, managing the security of their networks. 

It seems he was just a bit too late to give his blessing to the recent commissioning of DNSSEC on each of the 13 authoritative names servers of the Internet. However there will be a formal key ceremony in June which may require a cryptographic high priest, or he may yet bag one of the coveted 14 crypto officers roles, to whom key recovery shares will be entrusted. 

He also does a good impression of Gandalf the Brown.

Related articles by Zemanta

• Diffie Named ICANN VP, Information Security and Cryptography (infosecurity.us)
• Encryption guru joins Icann (v3.co.uk)
• ICANN Hires Cryptography Pioneer (techdailydose.nationaljournal.com)

Phishing and scamming in the new Top Level Domains

Earlier this month was the historic event of non-Latin domain names being introduced on the Internet by ICANN. While half the global internet population does not have a Latin language as their mother tongue, sites can now have Arabic names for example and eventually Chinese, Thai and Tamil.

At the blog of security company Sûnnet Beskerming they have a post which points out some security risks associated with the new non-Latin names

A risk, which isn't immediately obvious, is that this opens up a new world of opportunity for scammers and phishers to register domains that will visually appear very similar to legitimate sites in the address bar, but which will have a base address significantly different, thanks to being registered in a non-Latin script. By relying on alternate character rendering, this could cause problems for users who may not be able to determine the slight differences between otherwise similar looking characters. It also means that software and tools designed to help detect phishing or XSS attacks will have to expand their repertoire significantly to interpret and assess a much broader range of character and rendering sets.

The opportunities for typosquatting will probably multiply, and the Register recently reported this market to be worth almost half a billion dollars annually now. You can read more about this market in Measuring Typosquatting Perpetrators and Funders by Tyler Moore from Cambridge University.