Subject: A DNS security issue that might actually have impact eventually

From: Phillip Hallam-Baker <[email-masked]>
Date: Sun, 12 Jan 2014 11:02:02 -0500

In recent news there have been two cases of DNS registrars being 'ordered'
to take down domain names and lock them against transfer. The city of
London police case is well known. There is also a Pharmacy industry group
asserting the 'right' to take down sites without a court order or any form
of due process.

http://www.techdirt.com/articles/20140110/12140025836/pharmacy-lobbyists-lie-to-registrars-if-we-complain-about-site-it-must-be-taken-down-no-questions-asked.shtml

What is worrying here is not just the lack of oversight in these particular
cases. If these practices become a regular occurrence they are going to be
interpreted as an attack and countermeasures will begin to emerge.

We have indeed already seen the emergence of one such countermeasure
'Namecoin' which applies Bitcoin to "replace" the DNS and according to some
this also "deprecates" the WebPKI.

The main application for Namecoin appears to be the same as the main
application for Bitcoin itself: Enabling the dotcom revolution to finally
extend to the provision of recreational pharmaceuticals. But the Namecoin
technology if successful would also be used for much more including
applications most of us support (dissident speech against authoritarian
regimes) and applications none of us support (child abuse, etc.).

At the moment use of Namecoin is restricted to a particular niche and is
unlikely to gain widespread acceptance. It is also a technology designed by
geeks for geeks in the finest tradition of calling anyone who can't grock
it a luser.

But if the principle of due process comes under further attack, we are
going to find ourselves in a different domain and the demand for a naming
infrastructure that is not exposed to the risk of arbitrary search and
seizure will grow.

-- 
Website: http://hallambaker.com/

---

From: Randy Bush <[email-masked]>
Date: Mon, 13 Jan 2014 06:42:49 +0900

the internet was a disruptive technology, and has been used for good,
bad, and indifferent.  thanks to societal forces, ongoing development of
disrupptive tools is at the edge, not the core.  bitcoin, namecoin, ...
are new disruptive technologies routing around the ossification,
cooption, and greed of the internet by LEO, NSA, ICANN, MPAA, ....
these new tools will be used for good, bad, and indifferent.

the tools which worry me are the ones where the use is only bad, e.g.
the spymall catalog.

> going to find ourselves in a different domain and the demand for a
> naming infrastructure that is not exposed to the risk of arbitrary
> search and seizure will grow.

yup.  i think of it as the internet body's white blood cells trying to
heal us from disease.

randy

---

From: [email-masked] (Dale R. Worley)
Date: Thu, 16 Jan 2014 15:16:14 -0500 (EST)

> From: Phillip Hallam-Baker <[email-masked]>

> interpreted as an attack and countermeasures will begin to emerge.

What appears is that certain organizations have been asserting rights
that they don't have.  Which is really a rather common practice in the
real world.  The central problem, IMO, is that the registrar, Public
Domain Registry, fell for these assertions.

In a sense, the registrar had sufficient oversight applied to it, as
EasyDNS took them to arbitration and won.  But it shouldn't take that
much effort to get a registrar to follow the rules.

It seems that the oversight that is needed is to ensure that
registrars are sufficiently punished for not following the rules that
they do follow the rules.

The analogy is with other organizations that hold valuable property
belonging to others.  For instance, a bank holds money that belongs to
other people.  People would not be particularly surprised if a random
person walked into a bank and attempted to obtain the money that
belonged to another person.  But they would be aghast if the bank did
give it to them.

Dale

---

From: Christopher Morrow <[email-masked]>
Date: Thu, 16 Jan 2014 15:46:16 -0500

On Sun, Jan 12, 2014 at 11:02 AM, Phillip Hallam-Baker <[email-masked]> wrote:
> to take down domain names and lock them against transfer. The city of London
> police case is well known. There is also a Pharmacy industry group asserting
> the 'right' to take down sites without a court order or any form of due
> process.

this has been going on for ~5+ years now, DHS/ICE asserts this sort of
authority almost daily on com/net (at least)... and has gotten into
the press several times for 'bad' takedowns. (there was a rather loud
incident with: Rojadirecta.org in 2001)

I don't quite understand how the above 2 examples are any different,
it'd be nice if gov'ts would stop asserting this sort of control
method :( especially since it's not particularly effective at stopping
bad actors.

-chris