Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The International Domain Name mitigation API's are available here for download.

Has anyone used them since they were first published in 2006? Are there any pending updates to them (I can't find a MSFT connect site for these)?

Lastly, is anyone aware of a .NET wrapper, or any .NET samples for this library?

share|improve this question
Definitely on topic: This library has "several API functions specifically intended to allow applications to mitigate some of the security risks presented by this technology" – LamonteCristo Dec 6 '10 at 17:27
agreed, this question seems on topic to me. – user185 Dec 7 '10 at 16:52

1) Microsoft's API's are limited in scope of protection. And no a .NET wrapper does not exist. The IDN mitigation API's are limited to conversions between IDN and ASCII (punycode) and providing some rudimentary checking of mixed script as a security precaution.

2) Something like will provide more significant detection of string confusability including the presence of confusable characters in IDN. This API also allows for comparison of two strings such as:

IsStringConfusable(source, DetectionMethods)
AreStringsConfusable(source, target, DetectionMethods)

UCAPI does have a .NET API but it's neither public nor open source.

3) An open source alternative would be ICU at which includes an API also for detecting confusables similar to UCAPI above. However ICU is C, C++, and Java only.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.