Subject: Re: [weirds] New Unified DNR/RIR Internet-Drafts

From: "John Levine" <[email-masked]>
Date: 12 Sep 2012 21:57:56 -0000

I support adopting all three of these as -00 drafts, so we can use them
as a starting point for future work.

>> https://datatracker.ietf.org/doc/draft-hollenbeck-weirds-unified-rdap-query

I have some minor niggles, but it's fine as an initial draft.

>> https://datatracker.ietf.org/doc/draft-newton-weirds-unified-json-response

Slightly more niggles, e.g., what fields are free format vs. fixed
syntax, but nothing that can't be fixed.

>> https://datatracker.ietf.org/doc/draft-hollenbeck-weirds-rdap-sec

This one needs more work, although I still would be OK adopting it as
a -00 with the understanding that we'll be addressing questions like
these:

* Does authentication work by sessions, i.e., you authenticate and get
a cookie or something to return for the rest of the session, or is
each query authenticated from scratch?

* Is there some way to do single sign on, authenticate yourself once
and reuse the credentials at other sites?  This could be handy for name
WHOIS if there's a hundred domains run by the same entity but with
separate servers, or ICANN does shared WHOIS accounts like they're
doing shared ZFA accounts.

* Assuming there's more than one authentication mechanism, how do you
figure how to authenticate yourself to what server?

There are probably others, but these ought to be enough to keep us
busy for a while.

By the way, I wouldn't dismiss client certs.  Take a look at
https://www.startssl.com/ which provides surprisingly good free SSL
certs.  When you set up an account, they provide an S/MIME cert that's
installed into your browser, and then works to authenticate you to
come back.  Somewhat to my surprise, it really works, with multiple
browsers.  Exporting the cert from one browser to another is a minor
pain, but no worse than remembering site passwords.

R's,
John