> The basic attack: Alice runs on host that uses Latin-1 for > input/output and enters www.µbank.com (where µ is 8859-1 0xB5). The > domain is registered using U+00B5, but Alice's application transcode > the string using U+03BC. Either Alice can't connect (if the other > domain doesn't exist) or she ends up talking to someone else (if the > other domain does exist).
I'm sorry, but your example doesn't work. In nameprep, when doing Unicode Normalization, U+00B5 is mapped to U+03BC. So these will be the same domain name, and have the same ACE label. roozbeh
