July 2009 - RegistryService

Follow-up on previous email
by Patrick Jones July 11, 2009

July 11, 2009

Mason, The last line of my previous email should have read: ICANN would publish any change to the RRA for comment and encourages continued consultation between VeriSign and registrars on operational concerns with implementation of the service on a voluntary basis. I understand those consultations will be occurring soon. Patrick -- Patrick L. Jones Registry Liaison Manager & Support to ICANN Nominating Committee Internet Corporation for Assigned Names & Numbers 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292 Tel: +1 310 301 3861 patrick.jones(a)icann.org patrickjones.tel

1 0

Registrar Constituency Position on VeriSign's Proposed Registry Service Requests
by Clarke D. Walton July 11, 2009

July 11, 2009

July 9, 2009 Registrar Constituency Position on VeriSign's Proposed Registry Service Requests BACKGROUND VeriSign, Inc. ("VeriSign") recently submitted several Registry Service Requests to ICANN. Among its proposals, VeriSign submitted requests for a "Registry-Registrar Two-Factor Authentication Service" and a "Domain Name WhoWas Service" (collectively, the "Proposed Services"). This Position Paper captures the overall sentiment expressed by the RC Members who provided feedback about these Proposed Services. Due to time constraints, however, no formal vote regarding this Position Paper was taken. RC POSITION The RC is concerned with certain statements contained in the Proposed Service applications related to VeriSign's communication related to the Proposed Services. For example, page "3" section (c) of the Domain Name WhoWas Service application asks: "Were consultations with other constituency groups appropriate? Which groups were consulted? What were the nature and content of these consultations?" VeriSign's response is: "VeriSign has discussed this concept with members of the Intellectual Property Constituency and Registrar Constituency. VeriSign received positive feedback from these initial discussions, especially with respect to the registry providing an authoritative source of historical registration data." (emphasis added). Furthermore, page 2 section (b) of the Domain Name WhoWas Service application asks: "Were consultations with gTLD registrars or the registrar constituency appropriate? Which registrars were consulted? What were the nature and content of the consultation?" (emphasis added). VeriSign's response is: "VeriSign is currently discussing the Domain Name WhoWas concept with both registrars and non-registrars." Similar responses were provided regarding the Two-Factor Authentication Service. The RC notes that VeriSign's answers are not fully responsive to the questions. The RC believes that VeriSign should identify the nature of its consultations with registrars, without necessarily providing the names of the individual registrars. The RC also does not believe that consultations with individual members should supplant consultations with the constituency group as a whole. The RC is concerned that consultation between VeriSign and registrars on the Proposed Services have, thus far, been insufficient. To date, no known consultations between VeriSign and the RC have occurred, and it is unclear which RC members, if any, were consulted. Because these Proposed Services may directly impact registrars, the RC believes that a formal consultation process between VeriSign and the RC is appropriate. Accordingly, the RC requests that ICANN delay making a preliminary determination until July 31, 2009 to give VeriSign time to appropriately consult with the RC. This will allow the RC time to fully understand the proposed registry services, and provide the necessary information for ICANN to make an informed preliminary determination as called for under the Registry Services Evaluation Policy. The RC generally believes that consultation on proposed Registry Service Requests is extremely important. Accordingly, the RC requests that ICANN not approve any registry funnel requests that do not fully and completely respond to the questions related to consultations. Moreover, the RC offers to assist ICANN and the Registry Constituency in establishing a formal process for RC consultations on future Registry Service Requests. The RC believes that a formal consultation process for these and future applications would reduce the risk of mis-understandings between registrars and registries. The RC is not commenting on the substantive nature of the Proposed Service applications at this time, however it anticipates possibly offering substantive comments after the requested consultations. CONCLUSION The opinions expressed by the RC in this Position Paper should not be interpreted to reflect the individual opinion of any particular RC member.

1 0

Request for additional time on VeriSign's Registry-Registrar Two-Factor Authentication Service proposal
by Patrick Jones July 11, 2009

July 11, 2009

Mason, This is in response to the comment from the Registrar Constituency on VeriSign's request for the Registry-Registrar Two-Factor Authentication Service posted at http://forum.icann.org/lists/registryservice/msg00026.html. Under the Registry Services Evaluation Policy (http://www.icann.org/en/registries/rsep/rsep.html) ICANN is obligated to review and provide a preliminary determination on proposed registry services for competition and security & stability issues in 15-calendar days. ICANN has reviewed the request and notes that VeriSign may deploy as a voluntary optional service, but if made a requirement for registrar-registry communications, a description of the two-factor authentication may need to be added into the Registry-Registrar Agreement (Appendix 8 of the dot-com and dot-net Registry Agreements). ICANN would publish any change to the RRA for comment and encourages continued consultation between ICANN and registrars on operational concerns with implementation of the service on a voluntary basis. Please let me know if you have additional questions. Patrick -- Patrick L. Jones Registry Liaison Manager & Support to ICANN Nominating Committee Internet Corporation for Assigned Names & Numbers 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292 Tel: +1 310 301 3861 patrick.jones(a)icann.org patrickjones.tel

1 0

Go Daddy Comments on VeriSign Two-Factor Authentication and Who Was Services
by Tim Ruiz July 10, 2009

July 10, 2009

Our comments below are specifically related to the VeriSign Registry-Registrar Two-Factor Authentication Service. However, we would like to make clear that Go Daddy was not consulted on either this service or the Who Was Service. The Registrar Constituency also has concerns regarding the lack of a more formal process to ensure that such consultations take place and has submitted comments in that regard. We fully support those comments. The VeriSign Registry-Registrar Two-Factor Authentication Service describes two phases of the service. The first phase involves communications between the Registrar and the Registry. The second phase involves communications between the Registrar and the Registrant. Our concerns involve the second phase. VeriSign's request goes on to state: "Both phases of thee[sic] Registry-Registrar Two-Factor Authentication Service would initially be an optional service for registrars who elect to use it. Once the service becomes widely adopted, two-factor authentication credentials will become a requirement for Registry-Registrar transactions." After reading the above we contacted VeriSign regarding their intent to eventually require Registrars to provide the service. VeriSign confirmed that their desire was indeed to eventually make both phases of the service a requirement. We expressed our concerns regarding requirement of phase II. VeriSign understood our concerns, agreed to take them in account, and suggested we also submit comments to ICANN. As we expressed to VeriSign, we do not believe phase II should ever be required. It assumes that two-factor authentication is the best option and dictates that registrars use it with their customers. We do not believe there is any evidence to support two-factor authentication as the best or only solution, nor to suggest that a non-OATH proprietary model (perhaps our own) may not be better or as secure. Requiring phase II removes the Registrar and consumer choice to decide how/what/when we want to market/sell/promote/purchase security type services. For example, Go Daddy offers security products such as Protected Registrations and SSL Certificates. Numerous other Registrars offer similar services of their own or through arrangements with third party providers. Without the opportunity for consultation with VeriSign, it is difficult to determine the impact of their service on these potentially competing products, or with products/services that we may have under development. Phase II also implies a more direct relationship between Registrants (our customers) and the Registry, a relationship which is not fully described or understood at this stage. Again, further consultations with VeriSign are essential to understand the impact on customer relationship management, customer support and service, and the costs and impact of implementation. We believe ICANN should ask VeriSign to engage Registrars more fully in consultation on this service before considering the request complete and actionable. Failing that, phase II should be removed from this request until such consultations have taken place. In no event should the service be approved in a way that would allow VeriSign to later require phase II of Registrars without fully consulting with Registrars and Registrants. Tim Ruiz Vice President Corporate Development & Policy GoDaddy.com, Inc.

1 0

Request for additional evaluation time for Two-Factor Authentication
by Mason Cole July 10, 2009

July 10, 2009

The Registrar Constituency has been made aware of VeriSign's registry service proposal for a Two-Factor Authentication system. We respectfully ask for an additional 15 days to evaluate this service in more detail. Because many registrars were traveling following the ICANN meeting in Sydney, many were not aware of the request until well into the initial 15-day review period. Further, and more important, the proposal as submitted regrettably does not provide adequate detail for registrars to accurately assess the operational impact on either their businesses or their customers. Without a consultation with the service provider, we are unable to provide informed commentary. Because registrars most often bear the burden of implementation of new services and policies, it's critical that we have sufficient time to review their impact. Mason Cole Registrar Constituency Chair

1 0