Security Concern When Implementing Unicode

The Unicode Consortium has a draft paper up about security considersations when implementing Unicode.  Good reading for testers and developers alike.

There are many potential problems, the most prominent being International Domain Name (IDN) spoofing.  In this attack, a malicious user sets up a site at a domain name using Unicode characters that look nearly (or completely - this could depend on the font your browser uses) to an existing site.  They then go phishing.  The average users is completely lost as their address bar is displaying an apparently perfect URL.

Once again, thanks to Bruce Schneier for the heads up.