Featured Blogs

Cyber Crime: An Economic Problem

During ISOI 4 (hosted by Yahoo! in Sunnyvale, California) whenever someone made mention of RBN (the notoriously malicious and illegal bulletproof hosting operation, the Russian Business Network) folks would immediately point out that an operation just as bad was just "next door" (40 miles down the road?), working undisturbed for years. They spoke of Atrivo (also known as Intercage). The American RBN, if you like... more

Analyzing The Inbox of a Spammer’s Domain

Consider this scenario: you need a domain name for your site so you go to your favorite domain registrar's website and upon a quick search find that your third choice is actually available! You quickly pull your credit card and register the name. Everything is good and you can't wait to have your new domain start pointing to your site and represent your official email address. But not so fast -- some of the recent events are revealing that, these days, when you are registering a domain name there is one more critical thing you need to do: check under the hood! more

Registrar Influence on the Domain Security Posture of the Forbes Global 2000

In the 2021 Domain Security Report, we analyzed the trend of domain security adoption with respect to the type of domain registrar used, and found that 57% of Global 2000 organizations use consumer-grade registrars with limited protection against domain and DNS hijacking, distributed denial of service (DDoS), man-in-the-middle attacks (MitM), or DNS cache poisoning. On average, the adoption of domain security controls is two times higher for enterprise-class registrars than for those using consumer-grade registrars. more

CIRA Proposes New Standard for Domain Name Whois Privacy

The Canadian Internet Registration Authority (CIRA) has announced its proposed policy to provide all dot-ca domain name holders with increased privacy safeguards, bringing it in line with recently-enacted Canadian privacy laws. more

Another View of the New ICANN-DoC Agreement

The new MoU, called a Joint Project Agreement (JPA) is a cosmetic response to the comments received by NTIA during its Notice of Inquiry in July 2006. The object seems to be to strengthen the public's perception that ICANN is relatively independent. But the relationship between the USG and ICANN is fundamentally unchanged. In one important respect, the JPA has actually increased direct US intervention. more

TLD Registration Enforcement: A Call for Automation - Part I

The past year has brought a rise in so-called "open and chartered" top-level domains (TLDs). Like the traditional open TLDs of .COM, .NET, and .ORG, these namespaces encourage large-scale registrations, but they differ in that they limit who can legitimately register domains. So far, many thousands of their registrations seem to break the stated rules. It's therefore worth thinking through their respective enforcement efforts -- before the situation gets out of control. more

Lobbying for Whois Privacy

Today a letter was submitted to the President of ICANN, Paul Twomey, at the ICANN Carthage meeting, "asking him to ensure that strong privacy safeguards, based on internationally accepted standards, are established for the WHOIS database." Latest reports indicated that the draft letter had been signed by about 50 nonprofit groups and represented 21 countries on six continents. "Signers of the letter included the American Library Association, the U.S. Association for Computing Machinery, the Australian Council for Civil Liberties, Electronic Frontier Finland, Privacy Ukraine, and the United Kingdom's Foundation for Information Policy Research." more

IDNs and IE7 and the Coming Storm

If you're brave, today you can finally download the Internet Explorer 7 public beta. Why should you be interested? Not because the browser's wonderful. It isn't -- initial reports are that it's not ready for prime-time. But you might be interested to know that as of today, users of IE will be able to use internationalized domain names (IDNs). ...Many other browsers are already IDN-capable, including Firefox, but most people in the world use Explorer. Think China, Japan, India. Think most of the world's population... Think of millions of new Internet users working in their own language, customers for commercial goods and services. But think also about intellectual property nightmares, think about phishing, think about whether there's one interoperable Internet, or several Internets acting very weird. These issues and others will become big news when people start using IDNs massively -- and with support from Internet Explorer, that's about to happen. more

Do You Agree With WLS? Your Chance to Comment!

Should ICANN's Wait-Listing Service be implemented?

Why yes or why not? What are the negative or positive consequences that are being overlooked?

In light of the recent events regarding ICANN's approval of the Wait-Listing Service (WLS), CircleID is requesting all stakeholders (all individuals or organization that own domain names or sell related services) to submit their comments 'for' or 'against' WLS. All comments gathered will be posted on CircleID WLS Speical Coverage and presented to key decision makers...  more

The Deeper Root Cause of the Fastly and Akamai Outages

As we finished this article, the world was hit by another global outage by content delivery network (CDN) provider, Akamai, on June 17, 2021. The cause seems to be related to the lack of capacity to a certain "routing table" of their distributed denial of service (DDoS) mitigation. Although the technical analysis is not yet available, the central premise of this article also applies to this incident, and it serves as a timely testimony. more

FreeNum Links Phone Numbers to the Internet

I loved John Todd's ETel presentation (podcast) on FreeNum, a scheme for bringing phone numbers to the Internet. Of course, I love identifiers and addresses and all that they enable, so it was a natural. Suppose you were a university campus and when you looked at your phone bill, you noticed that a lot of calls were to other universities. You've got a VoIP telephone system; they've all got VoIP telephone systems. You might wonder "isn't there some way to route these calls over the Internet and save some serious money?" The answer, of course is "yes" but making it usable is a little harder... more

Domain Name Dispute Puts Dot-Ca in the Spotlight

My weekly Law Bytes column (freely available hyperlinked version, Toronto Star version) focuses on the recent Canadian parliamentary discussion on domain name disputes. As discussed about ten days ago, the impetus for governmental interest in domain name disputes and Internet governance is the registration of several domain names bearing the names of sitting Members of Parliament by the Defend Marriage Coalition, an opponent of same-sex marriage legislation. The resulting websites, which include donboudria.ca and davidmcguinty.ca, include MP contact information, photos, and advocacy materials. more

A Brief Look at the Domain Attack Surface of Streaming Media Companies

The term "attack surface" is often heard in cybersecurity conversations. It refers to the sum of all possible attack vectors or the vulnerabilities that threat actors can exploit to penetrate a target network or damage an organization somehow. An unused and forgotten subdomain, for instance, can become an attack vector when taken over. Certain categories of companies have very large attack surfaces. Such is the case of streaming media businesses like Netflix and HBO Max. more

IPv6: A 2012 Report Card

The Gogonet Live conference in San Jose witnessed outstanding presentations by several federal administrations including Veteran Affairs, NASA and SPAWAR, sharing their experience and progress towards IPv6 adoption. Furthermore, the NIST compliance report leaves no agency any place to hide. The report card is there for everybody to see. In spite of regular jabs and criticisms, the US Federal Government has done a remarkable job. more

CAN-SPAM Defendant Awarded $111k in Fees/Costs: Gordon v. Virtumundo

I believe this ruling represents the first time that a CAN-SPAM plaintiff has been ordered to pay attorneys' fees and costs to a defendant. As a result, it's a leading example that courts can and do grow tired of bogus anti-marketing lawsuits, and perhaps it will serve as an expensive warning to CAN-SPAM plaintiffs to ensure the merits of their lawsuit. Gordon is an uber anti-spam plaintiff, leading countless CAN-SPAM lawsuits. As the court describes, Gordon runs a "spam business"--basically, a for-profit plaintiff litigation shop to go after spammers (the court also calls it a "litigation factory")... more