Testing IDNs

Internationalized (non-ascii) domain names (IDN) are a key issue for ICANN. Yesterday, the Board completed two days of workshop presentations about various matters (IANA, security, GAC relationships), and we were briefed on the IDN testing that is planned. I thought it might be useful to make clear the distinction between the tests (which are testing mechanisms for IDNs) and the very difficult policy questions that confront ICANN. As several people explained to me yesterday, they're different. more

MicroID: A Microformat for Claiming Ownership

This morning I learned about MicroIDs from Doc Searls. Jeremy Miller has proposed MicroIDs as a microformat that "allows anyone to simply claim verifiable ownership over their own pages and content hosted anywhere." A MicroID is a hash of two hashed values. The first is a verified communication ID. The second is the URI of the site that the content will be published on. You end up with a unique, long string of gibberish that can be put in the header of a Web page or even wrapped around one part of a page... more

Reporting To God

"GOD, at least in the West, is often represented as a man with a flowing beard and sandals. Users of the Internet might be forgiven for feeling that nature is imitating art — for if the Net does have a god he is probably Jon Postel" (The Economist, Feb. 1997) David W. Maher, Senior Vice President, Law and Policy of Public Interest Registry (PIR) offers his reminiscence of the early days of the Internet and attempts made to restructure the Domain Name System — an article he has entitled 'Reporting to God'. more

Identity, ICANN, and Public Meetings

Ok, so I had a day in Wellington that was not busy with other things so I thought I'd wander over to the ICANN venue and sit in on the PUBLIC Forum... I saw friends on the walk over and we entered the venue, chatting about several different things. They pulled out their badges. I didn't have one. They were admitted, I was denied entrance... more

In Historic Vote on WHOIS Purpose, Reformers Win by 2/3 Majority

It has taken almost three years -- by some counts, more than 6 years -- but ICANN's domain name policy making organization has finally taken a stand on Whois and privacy. And the results were a decisive defeat for the copyright and trademark interests and the US government, and a stunning victory for advocates of the rights of individual domain name registrants... more

When Will Google™ Become Generic?

Today, there are hundreds of once highly protected famous name brands, which were backed by multi-million dollar promotional budgets, now commonly used in daily lingo as generic names, as it was their huge popularity that made them lose their trademark protection. So why is the use of famous trademarked names as 'verbs' in our daily language feared by the attorneys representing that mark? Now this calls for a closer look... more

How Could the Internet be Governed: Perspective from Bulgaria

In the last few years there have been many discussions on how the Internet is governed, and how it should be governed. The whole World Summit on the Information Society (WSIS) ended talking about this problem. It caused exchange of letters between the US Secretary of State and the European Union presidency. And it caused a public discussion, organized by the US Department of Commerce on that issue. I saw some reflection of this discussion and here are some comments on that. My colleague Milton Mueller of the Syracuse University sent me an e-mail today in which, among other, it says, "A global email campaign by IGP generated comments from 32 countries... more

A Fundamental Look at DNSSEC, Deployment, and DNS Security Extensions

In looking at the general topic of trust and the Internet, one of the more critical parts of the Internet's infrastructure that appears to be a central anchor point of trust is that of the Domain Name Service, or DNS. The mapping of "named" service points to the protocol-level address is a function that every Internet user relies upon, one way or another. The ability to corrupt the operation of the DNS is one of the more effective ways of corrupting the integrity of Internet-based applications and services. If an attacker can in some fashion alter the DNS response then a large set of attack vectors are exposed. ...The more useful question is whether it is possible to strengthen the DNS. The DNS is a query -- response application, and the critical question in terms of strengthening its function is whether it is possible to authenticate the answers provided by the DNS. DNSSEC provides an answer to this question. more

Net Neutrality Is As Silly As So-Called Internet Governance

From the perspective of Internet security operations, here is what Net Neutrality means to me. I am not saying these issues aren't important, I am saying they are basically arguing over the colour of bits and self-marginalizing themselves. For a while now I tried not to comment on the Net Neutrality non-issue, much like I didn't comment much on the whole "owning the Internet by owning the Domain Name System" thingie. Here it goes anyway. Two years ago I strongly advocated that consumer ISP's should block some ports, either as incident response measures or as permanent security measures... more

Making DKIM More Useful with Domain Assurance Email

The IETF DKIM working group has been making considerable progress, and now has a close-to-final draft. DKIM will let domains sign their mail so if you get a message from fred@furble.net, the furble.net mail system can sign it so you can be sure it really truly is from furble.net. But unless you already happen to be familiar with furble.net, this doesn't give you any help deciding whether you want the message. This is where the new Domain Assurance Council (DAC) comes in... more

Another Try at Proof-of-Work e-Postage Email

Another paper from the Fifth Workshop on the Economics of Information Security, (WEIS 2006) is Proof of Work can Work by Debin Liu and L, Jean Camp of Indiana University. Proof of work (p-o-w) systems are a variation on e-postage that uses computation rather than money. A mail sender solves a lengthy computational problem and presents the result with the message. The problem takes long enough that the sender can only do a modest number per time period, and so cannot send a lot of messages, thereby preventing spamming. But on a net full of zombies, proof of work doesn't work. more

VeriSign Director Charged with Securities Fraud

Bloomberg is reporting that Gregory Reyes is facing criminal and civil charges in relation to securities fraud. Reuters and the Mercury News also have coverage. "Former Brocade Communications Systems Inc. Chief Executive Officer Gregory Reyes became the first CEO charged in the U.S. probe of the backdating of stock option grants to create lucrative employee pay packages." more

The Blurr-Cade Proposal on Root Zone Oversight

Becky Burr (former NTIA official) and lobbyist Marilyn Cade has made a proposal to create a multilateral working group to oversee the root zone file updates. I would characterize the Burr-Cade proposal as a "small step for mankind and a giant step for the US" to paraphrase Neil Armstrong. The main merit of the proposal is that it looks like something the USG might want to follow. Sevaral people suggested there should be no governmental oversight at all but that does not look realistic, in the sense that there can be huge economic and political interests behind ICANN decisions. more

Conflict of Opinion

If a UDRP panelist believes domainers are the same thing as cybersquatters, is he fit to arbitrate? I came across an editorial on CNET today by Doug Isenberg, an attorney in Atlanta and founder of GigaLaw.com, and a domain name panelist for the World Intellectual Property Organization. The guest editorial focuses on Whois privacy and why it's imperative to maintain open access to registrant data for intellectual property and legal purposes. That's a common opinion I've read a million times. Nothing groundbreaking there. But then I was shocked to read that Isenberg generalizes domainers as cybersquatters: "Today, cybersquatters have rebranded themselves as 'domainers.' Popular blogs and news sites track their activities..." more

Phishing Moving to the Web Channel

Today we received one of the first phish attempts to be made as a web spam (comment spam/blog spam) attempt. I wasn't convinced, and thought that perhaps it was a way to gather and verify RELEVANT online identities. Someone put me straight. It's phishing. I've often in the past had run-ins with the good folks in the anti virus realm back between 1996 and 2005 who thought Trojan horses and then spyware were not part of their business. Years later the AV business people ruled it is part of their business and ran to catch up. Same with botnets. more