Subject: [DNSOP] What is an authoritative domain?

From: "Yngve N. Pettersen" <[email-masked]>
Date: Wed, 12 Mar 2008 15:01:12 -0400

Hello all,

Two years ago I posted two drafts about a problem with restricting  
distribution of HTTP cookies within TLDs that have one or more layers of  
registry-like domains, such as the .uk, .no and .us domains.

I also gave a presentation to this WG at the meeting in Montreal.

Since Montreal, there have been a couple of developments, primarily that  
Mozilla has continued work on its "Effective TLD" database[1], and is now  
using it in Firefox 3, for example to emphasize information in the address  
bar, and that Internet Explorer 8 (beta) is doing something similar [2]  
(AFAIK based on the same database [3] as Mozilla). Additionally, I have  
the impression that a related issue has emerged in DKIM.

Some argue that the way cookies and Effective TLD use domain names is  
incorrect, and/or based on wrong assumptions about DNS names and the DNS  
hierarchy, but the domains are used this way because there may not  
currently be any feasible alternatives.

The problem area can possibly be defined as "How do we determine that two  
host names and/or domains within a specific hirearchy are administrated by  
the same entity?" .

CFrom [email-masked]  Wed Mar 12 12:07:29 2008
Date: Wed, 12 Mar 2008 15:01:12 -0400
To: "IETF DNSOP WG" <[email-masked]>
From: "Yngve N. Pettersen" <[email-masked]>
Organization: Opera Software ASA
Subject: [DNSOP] What is an authoritative domain?
Sender: [email-masked]

Hello all,

Two years ago I posted two drafts about a problem with restricting  
distribution of HTTP cookies within TLDs that have one or more layers of  
registry-like domains, such as the .uk, .no and .us domains.

I also gave a presentation to this WG at the meeting in Montreal.

Since Montreal, there have been a couple of developments, primarily that  
Mozilla has continued work on its "Effective TLD" database[1], and is now  
using it in Firefox 3, for example to emphasize information in the address  
bar, and that Internet Explorer 8 (beta) is doing something similar [2]  
(AFAIK based on the same database [3] as Mozilla). Additionally, I have  
the impression that a related issue has emerged in DKIM.

Some argue that the way cookies and Effective TLD use domain names is  
incorrect, and/or based on wrong assumptions about DNS names and the DNS  
hierarchy, but the domains are used this way because there may not  
currently be any feasible alternatives.

The problem area can possibly be defined as "How do we determine that two  
host names and/or domains within a specific hirearchy are administrated by  
the same entity?" .

Currently, this question is answered by some applications by assuming that  
every server and subdomain within a domain is administrated by the owner  
of that domain, but there are problems with this when drawing the line  
between the registry and the ordinary domain owners within the domain  
controlled by the registry.

I believe this problem area needs to be investigated by the DNSop WG, or  
another group within the IETF with expertise in the area.

The drafts I have published are suggestions for how the problem can be  
(partially) solved within the framework my application (a Web Browser)  
works, but there are probably good alternatives or other complementary  
solutions that should be explored.

For more information see:

Drafts:
http://www.ietf.org/internet-drafts/draft-pettersen-dns-cookie-validate-03.txt
http://www.ietf.org/internet-drafts/draft-pettersen-subtld-structure-03.txt
(related:  
http://www.ietf.org/internet-drafts/draft-pettersen-cookie-v2-02.txt )

[1] http://wiki.mozilla.org/Gecko:Effective_TLD_Service
[2] <URL:  
http://blogs.msdn.com/ie/archive/2008/03/11/address-bar-improvements-in-internet-explorer-8-beta-1.aspx  
[3] http://www.publicsuffix.org/

Background:

http://my.opera.com/yngve/blog/show.dml/267415
(Related: http://my.opera.com/yngve/blog/show.dml/388840 )

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: [email-masked]
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

urrently, this question is answered by some applications by assuming that  
every server and subdomain within a domain is administrated by the owner  
of that domain, but there are problems with this when drawing the line  
between the registry and the ordinary domain owners within the domain  
controlled by the registry.

I believe this problem area needs to be investigated by the DNSop WG, or  
another group within the IETF with expertise in the area.

The drafts I have published are suggestions for how the problem can be  
(partially) solved within the framework my application (a Web Browser)  
works, but there are probably good alternatives or other complementary  
solutions that should be explored.

For more information see:

Drafts:
http://www.ietf.org/internet-drafts/draft-pettersen-dns-cookie-validate-03.txt
http://www.ietf.org/internet-drafts/draft-pettersen-subtld-structure-03.txt
(related:  
http://www.ietf.org/internet-drafts/draft-pettersen-cookie-v2-02.txt )

[1] http://wiki.mozilla.org/Gecko:Effective_TLD_Service
[2] <URL:  
http://blogs.msdn.com/ie/archive/2008/03/11/address-bar-improvements-in-internet-explorer-8-beta-1.aspx  
[3] http://www.publicsuffix.org/

Background:

http://my.opera.com/yngve/blog/show.dml/267415
(Related: http://my.opera.com/yngve/blog/show.dml/388840 )

-- 
Sincerely,
Yngve N. Pettersen

********************************************************************
Senior Developer                     Email: [email-masked]
Opera Software ASA                   http://www.opera.com/
Phone:  +47 24 16 42 60              Fax:    +47 24 16 40 01
********************************************************************
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Måns Nilsson <[email-masked]>
Date: Wed, 12 Mar 2008 22:03:34 +0100

--On onsdag, onsdag 12 mar 2008 15.01.12 -0400 "Yngve N. Pettersen"
<[email-masked]> wrote:

>  host names and/or domains within a specific hirearchy are administrated
> by   the same entity?" .

You are, as others no doubt have told you, hammering shut a square leak
with a round peg. 

The ugly hack answer to your question is to ask for the triplet
nodename-class-some_unallocated_recordtype and check whether the SOA record
returned in the AUTHORITY is identical. (NB: That a "solution" can be
devised as above is by no means an endorsement of this practice)

Now, this information, since it is used in a security verification context,
is useless, even dangerous, without DNSSEC. 

OTOH, with DNSSEC, you can determine this securely, and the methods are a
bit nicer. 

I remain unconvinced, though, that this is a problem best solved by
assuming things about the administrative domain limits that might or might
not correlate with the administrative authority structure of the DNS. 
-- 
Måns Nilsson                     Systems Specialist
+46 70 681 7204   cell                       KTHNOC
+46 8 790 6518  office                  MN1334-RIPE

I'm also pre-POURED pre-MEDITATED and pre-RAPHAELITE!!
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Måns Nilsson <[email-masked]>
Date: Wed, 12 Mar 2008 22:03:34 +0100