Subject: [dns-privacy] privacy respect... ICANN!!

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sat, 27 Jun 2015 14:42:38 +0200

Hello,

I received this note from my domain registrar that ICANN is going to expose
the information of domain holder to whois requests.

https://www.respectourprivacy.com/

Any comment?

Best,
Hosnieh

---

From: [email-masked]
Date: Sat, 27 Jun 2015 15:12:58 +0200 (CEST)

> https://www.respectourprivacy.com/

Having been at the abuse handling end of things, I'd be very glad to
see the real domain holder exposed. Domains by proxy makes any abuse
handling process much harder.

YMMV.

Steinar Haug, Nethelp consulting, [email-masked]

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sat, 27 Jun 2015 15:21:14 +0200

On Sat, Jun 27, 2015 at 02:42:38PM +0200,
 Hosnieh Rafiee <[email-masked]> wrote 

> Any comment?

My personal opinion is that it is a bad move from ICANN (and illegal
in European countries, where the european directive on personal data
protection is more important than ICANN rules). So, european ccTLD
won't follow it and I'm glad for it.

But it is completely unrelated to this working group: whatever ICANN
decides on this matter, the DNS will leak information (and we are here
to limit this leak: let me remind you that qname minimisation is
currently in Working Group Last Call in dnsop).

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sat, 27 Jun 2015 15:26:18 +0200

> > I received this note from my domain registrar that ICANN is going to
> > expose the information of domain holder to whois requests.
> >
> Having been at the abuse handling end of things, I'd be very glad to see
the
> real domain holder exposed. Domains by proxy makes any abuse handling
> process much harder.
> 

You only see the case from one points of view. If you change your points of
view and see it as an individual (not a company) who holds a domain, you
might change your way of thinking. It might be of no problem for companies
that anybody has their address but not a person. There are some threats
against a personal privacy from criminals. Because name and address can
gives criminals a possibility to  access more critical information about
this user. 

If someone wants to stop any spamming activities, he or she  can legally ask
for those information with the reason of spamming but exposing such critical
information to public is against privacy rights of an individual and allow
criminals to do more fraudulent activities with real personal information or
some fraudulent companies to use this opportunities to pre-sell their
products and submit it to those addresses. I see a big range of attacks by
only this simple information exposal. 

Best,
Hosnieh

---

From: [email-masked]
Date: Sat, 27 Jun 2015 16:52:54 +0200 (CEST)

> might change your way of thinking.

I've been in the position of an individual holding a domain (and having
my details published in whois) for around 20 years. I still like having
the details available.

In any case, this is not relevant to qname minimization - which I am
definitely in favor of. So I'll shut up about whois now.

---

From: Paul Hoffman <[email-masked]>
Date: Sat, 27 Jun 2015 07:57:13 -0700

> currently in Working Group Last Call in dnsop).

+1. If you want to have a constructive discussion about this topic that has some chance of changing the outcome, you should probably do it in ICANN, not in an unrelated WG in the IETF.

--Paul Hoffman

---

From: Jim Reid <[email-masked]>
Date: Sat, 27 Jun 2015 15:58:37 +0100

On 27 Jun 2015, at 14:26, Hosnieh Rafiee <[email-masked]> wrote:

> but exposing such critical information to public is against privacy rights

So get your local law enforcement and/or legislature to intervene. Please take your complaints there.

If you want to join in the latest battle in this never-ending screaming contest at ICANN, be my guest. ICANN's policy-making machinery is open to everyone. It cannot be influenced by a discussion in an IETF WG. Debating whois, and in particular ICANN policy development on the topic, is not relevant to this WG. DNS != whois.

IMO, the issues around ICANN's whois policies are intractable and will never converge on a consensus. There are two vocal and highly motivated constituencies who hold mutually exclusive positions. And speaking from personal experience, the intersection between ICANN's gTLD contract and national law can be a far from pleasant one.

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sat, 27 Jun 2015 17:41:32 +0200

> +1. If you want to have a constructive discussion about this topic that
has
> some chance of changing the outcome, you should probably do it in ICANN,
> not in an unrelated WG in the IETF.

I agree about ICANN decision that not relates to this group but not about
DNS privacy where directly relates to privacy of user .  My note had two
messages that ICANN decision only is a part of that but the important part
of it is that what are the privacy concerns of data processing and/or
information that are stored in a DNS server (with different RRtypes)

At the moment this group only focused on (to some extend) the privacy of a
particular end user (but not all as domain owners can be also an end user) .
In other word, the privacy of DNS server and data that are stored in the DNS
server. 

DNS is an IETF protocol. RRs are all defined at IETF. If some sensitive data
are not stored in DNS server in a form of different RRtypes, then the
decision of ICANN would not have any  impact on users' privacy. 

Hosnieh
BTW,I didn't follow the discussion on this qname minimization draft but if
it is about  minimizing data kept in DNS server, then that is a good start.

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Sat, 27 Jun 2015 19:12:35 +0200

Just correcting a part of the sentence that the meaning was different.

 In other word, the privacy of DNS server and data that are stored in the
DNS  server are also important but at the moment this group did not focus on
them. Especially when considering the NFV and a virtual DNS server, then...
the DNS storage is prune to many privacy attacks. 

<The following part is related to IANA, relation of whois database to DNS
and ICANN> So, sorry it was unrelated to this discussion here.
... then the decision of  ICANN would not have any  impact on users'
privacy....

Best,
Hosnieh

---

From: Joe Abley <[email-masked]>
Date: Sat, 27 Jun 2015 14:19:19 -0300

> it is about  minimizing data kept in DNS server, then that is a good start.

It's not, really, but if you were to read the document your comments
would be entirely on-topic here.

Joe

---

From: Rubens Kuhl <[email-masked]>
Date: Sat, 27 Jun 2015 15:15:45 -0300

> On Jun 27, 2015, at 9:42 AM, Hosnieh Rafiee <[email-masked]> wrote:
> 
> Hello,
> 

From an IETF perspective, WHOIS only relate to the old WHOIS port 43 specs and the to new RDAP specs, and none of those contain policy; what you are questioning is a possible policy decision, but that only belongs in the same venue where policy is developed. 

Rubens

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 28 Jun 2015 09:16:23 -0400

On Sat, Jun 27, 2015 at 9:12 AM, <[email-masked]> wrote:

> expose

Every security problem is trivial if you only consider one problem.

Members of my family have been subject to assassination attempts from time
to time. The last one resulted in the death of five people. There are very
good reasons for people to keep their home addresses private. These reasons
are vastly more consequential than the piddling problems people have with
domain names.

---

From: Doug Royer <[email-masked]>
Date: Sun, 28 Jun 2015 14:24:40 -0600

> ... There
> are very good reasons for people to keep their home addresses private.
> These reasons are vastly more consequential than the piddling problems
> people have with domain names. 
> 

So use a different address, I do.

-- 

Doug Royer - (http://K7DMR.us / http://DougRoyer.US)
[email-masked]
714-989-6135

---

From: Warren Kumari <[email-masked]>
Date: Mon, 29 Jun 2015 14:18:35 -0400

<chair hat>
So, the whole WHOIS topic is an endless blackhole of misery... ICANN
has a whole section of their site devoted to it, at
https://whois.icann.org/en/ , and *some* of the current issues at:
https://whois.icann.org/en/current-issues They even have a whole
section of privacy at: https://whois.icann.org/en/privacy

If you'd like to be involved, see:
https://whois.icann.org/en/get-involved -- the whole privacy /
anonymous subject is currently being hotly debated, and showing up in
the news, see: https://www.google.com/webhp?q=ICANN+whois&tbm=nws for
examples...

This topic, while important, is not about *DNS* privacy, it is about
*registration* privacy, so, we won't be discussing it here.
I encourage folk who care about this topic to participate in the ICANN
process - I attend all the ICANN meetings (and just got back from one
on Saturday) - I'll be happy to take you around and introduce you to
folk, etc.

W
</chair hat>

On Sun, Jun 28, 2015 at 4:24 PM, Doug Royer <[email-masked]> wrote:
> _______________________________________________
> dns-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dns-privacy
>

-- 
I don't think the execution is relevant when it was obviously a bad
idea in the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair
of pants.
   ---maf

---

From: Michele Neylon - Blacknight <[email-masked]>
Date: Mon, 29 Jun 2015 18:22:09 +0000

And if you can’t find Warren look for me - I’m always there too :)

--
Mr Michele Neylon
Blacknight Solutions
Hosting, Colocation & Domains
http://www.blacknight.host/
http://blog.blacknight.com/
http://www.blacknight.press - get our latest news & media coverage
http://www.technology.ie
Intl. +353 (0) 59  9183072
Direct Dial: +353 (0)59 9183090
Social: http://mneylon.social
Random Stuff: http://www.michele.irish/
-------------------------------
Blacknight Internet Solutions Ltd, Unit 12A,Barrowside Business Park,Sleaty
Road,Graiguecullen,Carlow,Ireland  Company No.: 370845