Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

The International Domain Name mitigation API's are available here for download:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad6158d7-ddba-416a-9109-07607425a815&displaylang=en

Has anyone used them since they were first published in 2006? Are there any pending updates to them (I can't find a MSFT connect site for these)?

Lastly, is anyone aware of a .NET wrapper, or any .NET samples for this library?

share|improve this question
3  
Definitely on topic: This library has "several API functions specifically intended to allow applications to mitigate some of the security risks presented by this technology" – makerofthings7 Dec 6 '10 at 17:27
agreed, this question seems on topic to me. – Graham Lee Dec 7 '10 at 16:52

1 Answer

up vote 3 down vote

1) Microsoft's API's are limited in scope of protection. And no a .NET wrapper does not exist. The IDN mitigation API's are limited to conversions between IDN and ASCII (punycode) and providing some rudimentary checking of mixed script as a security precaution.

2) Something like http://www.casaba.com/products/UCAPI/ will provide more significant detection of string confusability including the presence of confusable characters in IDN. This API also allows for comparison of two strings such as:

IsStringConfusable(source, DetectionMethods)
AreStringsConfusable(source, target, DetectionMethods)

UCAPI does have a .NET API but it's neither public nor open source.

3) An open source alternative would be ICU at http://www.icu-project.org/ which includes an API also for detecting confusables similar to UCAPI above. However ICU is C, C++, and Java only.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.