Translation of Domainnames with ä ü ö etc. about deltachat-android HOT 4 CLOSED

Where are domain names translated?

The general conclusion seems to depreciate "punnycode" international domain names.
https://stackoverflow.com/questions/7497468/can-punycode-encoded-email-addresses-clash-with-real-addresses
http://rant.gulbrandsen.priv.no/eai/utf8-punycode
And a search for "punnycode security" brings up many reasons to disable it by default. At least in browsers.

from deltachat-android.

can you provide an example? I am not sure I understand where the problem occurs.

from deltachat-android.

According to the last link messages including headers can be UTF8, but domain names can not, they need to be in punny-code. (special characters are translated into something like xn--code)

The last paragraph says to use UTF8 everywhere internally, and to only translate before sending (outgoing).

BUT (IIUC) the spoofing problem comes in when translating incoming punny domains (what r10s seems to refer to above), because there are multiple punnycode domains that look the same for the user.

Thus, also keeping the domain part as non-ambiguous punny-code for reference internally and use it to assign incoming messages to the right chat (possibly also displaying in the contact details), also seems safer (prevents others to spoof). (And, do not translate local parts to always stay unambiguous and prevent mis-addressing and spoofing.)

from deltachat-android.

moved to deltachat/deltachat-core#264

from deltachat-android.