Proposal: High-legibility fonts requirement

Fairly self-explanatory, branch off from #3338 and more specifically first mention here.

Draft requirement:

Verify that fonts used to display user-provided data are highly legible, as to resist visual spoofing through lookalike characters. This also applies to e-mail templates and printer device output.

And if appropriate, supplementary section guidance text:

User-provided text can be leveraged for phishing and similar methods for fraud. Attackers often exploit lookalike characters such as the letter O and the digit 0, or combinations such as "rn" mimicking the letter "m". While this is especially common with hyperlinks, visual spoofing attacks are not limited to functional elements and applications should account for that. The Sans-serif family of fonts is typically a safe choice for limiting the potential for exploitation.

I kind of wish to also mention the WCAG as a natural overlap, since symbiosis with other standards usually benefits security indirectly. I fear that it's getting too detailed already though.

Thoughts?

Start by reading issue #3338 and the linked first mention, then compare the draft requirement and guidance here with the WCAG standards. Done means reaching agreement on the wording and scope, including e-mail templates and printer output, and incorporating the accepted text into the ASVS content.