Reminder: Deadline for input to Transfer PDP Initial Draft for Phase 1A is May 14, 2022
Dear all, A friendly reminder to give your input to the Draft Initial Report for phase 1a. If there are charter questions that At-Large would like to be worded differently, please update https://docs.google.com/document/d/1_wY631ybdRAwieTUsSR8uEcfTimwoP592oP93Sv1... in the corresponding section. The draft initial report is attached to this email. In my opinion – but not necessary all At-Large Working Group members view, is that the discussion and recommendations in the PDP WG, will be an improvement for a secure and smooth transfers of gTLD domain names from one accredited registrar to a new registrar. After the deadline, the working group will spend the following four working group meetings reviewing the items submitted in the input document. If your groups are unable to provide input by 14 May, feedback on the Initial Report can be provided during the public comment period. Regards, Steinar Grøtterød
On Mon, May 09, 2022 at 09:57:22AM +0000, Steinar Grøtterød via CPWG wrote:
A friendly reminder to give your input to the Draft Initial Report for phase 1a.
My business duties in the last few days was more than expected, so I'm late in adding comments.
After the deadline, the working group will spend the following four working group meetings reviewing the items submitted in the input document. If your groups are unable to provide input by 14 May, feedback on the Initial Report can be provided during the public comment period.
That's the main point. The requested input right now is primary to find missing or errornous parts in the initial report. There is no expectation of deep discussions, they will be expected during the upcoming public comment phase. By my reading of the initial report and the AtLarge "Draft responses" I do not miss anything important (besides the point, that the FOAs are removed in exchange for a promise to have an easy to use rollback mechanism later) or misleading.
On Sat, May 14, 2022 at 11:48:25PM +0200, Lutz Donnerhacke via CPWG wrote:
By my reading of the initial report and the AtLarge "Draft responses" I do not miss anything important (besides the point, that the FOAs are removed in exchange for a promise to have an easy to use rollback mechanism later) or misleading.
Please let me explain my point by quoting some lines of the "TRP Initial Report Draft", lines 576-580 (https://community.icann.org/display/TPRPDP/Working+Documents?preview=/167543...) ----- Taking into account these considerations, the working group determined that the Losing FOA requirement should be eliminated and replaced with new requirements. These new requirements allow the transfer to occur in nearly real time while ensuring that: 1. The RNH is informed of an inter-Registrar transfer and 2. A sufficient record of the process is maintained to support investigation of complaints and resolution of disputes. ----- As far as my memory told me, this was one of the occurences of this "promise of an quick-reverse mechanism". But this promise is missing in the draft. OTOH on the same page there is a mentioning of a "TAC notification" which seems to replace the "Losing FOA", but can not stop the initiated transfer. There is a time window to transfer the domain using the TAC which is send out at roughly the same time as the notification, so the TAC can be used before the registrant had time to react (given, that most registrans do not read email every day). In lines 606-629 that a "Notification of Transfer Complete" must be send. This might also be called "Damage report", if something went wrong. I.e. the registrants notification email is using the domain name, which was transfered maliciously, so the attacker can redirect all emails and filter the notification. So the line 628/629 instructions how to revert a domain transfer might not reach the (former) registrant. Yes, this is not part of the currenct process, but should be raised during the public comment phase.
On Sat, May 14, 2022 at 11:48:25PM +0200, Lutz Donnerhacke via CPWG wrote:
misleading.
An other example for misleading wording is the partial(!) replacement of "registrant" with "RNH" (aka Registered Name Holder) without providing a clear definition and differenciation of those terms. I like you to let this sink.
participants (2)
-
Lutz Donnerhacke -
Steinar Grøtterød