Domain security arrives in .com

VeriSign announced late yesterday that it has fully implemented DNSSEC in .com, meaning pretty much anyone with a .com domain name can now implement it too.
DNSSEC is a domain-crypto protocol mashup that allows web surfers, say, to trust that when they visit wellsfargo.com they really are looking at the bank’s web site.
It uses validatable cryptographic signatures to prevent cache poisoning attacks such as the Kaminsky Bug, the potential internet-killer that caused panic briefly back in 2008.
With .com now supporting the technology, DNSSEC is now available in over half of the world’s domains, due to the size of the .com zone. But registrants have to decide to use it.
I chatted to Matt Larson, VeriSign’s VP of DNS research, and Sean Leach, VP of technology, this afternoon, and they said that .com’s signing could be the tipping point for adoption.
“I feel based on talking to people that everybody has been waiting for .com,” Larson said. “It could open the floodgates.”
What we’re looking at now is a period of gradual adoption. I expect a handful of major companies will announce they’ve signed their .coms, probably in the second half of the year.
Just like a TLD launch, DNSSEC will probably need a few anchor tenants to raise the profile of the technology. Paypal, for example, said it plans to use the technology at an ICANN workshop in San Francisco last month, but that it will take about six months to test.
“Most people have their most valuable domains in the .com space,” said Leach. “We need some of the big guys to be first movers.”
There’s also the issue of ISPs. Not many support DNSSEC today. The industry has been talking up Comcast’s aggressive deployment vision for over a year now, but few others have announced plans.
And of course application developer support is needed. Judging from comments made by Mozilla representatives in San Francisco, browser makers, for example, are not exactly champing at the bit to natively support the technology.
You can, however, currently download plugins for Firefox that validate DNSSEC claims, such as this one.
According to Leach, many enterprises are currently demanding DNSSEC support when they buy new technology products. This could light a fire under reluctant developers.
But DNSSEC deployment will still be slow going, so registries are doing what they can to make it less of a cost/hassle for users.
Accredited registrars can currently use VeriSign’s cloud-based signing service for free on a trial basis, for example. The service is designed to remove the complexity of managing keys from the equation.
I’m told “several” registrars have signed up, but the only one I’m currently aware of is Go Daddy.
VeriSign and other registries are also offering managed DNSSEC as part of their managed DNS resolution enterprise offerings.
Neither of the VeriSign VPs was prepared to speculate about how many .com domains will be signed a year from now.
I have the option to turn on DNSSEC as part of a Go Daddy hosting package. I probably will, but only in the interests of research. As a domain consumer, I have to say the benefits haven’t really been sold to me yet.

Comment Tagged: .com, DNSSEC, verisign

Greek IDN blocked due to non-existent domain

Greece’s request for .ελ, a version of .gr in its local script, was rejected by ICANN because it looked too much like .EA, a non-existent top-level domain, it has emerged.
Regular readers will be familiar with the story of how Bulgaria’s request for .бг was rejected due to its similar to Brazil’s .br, but to my knowledge the Greeks had not revealed their story until this week.
In a letter to the US government, George Papapavlou, a member of ICANN’s Governmental Advisory Committee, called the process of applying for an IDN ccTLD “long and traumatic”.
He said that Greece had to jump through “completely unnecessary” hoops to prove its chosen string was representative of the nation and supported by its internet community, before its application was finally rejected because it was “confusingly similar” to a Latin string.
“IANA has no right to question languages or local Internet community support. Governments are in the position of expressing their national Internet communities,” Papapavlou wrote.

The capital letters version of .ελ (ΕΛ) was considered to be confusingly similar to the Latin alphabet letters EA. The possibility of such confusion for a Greek language speaker, who uses exclusively Greek alphabet to type the whole domain name or address, to then switch into capital letters and type EA in Latin alphabet is close to zero. After all, there is currently no .ea or .EA ccTLD.

That’s true. There is no .ea. But that’s not to say one will not be created in future and, due to the way ccTLD strings are assigned, ICANN would not be able to prevent it on stability grounds.
Papapavlou called for “common sense” to be the guiding principle when deciding whether to approve an IDN ccTLD or not.
That is of course only one side of the story. Currently, ICANN/IANA does not comment on the details of ccTLD delegations, so it’s the only side we’re likely to see in the near future.

20 Comments Tagged: .gr, .ελ, cctlds, greece, iana, ICANN, idns

Those April 1 Headlines in Full

Too many ideas, not enough time.
These are some of the stories I would have written if there were more hours in the day…

Joan Rivers dies after head transplant surgery
UK banishes cybercrime sites to .au
Transparency review calls for ICANN reality show
UDRP panelist returns Taiwan to China
Bob Parsons shoots BigJumbo CEO
“Pigeon shit” blamed for Playboy plague
Hank Alvarez named ICANN compliance chief
Constantine Roussos says DNS needs “more cowbell”
NATO apologizes for Bit.ly bombing
Blacknight unveils leprechaun mascot
RIAA says .so domains “haven for piracy”
DomainTools merges with DomainJerks
BBC to apply for .cotton
ICANN successfully delays heat death of universe
Parsons apologizes, resurrects elephant

6 Comments Tagged: it's friday

‘Hostel’ director slams Go Daddy CEO

Okay, this is getting weird.
Eli Roth, director of Hostel – one of the sickest horror films of recent years – has criticized Go Daddy CEO Bob Parsons for his controversial elephant-hunting video.
In a series of Twitter posts last night, Roth condemned Parsons for his video, saying, among other things: “It’s sick fucks like you that make me think Hostel could really happen.”
If you haven’t seen Hostel, it’s basically about an Eastern European gang that lets wealthy Americans torture and murder kidnapped backpackers in exchange for a hefty fee.
It’s just about as grim a movie as you could imagine.
Here’s a screenshot of some of Roth’s tweets.

Compounding the weirdness, Roth was later retweeted by Russell Crowe.

Comment Tagged: bob parsons, elephants, eli roth, go daddy, hostel

Porn affiliate network to shun .xxx

The Free Speech Coalition has announced support for its .xxx boycott from what looks to be a significant player in the porn affiliate network market.
Gamma Entertainment, which runs programs such as LiveBucks.com, said it plans to defensively register some of its brands in .xxx.
But for every dollar the company spends with ICM Registry, it also plans to make a matching donation to the top-level domain’s opponents, such as the FSC.
Xbiz quotes Gamma president Karl Bernard: “Gamma is committed to using our resources to lead by example – by pledging our support in the efforts to combat ICM’s .xxx.”
The company will continue to focus development on its .com web sites, according to the article.
The FSC announced its boycott earlier this week, to signal its objection to ICANN’s approval of the TLD.

2 Comments Tagged: free speech coalition, fsc, gamma entertainment, icm registry, xxx

Short .tel domains coming June 1

Telnic, the .tel registry, is to start selling short and numeric .tel domain names from June 1.
The company announced today that two-character and numeric-only .tel domains will first be subject to a premium-price landrush, followed by general availability from June 14.
It’s the first time you’ll be able to register domains containing only numerals, but you won’t be able to register anything with more than seven digits, including hyphens.
This would presumably rule out phone numbers including area codes in most if not all places.
All two-letter strings that correspond to existing country-code top-level domains are also reserved, as are all one-letter strings, whether they be numeric or alphabetic.
The release follows Telnic’s moderately controversial request to ICANN to liberalize its registration policies, which I previously covered here and here.

3 Comments Tagged: .tel, landrush, telnic

New UDRP guidelines reflect unpredictability

Cybersquatting cases filed under the Uniform Dispute Resolution Policy have become less predictable, judging from complex new guidelines for adjudication panels.
The World Intellectual Property Organization has just published WIPO Overview 2.0, which sets out over 10 years of UDRP precedent for panelists to consider when deciding future cases.
The document is a must-read for domain investors and trademark holders.
Updated for the first time since 2005, it contains new sections covering developments such as registrar parking, automatically generated advertising and proxy/privacy services.
The Overview has quadrupled in length, from 5,000 to 20,000 words. With that, has come increased complexity. WIPO notes:

While predictability remains a key element of dispute resolution systems, neither this WIPO Overview nor prior panel decisions are binding on panelists, who will make their judgments in the particular circumstances of each individual proceeding.

The document reflects decisions already made, rather than creating new law, but as such it also reflects the tilting balance of the UDRP in favor of complainants.
For example, while the 2005 guidelines presented majority and minority views on whether [trademark]sucks.com domains meet the “confusing similarity” criterion, Overview 2.0 presents only a “consensus view” that they do, suggesting that it is now settled law.
On whether parking a domain with PPC ads meets the “legitimate interests” criterion, the guidelines refer to precedent saying that the ads must not capitalize on a trademark:

As an example of such permissible use, where domain names consisting of dictionary or common words or phrases support posted PPC links genuinely related to the generic meaning of the domain name at issue, this may be permissible and indeed consistent with recognized sources of rights or legitimate interests under the UDRP, provided there is no capitalization on trademark value

Supporting this view, the Overview states that “bad faith” can be shown even if the domain owner does not control the content of their parked pages and makes no money from the ads:

Panels have found that a domain name registrant will normally be deemed responsible for content appearing on a website at its domain name, even if such registrant may not be exercising direct control over such content – for example, in the case of advertising links appearing on an “automatically” generated basis… It may not be necessary for the registrant itself to have profited directly under such arrangement

There is a defense to this, if the respondent can show they had no knowledge of the complainant’s trademark and made no effort to control or profit from the ads.
Because the UDRP calls for “registration and use in bad faith”, the guidelines also ask: “Can bad faith be found if the disputed domain name was registered before the trademark was registered or before unregistered trademark rights were acquired?”
The original guidelines said no, with a carve-out for cases where the squatter anticipated, for example, a future corporate merger (microsoftgoogle.com) or product release (ipad4.com).
The new guidelines are a lot less clear, calling it a “developing area of UDRP jurisprudence”. The document lists several cases where panelists have chosen to essentially set aside the registration date and concentrate instead just on bad faith usage.
The question of whether a renewed domain counts as a new registration is also addressed, and also has a couple of exceptions to give panelists more flexibility in the decisions.
The Overview covers a lot of ground – 46 bullet points compared to 26 in the first version – and will no doubt prove invaluable reading for people filing or fighting UDRP cases.
The guidelines are not of course set in stone. The 2005 version read:

The UDRP does not operate on a strict doctrine of precedent. However, panels consider it desirable that their decisions are consistent with prior panel decisions dealing with similar fact situations. This ensures that the UDRP system operates in a fair, effective and predictable manner for all parties

But the new version adds a caveat to the end of the sentence: “while responding to the continuing evolution of the domain name system.”

2 Comments Tagged: udrp, wipo

Too many ideas, not enough time.
These are some of the stories I would have covered today, if only there were more hours in the day.
Joan Rivers dies after head transplant surgery
UK government banishes cybercrime sites to .au
Transparency review calls for ICANN reality show
UDRP panelist returns Taiwan to China
Bob Parsons shoots BigJumbo CEO
“Pigeon shit” blamed for Playboy plague
Hank Alvarez named ICANN compliance chief
Constantine Roussos says DNS needs “more cowbell”
NATO apologizes for Bit.ly bombing
Blacknight unveils leprechaun mascot
RIAA says .so domains “haven for piracy”
DomainTools merges with DomainJerks
BBC to apply for .cotton
ICANN successfully delays heat death of universe
Parsons apologizes, resurrects elephant
There’s at least 15 stupidly obscure in-jokes there. Probably more. How many did you “get” without Googling?
15 – Congratulations! You’re me. Or a potential future spouse. Call me!
10-14 – You truly are a domain name industry nerd, the depth and breadth of your knowledge covering both domaining and ICANN politicking. You’ve probably been to ICANN meetings and DomainFest. You should be both immensely proud and profoundly ashamed of yourself.
6-10 – I’m proud to have you as a reader. You’re exactly the type of well-balanced individual I’m hoping to attract to this site. Why not try visiting one of my advertisers and purchasing something?
1-5 – Must try harder! Your insight into the industry is sadly lacking. Perhaps consider subscribing to my RSS and Twitter feeds, which can be found at at the top of the left-hand sidebar, in order to bulk up your knowledge base.
0 — You appear to have visited this blog by mistake. Were you searching for “group porn”? I get a lot of hits for that. Nothing to see here, please move along.

Comment

UDRP filings hit new record

The World Intellectual Property Organization handled more cybersquatting cases in 2010 than in any other year to date, according to just-released statistics.
WIPO said today it received 2,696 UDRP complaints last year, up 28% over 2009’s 2,107 cases.
But the number of domains covered by these cases actually slipped a little, from 4,688 to 4,370, according to WIPO.
Since the policy was created in 1999, WIPO says it has decided over 20,000 UDRP complaints, covering over 35,000 domain names in 65 TLDs.
It may sound like a lot, but it’s actually a vanishingly small percentage of the 205.3 million domain names that are registered across all TLDs today.

1 Comment Tagged: udrp, wipo

.xxx introduces the 48-hour UDRP

The forthcoming .xxx top-level domain will have some of the strictest abuse policies yet, including a super-fast alternative to the UDRP for cybersquatting cases.
With ICM Registry likely to sign its registry contract with ICANN soon, I thought I’d take another look at some of its planned policies.
I’d almost forgotten how tight they were.
Don’t expect much privacy
ICM plans to verify your identity before you register a .xxx domain.
While the details of how this will be carried out have not yet been revealed, I expect the company to turn to third-party sources to verify that the details entered into the Whois match a real person.
Registrants will also have to verify their email addresses and have their IP addresses recorded.
Whois privacy/proxy services offered by registrars will have to be pre-approved by ICM, “limited to services that have demonstrated responsible and responsive business practices”.
Registrants using such services will still have their full verified details stored by the registry, in contrast to TLDs such as .com, where the true identity of a registrant is only known to the proxy service.
None of these measures are foolproof, of course, but they would raise barriers to cybersquatting not found in other TLDs.
Really rapid suspension
The .xxx domain will of course abide by the UDRP when it comes to cybersquatting complaints, but it is planning another, far more Draconian suspension policy called Rapid Takedown.
Noting that “the majority of UDRP cases involve obvious variants of well-known trademarks”, ICM says it “does not believe that the clearest cases of abusive domain registration require the expense and time involved in traditional UDRP filings.”
The Rapid Takedown policy is modeled on the Digital Millennium Copyright Act. Trademark holders will be able to make a cybersquatting complaint and have it heard within 48 hours.
Complaints will comprise a “simple statement of a claim involving a well-known or otherwise inherently distinctive mark and a domain name for which no conceivable good faith basis exists”.
A “response team” of UDRP panelists will decide on that basis whether to suspend the domain, although it does not appear that ownership will be transferred as a result.
X strikes and you’re out
ICM plans to disqualify repeat cybersquatters from holding any .xxx domains, whether all their domains infringe trademarks or not.
The policy is not fully fleshed out, so it’s not yet clear how many infringing domains you’d have to own before you lose your .xxx privileges.
High-volume domain investors would therefore be advised to make sure they have clean portfolios, or risk losing their whole investment.
Gaming restrictions
ICM plans to allow IP rights holders to buy long-term, deep-discount registrations for non-resolving .xxx domains. As I’ve written before, Disney doesn’t necessarily want disney.xxx to point anywhere.
That would obviously appeal to volume speculators who don’t fancy the $60-a-year registry fee, so the company plans to create a policy stating that non-resolving domains will not be able to convert to normal domains.
There’s also going to be something called the Charter Eligibility Dispute Resolution Process, which which “will be available to challenge any resolving registration to an entity that is not qualified to register a resolving name in the .xxx TLD”.
This seems to suggest that somebody (think: a well-funded church) who does not identify as a member of the porn industry would be at risk of losing their .xxx domains.
The CEDRP, like most of the abuse policies the registry is planning, has not yet been fully fleshed out.
I’m told ICM is working on that at the moment. In the meantime, its policy plans are outlined in this PDF.

1 Comment Tagged: abuse, ICANN, icm registry, rapid takedown, whois, xxx