Cybersecurity

Mozilla Implements TLD Whitelist for Firefox in Response to IDN Homographs Spoofing

Mozilla Foundation has announced changes to Firefox concerning Internationalized Domain Names (IDN) to deal with homograph spoofing attacks. According to the organization, "Mozilla Foundation products now only display IDNs in a whitelist of TLDs, which have policies stating what characters are permitted, and procedures for making sure that no homographic domains are registered to two different entities." Following is a statement explaining the current status of the Mozilla changes to Firefox regarding IDN... more

The Politics of Email Authentication, 2006 Edition

A student at a well-known US university wrote me and asked whether, given the huge national interest in getting the industry to unite behind (at least) one format, did I think that the FTC should've played a stronger role in pushing the industry to adopt an authentication format? I said: Nope. Part of the reason it's taking so long to agree on a standard is that the process is infested with academic theoreticians who are more interested in arguing about hypotheticals and pushing their pet spam solutions than in doing something useful... more

The Problem With Wikis

Wikis have been around for a long time on the Web. It's taken a while for them to transform from geek tool to a mainstream word, but we're here now. Last week at the ICANN Meeting in Vancouver, it was fun to watch hundreds of people get introduced to Wikis and start using them, thanks to Ray King's ICANN Wiki project. In the past few days since, I've come to believe that Wikis are doomed unless they start thinking about security in a more serious way. more

She Gave Me a Fake Phone Number!

The Intellectual Property Constituency, meeting at the ICANN conference in Vancouver, was interested in increasing ICANN's budget not because they thought they deserved it, but because they wanted ICANN to actually enforce the rules on the books about fake registrations. Now there's some evidence about how prevalent that is. If there's any surprise here, it's that the numbers are so low. more

Abusive Anti-Anti-Spam Scheme a Dreadful Strategy

A new company called Blue Security purports to have an innovative approach to getting rid of spam. I don't think much of it. As I said to an Associated Press reporter: "It's the worst kind of vigilante approach," said John Levine, a board member with the Coalition Against Unsolicited Commercial E-mail. "Deliberate attacks against people's Web sites are illegal." more

Bug Reveals the Snooper in VeriSign’s Site Finder

Here's another interesting angle on the Verisign Site Finder Web site. VeriSign has hired a company called Omniture to snoop on people who make domain name typos. I found this Omniture Web bug on a VeriSign Site Finder Web page... more

VeriSign-ICANN Proposed Settlement Discussed in Vancouver

Unfortunately I cannot be in Vancouver for the conference. I write this from Cape Town, venue of last years fall ICANN. I want to disclose a couple of things upfront. Those who know me will know I am nothing if not strongly independent in my views. However disclosure helps those of a more suspicious mind know my associations and if they choose to, take them into account in interpreting my opinions. ...I am somewhat disappointed by the reaction to the proposed settlement. I feel that most of the discussion fails to take into account the actual conditions under which the settlement has been negotiated. more

The WSIS Deal

There is considerable coverage this morning (or this evening in Tunis) on the last minute WSIS deal struck yesterday. The gist of the coverage rightly reports that the U.S. emerged with the compromise they were looking for as the delegates agreed to retain ICANN and the ultimate U.S. control that comes with it (note that there is a lot in the WSIS statement that may ultimately prove important but that is outside the Internet governance issue including the attention paid to cybercrime, spam, data protection, and e-commerce). This outcome begs the questions -- what happened? And, given the obvious global split leading up to Tunis, what changed to facilitate this deal? more

Five More Years! There Was No “Deal” and WSIS Resolved Nothing

The basic problem posed by WSIS was the role of national governments and national sovereignty in global Internet governance. That conflict remains completely unresolved by the WSIS document. The document's thinking is still based on the fiction that there is a clear divide between "public policy" and the "day to day operation" of the Internet, and assumes that governments should be fully in control of the policy-setting function. Moreover, new organizational arrangements are being put into place which will carry on that debate for another 5 years, at least. The new Internet Governance Forum is a real victory for the civil society actors, but also fails to resolve the basic issue regarding the role of governments and sovereignty. Although called for and virtually created by civil society actors, the language authorizing its creation asks to involve all stakeholders "in their respective roles." In other words, we still don't know whether this Forum will be based on true peer-peer based interactions among governments, business and civil society, or whether it will reserve special policy making functions to governments. more

Internet Governance: Countdown to Tunis

In a paper entitled "DNS Détente", written in the authors' personal capacities, Tricia Drakes (a former member of the ICANN Board) and Michael D. Palage (a current member of the ICANN board) have attempted to address some of the unresolved issues of the recent Preparatory Committee (PrepCom) 3 session in Geneva as discussions head to the final phase of the World Summit on the Information Society (WSIS) in Tunis (Nov 16 to 18, 2005). More specifically, the paper focuses on one of the "fundamental stumbling blocks to the continued evolution of Internet Governance"; The insistence of the United States Government (USG) that it retain its historically exclusive role in connection with authorizing changes to the Root A server, particularly with respect to country code top-level domains (ccTLDs). Shared further is the content of this paper. more

Actions Required by Developing Economies Against Spam

My OECD paper on spam problems in developing economies is now linked from the OECD Anti-Spam Toolkit page, as part of section 8 of the Anti-Spam Toolkit (Outreach). This ZDNet article provides a reasonably good summary of my paper as well. I welcome comments and suggestions from CircleID readers. "Spam is a much more serious issue in developing countries as it is a heavy drain on resources that are scarcer and costlier in developing countries than elsewhere..." more

Nom-Com Appoints Independent and Diverse Candidates to ICANN Leadership Positions

When 72 candidates vie for 8 positions, making tough choices are inevitable. ICANN's 2005 Nominating Committee (Nom-Com) on Friday announced the selection of a diverse and independent set of nominees for important roles in ICANN, including the Board of Directors, the Generic Names Supporting Organization (GNSO), the At-Large Advisory Council (ALAC) and the Country Code Names Supporting Organization (ccNSO). more

Forgotten Principles of Internet Governance

Suddenly internet governance has become a hot topic. Words and phrases fly back and forth but minds rarely meet. We do not have discussion, we have chaos. We are not moving forwards towards a resolution. It's time to step back and review some basic principles. 1. Principle: The internet is here to serve the needs of people (and organizations of people); people are not here to serve the internet. Corollary: If internet technology does not meet the needs of users and organizations than it is technology that should be the first to flex and change. more

Survey Results Expose Widespread DNS Vulnerabilities

The Measurement Factory and Infoblox have announced results of a survey of more than 1.3 million Internet-connected, authoritative domain name system (DNS) servers around the globe. The results of the survey indicate that as many as 84 percent of Internet name servers could be vulnerable to pharming attacks, and that many exhibit other security and deployment-related vulnerabilities. The surveys consisted of several queries directed at each of a large set of external DNS servers to estimate the number of systems deployed today and determine specific configuration details. more

VeriSign and ICANN Settle Lawsuit

ICANN has announced today that it has tentatively agreed to settle a longstanding dispute with VeriSign Inc. The dispute which began in part from SiteFinder, a controversial search service VeriSign created in late 2003 for users who mistype Web addresses. The following is an excerpt from today's press release... more