Is the .home new gTLD doomed? ICANN poses study of security risks

ICANN has set up a study into whether certain applied-for new gTLD strings pose a security risk to the internet, admitting that some gTLDs may be rejected as a result.
Its board of directors on Saturday approved new research into the risk of new gTLD clashes with “internal name certificates”, saying that the results could kill off some gTLD applications.
In its rationale, the board stated:

it is possible that study might uncover risks that result in the requirement to place special safeguards for gTLDs that have conflicts. It is also possible that some new gTLDs may not be eligible for delegation.

Internal name certificates are the same digital certificates used in secure, web-based SSL transactions, but assigned to domain names in private, non-standard namespaces.
Many companies have long used non-existent TLDs such as .corp, .mail and .home on their private networks and quite often they obtain SSL certs from the usual certificate authorities in order to enable encryption between corporate resources and their internal users.
The problem is that browsers and other applications on laptops and other mobile devices can attempt to access these private namespaces from anywhere, not only from the local network.
If ICANN should set these TLD strings live in the authoritative DNS root, registrants of clashing domain names might be able to hijack traffic intended for secure resources and, for example, steal passwords.
That’s obviously a worry, but it’s one that did not occur to ICANN’s Security and Stability Advisory Committee until late last year, when it immediately sought out the help of the CA/Browser Forum.
It turned out the the CA/Browser forum, an alliance of certificate authorities and browser makers, was already on the case. It has put in new rules that state certificates issued to private TLDs that match new gTLDs will be revoked 120 days after ICANN signs a contract with the new gTLD registry.
But it’s still not entirely clear whether this will sufficiently mitigate risk. Not every CA is a member of the Forum, and some enterprises might find 120 day revocation windows challenging to work with.
Verisign recently highlight the internal certificate problem, along with many other potential risks, in an open letter to ICANN.
But both ICANN CEO Fadi Chehade and the chair of SSAC, Patrick Falstrom, have said that the potential security problems are already being addressed and not a reason to delay new gTLDs.
The latest board resolution appears to modify that position.
The board has now asked CEO Fadi Chehade and SSAC to “consider the potential security impacts of applied-for new-gTLD strings in relation to this usage.”
The Root Server Stability Advisory Committee and the CA/Browser Forum will also be tapped for data.
While the study will, one assumes, not be limited to any specific applied-for gTLD strings, it’s well known that some strings are more risky than others.
The root server operators already receive vast amounts of erroneous DNS traffic looking for .home and .corp, for example. If any gTLD applications are at risk, it’s those.
There are 10 remaining applications for .home and five for .corp.

3 Comments Tagged: ca/browser forum, ICANN, internal name certificates, rssac, security, ssac, ssl, verisign

Blow to domainers as Arab center approved to settle cybersquatting disputes

ICANN has approved a new UDRP resolution provider, the first to be based in the Arab region, despite the objections of domainers.
The Arab Center for Dispute Resolution will now be able to service UDRP complaints. But it won’t be bound to an ICANN contract, as had been demanded by the Internet Commerce Association and others.
The ACDR was approved by the ICANN board last week, almost three years after it originally applied for the privilege.
The board said in its rationale that the move would be good for geographic diversity and that its rigorous community review process highlighted community accountability.
On the issue of UDRP provider contracts, it merely noted:

commenters suggested that ICANN develop contracts with each of its UDRP providers as a means to require uniformity among providers. Contracts have never been required of UDRP providers.
…
the proposal now includes an affirmative recognition that if ICANN imposes further requirements on providers, the ACDR will follow those requirements

The ACDR will come as a knock to the ICA, which recently celebrated the fact that ICANN intends to have formal contracts with providers of Uniform Rapid Suspension services.

3 Comments Tagged: acdr, arab center for dispute resolution, cybersquatting, ICANN, udrp

No Las Vegas, alas. ICANN picks LA for 2014 meeting

ICANN has picked Los Angeles for the third of its three 2014 public meetings.
The decision was approved by its board of directors at its retreat in Amsterdam last week.
As you may know, ICANN’s meeting schedule cycles through its five geographic regions, and North America’s next turn comes next year, picking up hopes that it might finally choose Las Vegas.
Alas, we get LA instead.
According to the board’s resolution, the cost of holding a meeting in LA should come in a couple hundred grand below the price of holding it elsewhere, presumably due to reduced travel expenses.
It will be the fourth time ICANN has gathered community members in its home town, but the first time since 2007. Back when ICANN did four meetings a year, LA was the home of its annual general meetings.
Recent North American meetings have been held in Toronto, San Francisco and Puerto Rico. The Mexico City meeting in 2009 counts as Latin America on ICANN’s map of the world.
Singapore and London have already been named at 2014 venues for Asia and Europe respectively.

1 Comment Tagged: ICANN, los angeles

Directi gets into the subdomain game

Directi, fresh from relaunching .pw, will shortly start selling third-level domain names under .in.net, mimicking the pseudo-TLD business model most often associated with CentralNic.
The sub-domains will be targeted at the Indian market, with prices expected to be in the sub-$10 range.
Directi is set to launch June 17 with a 42 day “landrush & TM claims service”, apparently merging “premium” name registration with the trademark protection sunrise period.
General availability will begin August 1.
India’s ccTLD is of course .in, and .in.net looks a little bit like it.

1 Comment Tagged: .in.net, directi, pseudo-tlds

Did GMO flunk evaluation on 27 gTLDs? CentralNic takes over the whole lot

Did would-be new gTLD registry services provider GMO Registry fail its ICANN technical evaluations?
The Japanese company has made a deal that will see CentralNic take over the back-end operations for all 27 of the applications it was signed up to service, it has emerged.
In a letter, provided by GMO to ICANN last week as part of its sweeping application change requests, CentralNic says:

CentralNic Ltd has entered into a contract with GMO Registry, Inc. (GMO) to provide backend gTLD registry services for their generic top-level domains.

The letter (pdf) goes on to enumerate the 10 critical technical functions — basically everything from EPP to DNSSEC to registrar management — that CentralNic will be taking over.
The letter seems to have been attached last week to change requests for each of the 27 applications for which the DI PRO database lists GMO as the back-end registry provider.
That list includes big dot-brands such as .toshiba, .sharp and .nissan, generics such as .shop and .mail, and city TLDs including .tokyo and .osaka. Even the original dot-brand, .canon, and GMO’s own .gmo are switching back-ends.
The requested changes certainly seem to explain why GMO has yet to pass any of its Initial Evaluations (as we noted on Twitter a couple weeks back) despite having prioritization numbers as low as 111.
GMO parent GMO Internet may not be widely known outside of Japan, but it’s a pretty big deal. The company had 2012 revenue of about JPY 75 billion ($730 million) and it owns a top-ten registrar, Onamae.
Per ICANN rules, the change request switching the applications to CentralNic back-ends are open for public comment for 30 days.

5 Comments Tagged: centralnic, gmo registry, ICANN, initial evaluation, new gtld

Fly9 offers services to simplify new gTLD sales

Portland-based developer Fly9 launched last week, offering new gTLD registries a broad range of software designed to make it easier to sell domain names.
The company, founded by SnapNames and Afilias alum Ravi Surya, hopes its platform will help new gTLD operators tap into registrars’ customer bases in a soon-to-be-flooded market.
“The problem with new TLDs is they’ll all depend on registrars, but the registrars are all busy selling other things, like hosting, they’re not interested in selling your TLD,” Surya said.
For a start-up, only just coming out of stealth mode, three-year-old Fly9 seems to have an awful lot of products with an awful lot of features, judging by a quick demo we saw last week.
Perhaps most interesting is the core TLD Distribution Platform. It’s a software service designed to plug the gap between the registry back-end and the registrar/reseller and simplify channel management.
The idea is to make it easier for newbie registry operators to leverage registrars’ marketing clout, but without asking the registrar to do a lot of technical integration work.
Say you’ve been awarded .pumpkins by ICANN. It’s a niche TLD and registrars — spoiled for choice in a world of 500 new gTLDs — aren’t exactly clamoring to sign up to offer it.
Fly9’s service would enable you to give these registrars a way to very quickly start selling .pumpkin domains, using their own registrar accreditation and payment systems but using Fly9’s hosted, white-label microsite.
According to Surya, registry managers can use the service to sign up registrars as little as five minutes. Adding branding and customizing the site for the registrar would obviously take longer.
Registries can also elect to use Fly9’s partner registrar, NameSystem, and create a channel of resellers instead.
The Fly9 suite also includes services for handling pre-registrations, sunrise periods, and premium domain auctions and Surya said the service can also handle EPP extensions for restricted gTLDs.
Pricing is based on transaction volume, but the software has already been licensed to two major back-end registry technical providers, which Surya said he could not yet name.
LogicBoxes and Architelos are among those offering software services for new gTLD management, but I’d be hard pressed to think of another company doing precisely what Fly9 is right now.

3 Comments Tagged: channel management, fly9, new gTLDs, tld management

Two failures among latest 44 new gTLD results

ICANN has released its weekly batch of new gTLD Initial Evaluation results and it includes the program’s second and third failures.
Two dot-brand applications — .olayangroup and .mckinsey, filed by Olayan Investments and McKinsey Holdings — didn’t get passing scores and are now categorized as “Eligible for Extended Evaluation”.
Both — like the only other failure to date, also filed by Olayan — passed the technical evaluation but failed on question 45, which asks the applicant to provide financial statements.
The strings that have passed IE this week are:

.dog, .pharmacy, .sener, .skydrive, .soy, .sport, .grocery, .rightathome, .scjohnson, .jll, .hosting, .americanexpress, .yamaxun, .analytics, .construction, .land, .management, .systems, .surgery, .news, .data, .reisen, .rugby, .theater, .university, .cba, .ads, .how, .chrome, .vanguard, .meo, .lotte, .hughes, .praxi, .uno, .versicherung, .blog, .bmw, .shangrila, .yandex and .bbc

There are now 341 passing applications and three failures.

3 Comments Tagged: ICANN, initial evaluation, new gTLDs

Donuts puts 63 new gTLDs to private auction, but at least 17 are dead on arrival

Donuts has committed 63 of its 307 new gTLD applications to a private auction next month, but at least 17 of them are doomed already because rival Uniregistry won’t take part.
Donuts, which does not want to enter into joint ventures with competing gTLD applicants, has decided to use a private auction managed by Cramton Associates instead of an ICANN auction.
The first round of auctions are due to kick off June 3, but Cramton has set a deadline of next week for applicants to commit the strings they want to bid on.
Donuts has put forward these ones (note that they’re different to those reported elsewhere earlier due to a couple of typos in the original press release):

.apartments, .auction, .audio, .baseball, .boats, .cafe, .church, .college, .construction, .direct, .discount, .fish, .football, .forsale, .furniture, .fyi, .global, .gratis, .guide, .juegos, .jewelry, .legal, .living, .luxury, .phone, .photography, .plus, .red, .run, .storage, .theater, .trading, .vote, .beauty, .broadway, .city, .club, .forum, .garden, .help, .hosting, .hot, .marketing, .media, .memorial, .wedding, .chat, .online, .pizza, .sale, .salon, .school, .search, .show, .soccer, .team, .group, .site, .style, .law, .store, .blog, and .art.

Running the list through the DI PRO database, we quickly discover that 33 of these strings are in two-horse races, 13 have three applicants, nine have four and three have five.
The remaining four contention sets have six, seven, nine and 10 applicants respectively.
Uniregistry, the portfolio applicant run by domainer Frank Schilling, is involved in 17 of the contention sets, and Schilling confirmed to DI today that the company does not intend to participate.
As we’ve previously reported, Uniregistry says it has concerns that private auctions may be illegal under US antitrust law, though substantial doubt has been cast over that assertion since.
Because all applicants in a contention set need to commit for the auction to be meaningful, we can assume that at least 17 of Donuts’ proposed auctions will not go ahead, unless Uniregistry changes its mind.
Top Level Domain Holdings has applied for 13 of the strings Donuts wants to take to auction. TLDH has also expressed concern in the past about the private auction concept.
Directi, Famous Four Media and Google are each involved in eight of the contention sets, while Amazon is involved in five.
According to Cramton, each auction will take place in bidding rounds, with the first round having a maximum bid of $50,000 multiplied by the number of applicants and subsequent rounds increasing that by 10% multiplied by the number of bidders.
If any applicant in a given auction requests privacy, then the winning amount will not be disclosed.

1 Comment Tagged: auctions, cramton, donuts, ICANN, new gTLDs, private auctions

‘Whistleblower’ claims cronyism and fear at ICANN

An anonymous individual claiming to be an ICANN staffer has warned the organization’s board of directors about senior-level cronyism and a “climate of fear” among employees.
However, DI’s private conversations with other ICANN staffers suggest that the concerns may not be widely shared, at least not to the same extreme.
DI received a lengthy email yesterday in which it is claimed that hiring practices since last year have seen “incompetent” friends of CEO Fadi Chehade and COO Akram Atallah appointed to senior positions, which has hurt morale and proved divisive among employees.
Here are some extracts:

While it is natural for a new CEO or COO to bring in their own team, many senior hires to ICANN have been selected without going through an interviewing process, hired despite recommendation by staff to the contrary, in some cases with lack of relevant experience and not following basic business practices on the selection on the basis of merit. It in many cases has been replaced by hiring friends, family and neighbors.
…
In some cases these hires have turned out to be quite competent but in other cases they are flat-out incompetent. They not only will remain on staff because Akram views them as loyal but they have enjoyed additional responsibilities and promotions unfairly based on their relationship with Akram or Fadi.
…
Because of these hiring practices, staff morale is at a low point. Staff now falls into two camps: (1) those hired before Fadi (2) those hired after Fadi. There are a record number of employees looking for other jobs. Some have already left and if a significant number leave in the future, ICANNs qualified talent pool will suffer.

The email was unsigned and sent from an anonymized account, but includes sufficient detail that nobody who has seen it doubts that it came from an ICANN employee.
The author refers to an intern, briefly employed, who would have had little to no interaction with the rest of the community and was even unknown to some staff, for example.
I’ve confirmed that the email was sent to at least some members of the board of directors — currently holed up at a retreat in Amsterdam — at about the same time it was sent to DI.
The email lists about 10 current or former ICANN executives who, it is claimed, were hired because they are friends with either Atallah or Chehade or worked with them at other companies.
To the extent that the relationships detailed are professional, they’re easily confirmed by online resumes. Others have been confirmed privately by ICANN staffers.
While the email names names, I’m not going to.
Having spent the last day running the email author’s concerns privately by a handful of ICANN employees, I was unable to find the same degree of concern expressed by anyone.
Some I spoke to recognized the scenario outlined in the email — a new batch of senior staff aligned to the new boss and perhaps not yet fully integrated with the old guard — but said that this is to be expected whenever a new CEO takes over.
“I’m really surprised that someone feels so strongly,” said one staffer. “It’s not that horrendous, new CEOs bring in their people and we’re not going to appreciate them all.”
The phrase “climate of fear”, used in the email, invokes (possibly deliberately) the words of Maria Farrell, the former ICANN staffer who humiliated then-CEO Rod Beckstrom with a scathing public assessment of staff morale during the meeting in San Francisco two years ago.
But another message that also came through loud and clear talking to staff is that while morale might remain low, things at ICANN are a lot better than they were before Chehade took over.
“At least Fadi and his people seem competent,” one person said.

6 Comments Tagged: ICANN

Donuts hires the face of the new gTLD program

Portfolio gTLD applicant Donuts has hired Michele Jourdan, who until last week was head of new gTLD communications at ICANN.
She has joined the company as director of sales and marketing, according to her LinkedIn profile.
Applicants and others following the program closely will remember her from the regular update videos published by ICANN.
She worked for ICANN for almost five years, but only in the last year or so started to take a visible front seat role in interactions with community members. I understand she left ICANN a week ago.
Jourdan is not the first ICANN alum Donuts has taken on.
Its CFO is former ICANN CFO Kevin Wilson, and we recently learned that former new gTLD program manager Kurt Pritz has been recruited, non-exclusively, as a consultant.

2 Comments Tagged: donuts, ICANN, new gTLDs