Featured Blogs

A Review of the 2024 Threat Landscape and Implications for Domain Security

The cybersecurity landscape in 2024 has been characterised by unprecedented complexity and rapidly evolving threats, presenting significant challenges for organisations across all sectors. As the digital attack surface expands and threat actors employ increasingly sophisticated techniques, domain security has emerged as a critical component of a robust cybersecurity strategy. more

Afilias to Protect TLDs Against Potential “Orphan Glue” Exploits

Afilias has informed registrars and registry clients that it is taking steps to remove orphan glue records from 200+ TLD zones in its care. This will eliminate the potential for a handful of domain names to be misused. "Glue records" enable websites and other uses of domain names to work on the internet. They are related to DNS domain name delegations and are necessary to guide iterative resolvers to delegated nameservers. more

IPv6 Deployment: A Very Complex Time Bomb with an Uncertain Trigger Date

I did a 2 hour interview on October 23rd with John Curran, Board Chair of ARIN the North American Regional Internet Routing Registry for the last decade. I now understand what is at stake with IPv6. Outside of a key core group of network engineers I think darn few people do understand. And not all of them agree on how the scenario plays out though virtually all say the situation is very serious. John believes that it is huge. It is as big as Y2K except no one knows a precise date by which everything has to be done... more

Typosquatting Continues to Pose Dangers to Enterprises, Consumers

While typosquatting is not a new phenomenon, recent research highlights that it is being used to collect sensitive corporate information from employees and lure consumers to interact with dubious websites. ... Security consultancy Godai Group recently uncovered the use of a specific type of typosquat - a "doppelganger domain" - to collect sensitive enterprise information via email-based attacks. more

NCUC Group Releases Nominations

The Noncommercial Users Constituency (NCUC) is the constituency group representing civil society organizations in the formation of domain name policy. In August 2004 it initiated a process to nominate people to serve on the UN Secretary-General's Working Group on Internet Governance, as representatives of civil society. Our purpose was to assist the Secretary-General to identify qualified and widely-supported individuals capable of serving on the WGIG on behalf of civil society. more

How Failure To Maintain IPv6 Is Hindering Law Enforcement

Recently, the FBI, DEA and even the Canadian Mounted Police have suggested that the switch to IPv6 is making it more difficult to track criminals online, those who would traffic in things such as drugs or child pornography, in addition to hackers, botnets, kidnappers and terrorists. Under IPv4, it wasn't very difficult to find offenders online via their IP addresses. The American Registry of Internet Numbers (ARIN) would hand out the address and internet providers would log them into the public WHOIS database. more

It’s “Verisign vs. Users”

But even if the collateral damage is left out of the picture, the very idea behind SiteFinder is user-unfriendly, and that's the second half of the ALAC's note: SiteFinder is, ultimately, about short-cutting other error handling methods, and redirecting any users that enter non-existing domain names into a web browser to Verisign's own service, for commercial purposes. SiteFinder is designed so it becomes difficult to deploy superior error handling services that would compete with it -- because errors aren't flagged. more

Banning 5G Equipment is a Foolish Strategy

It has become popular today around Washington and the venues of its coerced allies to issue threats to ban telecommunications equipment from certain countries - especially equipment intended for 5G use. The guise is vague assertions of "national security." It is an old tactic dating back to the turn of the last century and recurrent for decades. A combination of treaty instruments and collaborative industry standards activity several decades ago largely put an end to the banning tactic - significantly benefitting the entire world. more

New gTLD Registration Strategies: Preparing for the Inevitable

As we draw closer to the first new gTLD registry launch, many companies are beginning the arduous task of developing their new gTLD registration and blocking strategies. And after speaking with dozens of clients, I can tell you that the planned approaches are ranging from very minimal registration and blocking strategies for one or two core brands, all the way through to registrations of multiple brands in every single new gTLD registry. more

Can We Create a Secure Caller ID For VoIP?

Can we create a "secure Caller ID" for IP-based communications, a.k.a. voice-over-IP (VoIP)? And specifically for VoIP based on the Session Initiation Protocol (SIP)? Can we create a way to securely identify the origin of a call that can be used to combat robocalling, phishing and telephony denial-of-service (TDOS) attacks? That is the challenge to be undertaken by the "Secure Telephone Identity Revisited (STIR)" group meeting tomorrow morning, July 30, 2013, at 9:00 am in Berlin, Germany, as part of the 87th meeting of the Internet Engineering Task Force (IETF). more

As IPv6 Deploys, Will We Look Back on NAT as the Ugly Step Sister or Unsung Hero?

The debates are raging over whether or not we should migrate to IPv6. The strongest argument is the enormous address space that will allow for everyone and everything to have a unique public address, many addresses actually. It is often said that the shortage of public IPv4 addresses has limited our capabilities because it led to the pervasive use of private addressing, Network Address Translation (NAT) and Port Address Translation (PAT). Though these technologies remain critical, they are often regarded as stop-gap measures, and they sometimes create problems. In some circles, NAT has acquired a very bad name. But is that a fair perspective of the technology? Let's review the positives and negatives. more

Actions Required by Developing Economies Against Spam

My OECD paper on spam problems in developing economies is now linked from the OECD Anti-Spam Toolkit page, as part of section 8 of the Anti-Spam Toolkit (Outreach). This ZDNet article provides a reasonably good summary of my paper as well. I welcome comments and suggestions from CircleID readers. "Spam is a much more serious issue in developing countries as it is a heavy drain on resources that are scarcer and costlier in developing countries than elsewhere..." more

Finding Good ICANN Board Candidates

In the late summer of 2006, the ICANN Nominating Committee will convene to select three members to the ICANN Board of Directors, and four members to various councils. Depending on the global visibility of the nominees, and the current political and technical currents pulling at the Internet community, these nominations will be both pilloried and lauded in different circles. This process of selecting a good ICANN board member is astonishingly complex; I should know, having served on the founding NomCom in 2003, and the succeeding NomComs in 2004 and 2005. By far the biggest challenge is finding good candidates... more

The Continuing ITU Meltdown

It is rather like watching the episodes in the new season of a soap opera. When we last left the ITU at its WCIT treaty conference in Dubai in December, fifty-five nations got up and left, refusing to sign a profoundly broken scheme to regulate anything and everything related to telecommunications, information systems, and the Internet. Eighty-nine nations signed - notably Russia, China, Korea, and most of the Middle East and African countries. This G55 versus G89 split fundamentally fractured the legal basis of the ITU and the role of its standards making body. more

Diverting Traffic On The Web: Trademarks And The First Amendment

What's at the heart of cybersquatting may also be at the heart of free speech on the Internet: the diversion of Internet users looking for plaintiff's web site to defendant's web site. Cybersquatters register domain names to accomplish this, while meta-infringers (as we will call them) use HTML code and search engine optimization techniques. Meta-infringers do this by creating keyword density by using competitor's trademarks and permutations thereof in their website in order to rank higher in the search engine results when someone searches on the competitor's trademarks. more