Dotless domains “dangerous”, security study says

An independent security study has given ICANN a couple dozen very good reasons to continue outlaw “dotless” domain names, but stopped short of recommending an outright ban.
The study, conducted by boutique security outfit Carve Systems and published by ICANN this morning, confirms that dotless domains — as it sounds, a single TLD label with no second-level domain and no dot — are potentially “dangerous”.
If dotless domains were to be allowed by ICANN, internet users may unwittingly send their private data across the internet instead of a local network, Carve found.
That’s basically the same “internal name collision” problem outlined in a separate paper, also published today, by Interisle Consulting (more on that later).
But dotless domains would also open up networks to serious vulnerabilities such as cookie leakage and cross-site scripting attacks, according to the report.
“A bug in a dotless website could be used to target any website a user frequents,” it says.
Internet Explorer, one of the many applications tested by Carve, automatically assumes dotless domains are local network resources and gives them a higher degree of trust, it says.
Such domains also pose risks to users of standard local networking software and residential internet routers, the study found. It’s not just Windows boxes either — MacOS and Unix could also be affected.
These are just a few of the 25 distinct security risks Carve identified, 10 of which are considered serious.
ICANN has a default prohibition on dotless gTLDs in the new gTLD Applicant Guidebook, but it’s allowed would-be registries to specially request the ability to go dotless via Extended Evaluation and the Registry Services Evaluation Process (with no guarantee of success, of course).
So far, Google is the only high-profile new gTLD applicant to say it wants a dotless domain. It wants to turn .search into such a service and expects to make a request for it via RSEP.
Other portfolio applicants, such as Donuts and Uniregistry, have also said they’re in favor of dotless gTLDs.
Given the breadth of the potential problems identified by Carve, you might expect a recommendation that dotless domains should be banned outright. But that didn’t happen.
Instead, the company has recommended that only certain strings likely to have a huge impact on many internet users — such as “mail” and “local” — be permanently prohibited as dotless TLDs.
It also recommends lots of ways ICANN could allow dotless domains and mitigate the risk. For example, it suggests massive educational outreach to hardware and software vendors and to end users.

Establish guidelines for software and hardware manufacturers to follow when selecting default dotless names for use on private networks. These organizations should use names from a restricted set of dotless domain names that will never be allowed on the public Internet.

Given that most people have never heard of ICANN, that internet standards generally take a long time to adopt, and allowing for regular hardware upgrade cycles, I couldn’t see ICANN pulling off such a feat for at least five to 10 years.
I can’t see ICANN approving any dotless domains any time soon, but it does appear to have wiggle-room in future. ICANN said:

The ICANN Board New gTLD Program Committee (NGPC) will consider dotless domain names and an appropriate risk mitigation approach at its upcoming meeting in August.

DotMusic loses LRO, and four other cases rejected

Constantine Roussos has lost his first Legal Rights Objection over the flagship .music gTLD.
The case, DotMusic v Charleston Road Registry (pdf) was actually thrown out on a technicality — DotMusic didn’t present any evidence to show that it was the owner of the trademarks in question.
But the WIPO panelist handling the case made it pretty clear that DotMusic wouldn’t have won on the merits anyway.
If any applicant can be said to have built a brand around a proposed generic-term gTLD, it’s Roussos. DotMusic has been promoting .music on social media an in the music industry for years.
The company also owns the string “music” in a number of second-tier TLDs such as .co, .biz and .fm.
It’s not a bogus, last-minute attempt to game the system, like the .home cases — filed using Roussos-acquired trademarks — that have been thrown out repeatedly over the last couple of weeks.
The panelist addressed this directly:

On the one hand, the Panel recognizes that there has been a real investment by the Objector and associated parties in the trademark registrations, domain name registrations, sponsorship and branding to create consumer recognition and goodwill entitled to protection. On the other hand, there is a circularity in the Objector’s position in that the rights upon which the Objector relies to defeat the application are to a certain extent conditional on the defeat of the Applicant and the Objector’s success in obtaining the <.music> gTLD string.

In other words, Catch-22.
The panelist decided that .music is generic, that Google’s proposed use of it is generic, and that obtaining a trademark on a gTLD should not be a legit way to exclude rival applicants for that gTLD.

One objective of the Objector has been to obtain precisely the type of competitive advantage (in this case in the application process for the <.music> gTLD string) that the doctrine of generic names is designed to prevent. However, as the Applicant proposes to use the <.music> gTLD string in a generic sense it is immune from this challenge.

On that basis, the LRO would have failed, had DotMusic managed to demonstrate standing to object in the first place.
Unfortunately, DotMusic didn’t present any evidence that it actually owned the trademarks in question, which were applied for by Roussos and assigned to his company CGR E-Commerce.
The objection failed on that basis.
Defender Security, which obtained trademarks on “.home” from Roussos, ran into the same problems proving ownership of the trademarks in its LROs on the .home gTLD.
Four other LROs were decided this week:
.mail (United States Postal Service v. GMO Registry)
The case (pdf) turned on whether USPS owns a trademark that exactly matches the applied-for string (it doesn’t) and whether the word “mail” should be considered generic (it is) rather than a source identifier (it isn’t).
It’s pretty much the same logic applied in the two previous .mail LROs.
.food (Scripps Networks Interactive v. Dot Food, LLC)
This is the first of two competitive LROs filed by Scripps — which runs TV stations including the Food Network — against its .food applicant rivals to be decided.
Scripps has a bunch of trademarks containing the word “food”, including a November 2011 registration in the US for “Food” alone, covering entertainment services.
The WIPO panelist found (pdf) that the trademark was legit, but decided that it was not enough to prevent Dot Food using the matching string as a gTLD.
The fact that rights protection mechanisms exist in the new gTLD program was key:

to the extent that registration and use of a particular second-level domain within the <.food> gTLD actually creates a likelihood of confusion, then Objector will have remedies available to it, including the established Uniform Domain Name Dispute Resolution Policy, the forthcoming Uniform Rapid Suspension System and relevant laws. The fact that such disputes at the second level may arise is inherent in ICANN’s new gTLD program and is not in the circumstances of this case sufficient to uphold the present legal rights objection.
Objector’s rights in the FOOD mark do not confer upon it the exclusive right to use of the word “food” in all circumstances, particularly where, as here, Applicant intends to use the <.food> gTLD in connection with the food industry. Such intended use of the word would appear to be only for its dictionary meaning and not because of Objector’s trademark rights.

.vip (i-Registry v. Charleston Road Registry)
It’s the second objection by .vip applicant to get thrown out. In this case the respondent was Google.
Like the first time, the WIPO panelist found that the i-Registry trademark had been obtained for the purposes of the new gTLD program and that Google’s use of it in its generic sense would not infringe its rights.
.cam (AC Webconnecting Holding v. Dot Agency)
The second and final LRO decision (pdf) in the .cam contention set.
AC Webconnecting, an operator of webcam-based porn sites, lost again on the grounds that it applied for its trademark just a month before ICANN opened up the new gTLD application window in January last year.
The company didn’t have time to, and produced no evidence to suggest that, it had used the trademark and built up goodwill around “.cam” in the normal course of business.
In other words, front-running doesn’t pay.

Google beats USPS in LRO, Defender loses another

The United States Postal Service and Defender Security have both lost Legal Rights Objections over the new gTLDs .mail and .home, respectively.
In both cases it’s not the first LRO the objector has lost. USPS, losing here against Google, lost a similar objection against Amazon, while Defender has previously racked up six losses over .home.
The Defender case (pdf) this time was against .Home Registry Inc. The objection was rejected by the World Intellectual Property Organization panelist on pretty much the same grounds as the others — Defender acquired its trademark rights purely in order to be able to file LROs against its .home rivals.
In the USPS v Amazon case (pdf) the WIPO panelist also decided along the same lines as the previous case.
The decision turned on whether USPS, which owns trademarks on “U.S. Mail” but not “mail”, could be said to have rights in “mail” by virtue of the fact that it is the monopoly postal service in the US.
USPS argued that .mail is like .gov — internet users know a .gov domain is owned by the US government, so they’re likely to think .mail belongs to the official US mail service.
The panelist decided that users are more likely to associate the gTLD with email:

A consumer viewing the string <.mail> in the context of a domain name registration or an email address is presumably even more likely to think of the electronic (“email”) meaning, rather than the postal meaning, of the term “mail,”

WIPO has now decided 20 LRO cases. All have been rejected. Several more were terminated after the objector withdrew its objection.

First new gTLD objection scalps claimed

Employ Media has killed off the Chinese-language gTLD .招聘 in the latest batch of new gTLD objection results.
Amazon and DotKids Foundation’s respective applications for .kids also appear to be heading into a contention set with Google’s bid for .kid, following the first String Confusion Objections.
All three objections were marked as “Closed, Default” by objection handler the International Center For Dispute Resolution a few days ago. No full decisions were published.
This suggests that the objectors have won all three cases on technicalities (such as the applicant failing to file a response).
Employ Media vice president for policy Ray Fassett confirmed to DI that the company has prevailed in its objection against .招聘, which means “recruitment” in Chinese and would have competed with .jobs.
The String Confusion Objection can be filed based on similarity of meaning, not just visual similarity.
What’s more, if the objector is an existing TLD registry like Employ Media, the only remedy is for the losing applicant to have their application rejected by ICANN.
So Hu Yi Global Information Resources, the .招聘 applicant, appears to be finished as far as this round of the new gTLD program is concerned.
But because there’s no actual ICDR decision on the merits of the case, it seems possible that it, or another company, could try for the same string in a future round.
In Google’s case, it had objected to both the Amazon and DotKids applications for .kids on string confusion grounds. The company is applying for .kid, which is obviously very similar.
The String Similarity Panel, which created the original pre-objection contention sets, decided that singular and plurals could co-exist without confusion. Not everyone agreed.
Because .kid is merely an application, not an existing TLD, none of the bids are rejected. Instead, they all join the same contention set and will have to work out their differences some other way.
Applicants are under no obligation to fight objections; they may even want to be placed in a contention set.

IAB gives dotless domains the thumbs down

The Internet Architecture Board believes dotless domain names would be “inherently harmful to Internet security.”
The IAB, the oversight committee which is to internet technical standards what ICANN is to domain names, weighed into the debate with an article apparently published yesterday.
In it, the committee states that over time dotless domains have evolved to be used only on local networks, rather than the internet, and that to start delegating them at the top level of the DNS would be dangerous:

most users entering single-label names want them to be resolved in a local context, and they do not expect a single name to refer to a TLD. The behavior is specified within a succession of standards track documents developed over several decades, and is now implemented by hundreds of millions of Internet hosts.
…
By attempting to change expected behavior, dotless domains introduce potential security vulnerabilities. These include causing traffic intended for local services to be directed onto the global Internet (and vice-versa), which can enable a number of attacks, including theft of credentials and cookies, cross-site scripting attacks, etc. As a result, the deployment of dotless domains has the potential to cause significant harm to the security of the Internet

The article also says (if I understand correctly) that it’s okay for browsers to interpret words entered into address bars without dots as local resources and/or search terms rather than domain names.
It’s pretty unequivocal that dotless domains would be Bad.
The article was written because there’s currently a lot of talk about new gTLD applicants — such as Google, Donuts and Uniregistry — asking ICANN to allow them to run their TLDs without dots.
There’s a ban in the Applicant Guidebook on the “apex A records” that would be required to make dotless TLDs work, but it’s been suggested that applicants could apply to have the ban lifted on a case by case basis.
More recently, ICANN’s Security and Stability Advisory Committee has stated almost as unequivocally as the IAB that dotless domains should not be allowed.
But for some reason ICANN recently commissioned a security company to look into the issue.
This seems to have made some people, such as the At Large Advisory Committee, worried that ICANN is looking for some wiggle room to give its new gTLD paymasters what they want.
Alternatively, ICANN may just be looking for a second opinion to wave in the faces of new gTLD registries when it tells them to take a hike. It was quite vague about its motives.
It’s not just a technical issue, of course. Dotless TLDs would shake up the web search market in a big way, and not necessarily for the better.
Donuts CEO Paul Stahura today published an article on CircleID that makes the case that it is the browser makers, specifically Microsoft, that are implementing DNS all wrong, and that they’re objecting to dotless domains for competitive reasons. The IAB apparently disagrees, but it’s an interesting counterpoint nevertheless.

Google beaten in new gTLD contention set

When it comes to new gTLDs, Google is not invulnerable.
Japanese web portal NTT Resonant, a subsidiary of the country’s incumbent national telco, has drawn first blood against the search giant, apparently forcing Google to withdrawn its application for .goo.
NTT has also applied for .goo, the name of its primary portal site, which competes with Google for Japanese-language searchers.
The company had filed a formal legal rights objection with WIPO. The withdrawal demonstrates that the mechanism can protect trademark owners, at least insofar as it can scare off competing applicants.
Google’s bid was marked as withdrawn on ICANN’s web site overnight. It’s the fourth withdrawal from the company, following three misjudged geographic applications, leaving it with 97 active bids.
There are now 82 withdrawn and 1,848 live applications. The maximum number of delegated strings remains steady at 1,365. More program status stats can be found over on DI PRO.

Microsoft objects to Google’s dotless domains plan

Microsoft has strongly urged ICANN to reject Google’s plan for a “dotless” .search gTLD.
In a letter sent a couple of weeks ago and published last night, the company says that Google risks putting the security and stability of the internet at risk if its .search idea goes ahead.
David Tennenhouse, corporate vice president of technology policy, wrote:

Dotless domains are currently used as intranet addresses controlled by private networks for internal use. Google’s proposed amendment would interfere with that private space, creating security vulnerabilities and impacting enterprise network and systems infrastructure around the globe.

It’s a parallel argument to the one going on between Verisign and everyone else with regards to gTLD strings that may conflict with naming schemes on internal corporate networks.
While they’re subtly different problems, ICANN recently commissioned a security study into dotless domains (announced 11 days after Microsoft’s letter was sent) that links the two.
As Tennenhouse says in his letter, ICANN’s Security and Stability Advisory Committee, which has Google employees on it, has already warned about the dotless name problem in SAC053 (pdf).
He also claims that Google had submitted follow-up comments to SAC053 saying dotless domains would be “actively harmful”, but this is slightly misleading.
One Google engineer did submit such a comment, but it limited itself to talking about clashes with internal name certificates, a slightly different issue, and it’s not clear it was an official Google Inc comment.
The new gTLD Applicant Guidebook currently outlaws dotless domains through its ban on “apex A records”, but that ban can be circumvented if applicants can convince a registry services evaluation panel that their dotless domain plans don’t pose a stability risk.
While Google’s original .search application envisaged a single-registrant “closed generic”, it later amended the proposal to make it “open” and include the dotless domain proposal.
This is the relevant bit of the amended application:

Charleston Road Registry will operate a service that allows users to easily perform searches using the search functionality of their choice. This service will operate on the “dotless” search domain name (http://search/) and provide a simple web interface. This interface operates in two modes:
1) When the user has not set a preference for a search engine, they will be prompted to select one. The user will be provided with a simple web form that will allow them to designate a search engine by entering the second level label for any second level domain registered with in the TLD (e.g., if “foo.search” was a valid second level domain name, the user could indicated that their preferred search engine was “foo”). The user can also elect to save this preference, in which case a cookie will be set in the userʹs browser. This cookie will be used in the second mode, as described below. If the user enters an invalid name, they will be prompted again to provide a valid response.
2) If the user has already set a preferred search engine, the redirect service will redirect the initial query to the second level domain name indicated by the userʹs preference, including any query string provided by the user. For example, if the user had previously selected the “foo” search engine and had issued a query for http://search/?q=bar, the server would issue a redirect to http://foo.search/?q=bar. In this manner, the userʹs query will be consistently redirected to the search engine of their choice.

While Google seems to have preempted some concerns about monopolistic practices in the search engine market, approval of its dotless search feature would nevertheless have huge implications.
Make no mistake, dotless domains are a Big Deal and it would be a huge mistake for ICANN to treat them only as a security and stability issue.
What’s weird about Google’s proposal is that by asking ICANN to open up the floodgates for dotless domains, it risks inviting the domain name industry to eat its breakfast, lunch and dinner.
If ICANN lets registries offer TLDs domains without dots, the new gTLD program will no longer be about delegating domain names, it will be about auctioning exclusive rights to search terms.
Today, if you type “beer” into your browser’s address bar (which in all the cases I’m aware of are also search bars) you’ll be directed to a page of search results for the term “beer”.
In future, if “beer” is a domain name, what happens? Do you get search or do you get a web page, owned by the .beer registry? Would that page have value, or would it be little better than a parking page?
If browser makers decided to implement dotless domains — and of course there are plenty of reasons why they wouldn’t — every borderline useful dictionary word gTLD would be sold off in a single round.
Would that be good for the internet? I’d lean toward “no”.

Three gTLDs that Google doesn’t treat as gTLDs

Google this week reportedly updated its Webmaster Tools service to treat more ccTLDs as non-geography-specific, but it still seems to be overlooking two gTLDs altogether.
According to its refreshed FAQ, only 19 gTLDs are treated as “gTLDs that can be geotargeted in Webmaster Tools”.
The list does not include .post, which has been in the DNS since August 2012 and available to buy since October, or .xxx, which was delegated and went to general availability in 2011.
While the .arpa gTLD also does not appear (for perfectly sane reasons), the list does include tightly controlled and restricted gTLDs such as .int and .mil, however.
Google treats .asia the same as the ccTLD .eu: a “regional top-level domain” that can be geo-targeted in the same way as a regular gTLD.
The rules appear to apply to the geo-targeting function in Webmaster Tools, which allows webmasters to specify whether their site is designed for only a certain nation or region.
Assuming the list, which was updated this week, is accurate, it’s just the latest example of Google dragging its feet on gTLD acceptance.
One would assume, with Google being an applicant for almost 100 new gTLDs, that before long its gTLD team will be able to affect change elsewhere in the company in a more timely fashion.

Google domain hijacked in Kenya

Google’s Kenyan web site was reportedly inaccessible yesterday due to a hijacking of the company’s local domain name.
Google.co.ke briefly redirected users to a site bearing the slogan “hacked” on a black background, according to the Daily Nation. A change of DNS was blamed.
Google Kenya reportedly said:

Google services in Kenya were not hacked. For a short period, some users visiting www.google.co.ke and a few other website were re-directed to a different website. We are in contact with the organisation responsible for managing domain names in Kenya.

Google is of course a high-profile target; hackers often exploit weaknesses at third-party providers such as domain name registries in order to take down its satellite sites.
Its Irish site was taken down in October last year, after attackers broke in through a vulnerability in IEDR’s Joomla content management system.

Chutzpah alert! “Tube” domainer objects to Google’s .tube gTLD bid

Remember the “mystery gTLD applicant” that had promised to campaign against Google’s closed generic gTLD applications?
It turns out the company behind the campaign is actually Latin American Telecom, one of the three applicants for .tube, and that part of its strategy is a Legal Rights Objection.
According to a copy of the LRO kindly provided to DI this week, LAT claims that if Google gets to run .tube it would harm its Tube brand, for which it has a US trademark.
If you haven’t heard of Latin American Telecom, it, despite the name, appears to be primarily a domainer play. Founded in Mexico and based in Pittsburgh, its main claim to fame seems to be owning Mexico.com.
The company says it has also been building a network of roughly 1,500 video sites, all of which have a generic word or phrase followed by “tube.com” in their domains, since 2008.
It owns, for example, the domains IsraelTube.com, MozartTube.com, LabradorTube.com, AmericanWaterSpanielTube.com, DeepSeaFishingTube.com… you get the idea.
They’re all cookie-cutter microsites that pull their video content from Vimeo. Most or all of them appear to be hosted on the same server.
I’d be surprised if some of LAT’s domains, such as BlockbusterTube.com, PlaymateTube.com, FortyNinersTube.com and NascarTube.com, didn’t have trademark issues of their own.
But LAT was also granted a US trademark for the word TUBE almost a year ago, following a 2008 application, which gives it a basis to bring an LRO against Google.
According to its LRO:

The proposed purposes of and registrant limitations proposed for .TUBE by Google demonstrate that the intended purpose of Google’s .TUBE acquisition is to deprive other potential registry operators of an opportunity to build gTLD platforms for competition and innovation that challenge YouTube’s Internet video dominance. It is clear that Google’s intended use for .TUBE is identical to Objector’s TUBE Domain Channels and directly competes with Objector’s pre-existing trademark rights

There’s quite a lot of chutzpah being deployed here.
Would LAT’s ramschackle collection of –tube domains have any meaning at all were YouTube not so phenomenally successful? Who’s leveraging whose brand here, really?
For LAT to win its objection it has to show, among other things, that its TUBE trademark is famous and that Google being awarded .tube would impair its brand in some way.
But the company’s LRO is vague when it come to answering “Whether and to what extent there is recognition in the relevant sector of the public of the sign corresponding to the gTLD”.
It relies surprisingly heavily on its Twitter accounts — which have fewer followers than, for example, DI — rather than usage of its web sites, to demonstrate the success of the TUBE brand.
I don’t think its objection to Google’s .tube application is a sure thing by any stretch of the imagination.
There is a third .tube gTLD applicant, Donuts, but it has not yet received any LROs, according to WIPO’s web site.