Why Foldering Adds Very Little Security

I keep hearing stories of people using "foldering" for covert communications. Foldering is the process of composing a message for another party, but instead of sending it as an email, you leave it in the Drafts folder. The other party then logs in to the same email account and reads the message; they can then reply via the same technique. Foldering has been used for a long time, most famously by then-CIA director David Petraeus and his biographer/lover Paula Broadwell. Why is foldering used? more

The Economics of Hacking an Election

There have been many news stories of late about potential attacks on the American electoral system. Which attacks are actually serious? As always, the answer depends on economics. There are two assertions I'll make up front. First, the attacker -- any attacker -- is resource-limited. They may have vast resources, and in particular, they may have more resources than the defenders -- but they're still limited. Why? more

ICANN vs EPAG: ICANN Seeks Appeal Plus Pushes for ECJ Referral

As I predicted ICANN is pursuing its case against EPAG. They're now not only appealing the case to a higher court in Germany but are also trying to get the entire thing referred to the European Court of Justice. In an announcement late last night ICANN made it very clear what their intentions are. While they're pursuing the appeal in the higher court in the German region, which makes sense at some level, it's also very clear that they're not taking "no" for an answer. more

WHOIS Users Facing Serious Challenges Caused by Post-GDPR Fragmentation

On May 25, 2018, the European General Data Protection Regulation (GDPR) came into effect, meaning that European data protection authorities (DPAs) can begin enforcing the regulation against non-compliant parties. In preparation, the ICANN Board passed a Temporary Specification for gTLD Registration Data - essentially a temporary policy amendment to its registrar and registry contracts to facilitate GDPR compliance while also preserving certain aspects of the WHOIS system of domain name registration data. more

GDPR and WHOIS - Winners and Losers

I think we are all hoping that when ICANN meets with the DPAs (Digital Protection Authorities) a clear path forward will be illuminated. We are all hoping that the DPAs will provide definitive guidance regarding ICANN's interim model and that some special allowance will be made so that registrars and registries are provided with additional time to implement a GDPR-compliant WHOIS solution. more

Facebook vs. Domain Names: Lessons from Cambridge Analytica

The current revelations about Cambridge Analytica's use of Facebook data illustrate an important drawback to using a Facebook account as your business' online presence: Facebook knows and sells your customers! Millions of companies - especially small companies and start-ups - rely on a Facebook account for their online presence. On the surface, it seems like a great idea... more

Security, Standards, and IoT: Will Connected Devices Flourish Under Prescriptive Regimes?

Security for Internet-connected devices, the "Internet of Things" (IoT), is critically important. Now, more than ever, it is top of mind for device manufacturers, network operators, consumer advocates, lawmakers, and government regulators -- domestically and internationally. In the face of recent attacks, government authorities and consumer advocates have proposed legislation, frameworks, certifications, and labeling schemes. more

Accreditation & Access Model For Non-Public Whois Data

In the current debate over the balance between privacy and Internet safety and security, one of the unanswered questions is: "How will those responsible for protecting the public interest gain access to the non-public data in the WHOIS databases post General Data Protection Regulation (GDPR)?" In an attempt to prevent WHOIS data from going "dark," several community members have been working for the past weeks to create a model that could be used to accredit users and enable access to the non-public WHOIS data. more

GDPR and What Comes Next: The Parade of Horribles

The compliance deadline for the European Union's General Data Protection Regulation (GDPR) is nearly upon us, the unveiling of a proposed model to bring WHOIS into compliance is said to come from ICANN next week, and everyone is scrambling to understand all that's involved. Implementation of a revised WHOIS model is clearly on the horizon, but what comes after may be the real story! Specifically, if WHOIS information becomes more than nominally restricted, what's the consequence to the data controllers (ICANN and the contracted parties) who implement this revised model? more

Transition of the Telecoms Industry Is Overdue

It is interesting to observe the changes in the telecommunications environment over the last few decades. Before videotex (the predecessor of the internet) arrived in the late 1970s early 1980s, 90% of telecommunications revolved around telephone calls. And at that time telephony was still a luxury for many, as making calls were expensive. I remember that in 1972 a telephone call between London and Amsterdam cost one pound per minute. Local telephone calls were timed... more

Building a Brand for an Entire Industry: Q&A With Glenn Ruscoe of .physio

Success has many definitions. For many within the TLD community, it is a question of volume - domains under management, revenue and so on. For others, it's more long-term - renewal rates, utilization, and year-on-year growth. For Glenn Ruscoe, the physiotherapist behind the .physio TLD, success is far grander. His 'philanthropic' approach to the world of new domain extensions stems from a desire to create a global identity for the world's third-largest health profession. more

Hackers Hijack DNS Server for Cyrptocurrency Wallet BlackWallet, Over $400K Stolen From Users

Unknown hackers (or hacker) have hijacked the DNS server for BlackWallet.co, a web-based wallet application for the Stellar Lumen cryptocurrency (XLM). more

The Meeting That Changed the DARPA Datagram Internet

The National Science Foundation awarded a small contract to the IEEE to host a small two-day meeting on 30 Sept 1994 of selected invitees at the IEEE's Washington DC 18th Street offices on "Name Registration For The '.COM' Domain." Being part of the InterNIC contract oversight committee, I was one of the eight invitees. It turned out in many ways to be the single most important meeting in the long, checkered history of what is today referred to as "the internet," that made an extraordinarily bad decision. more

New UDRP Filing Fees at Czech Arbitration Court

The Czech Arbitration Court (CAC) has long offered the least expensive (by far) filing fees for complaints under the Uniform Domain Name Dispute Resolution Policy (UDRP), but its fee are about to become more expensive, at least in most cases. CAC's base UDRP filing fee (for a dispute involving up to five domain names and a single-member panel) will increase on February 1, 2018, from 500 euros to 800 euros. As of this writing, that's equivalent to about U.S. $600. more

The End of Net Neutrality Regulation COULD Mean the End of Last-Mile Oligopolies

Landline networks like the old phone system and the new(er) cable systems do lend themselves to monopoly or at least duopoly outcomes. Building these networks is both very expensive and requires myriad government approvals. Once a system is in place, it is hard for anyone to raise the capital to duplicate it. Even a network of wireless towers is hard to compete with. more