Subject: GA-DIGEST V1 #923
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST         Thursday, December 13 2001         Volume 01 : Number 923

----------------------------------------------------------------------

Date: Thu, 13 Dec 2001 00:17:16 -0600
From: [email-masked] (Kristy McKee)
Subject: Re[2]: [ga] Domain Transfers

At 10:01 PM 12/12/2001 -0800, William X Walsh wrote:

>Oh please, you want to make transfers impossible Kristy?
>
>Registrars employ secure means, and for almost all of them, the
>Administrative contact is the only one who is allowed to authorize a
>domain transfer from one registrar to another.

Well, personally, I agree that the Administrative Contact only should have 
authorization for such a move.

>Also, stop thinking so US Centric.  The domain industry has to work
>for registrants from all over the world, access to affordable notary
>service is something that is much rarer outside the industrialized
>western countries.  Your plan would make the costs of transferring a
>domain name prohibitively expensive to gain a security that is really
>far and above what is necessary to provide for secure transfers.

Okay, I know in the US I can walk into any bank and have paperwork 
notarized for no fee.

I have no idea what the situation is outside the US as I've never used the 
service while traveling abroad.  It would be helpful if those who know 
could add to.

I am absolutely opposed to the idea that any Registrar would not require 
authorization from their client to modify any information concerning any 
domain registered between them.  The power must reside in the consumer's 
hands within this policy.

~k

>Wednesday, Wednesday, December 12, 2001, 9:37:22 PM, Kristy McKee wrote:
>
> > Anyone who wants to change their Registrar should have to sign a document
> > with detailed about, from and to information and this document should be
> > notarized.  Any mail service should be allowable.  When digital signatures
> > become mainstream they should part of a secure form solution for those who
> > prefer using digital media.
>
> > Only the Technical or Administrative Contact should be allowed to 
> instigate
> > a change like this.
>
> > :)
>
> > ~k
>
> > --
> > This message was passed to you via the [email-masked] list.
> > Send mail to [email-masked] to unsubscribe
> > ("unsubscribe ga-full" in the body of the message).
> > Archives at http://www.dnso.org/archives.html
>
>
>
>
>
>--
>Best regards,
>William X Walsh <[email-masked]>
>--
>Webcertificates.info
>SSL Certificates for resellers from $49ea

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 12 Dec 2001 22:36:50 -0800
From: William X Walsh <[email-masked]>
Subject: Re[3]: [ga] Domain Transfers

Wednesday, Wednesday, December 12, 2001, 10:17:16 PM, Kristy McKee wrote:

> At 10:01 PM 12/12/2001 -0800, William X Walsh wrote:

>>Oh please, you want to make transfers impossible Kristy?
>>
>>Registrars employ secure means, and for almost all of them, the
>>Administrative contact is the only one who is allowed to authorize a
>>domain transfer from one registrar to another.

> Well, personally, I agree that the Administrative Contact only should have 
> authorization for such a move.

As do I.

> I am absolutely opposed to the idea that any Registrar would not require
> authorization from their client to modify any information concerning any 
> domain registered between them.  The power must reside in the consumer's 
> hands within this policy.

They do.

Don't believe what the Verisign Registrar tried to claim that
transfers were taking place that were not authorized.  This claim has
been refuted by EVERYONE but them, including the registrants they
cited when asked for examples.

This was nothing but an attempt by Verisign to slow the flow of
outgoing transfers, by engaging in a practice that made if more
difficult to transfer out and has permitted them to collect what must
be huge renewal fees from registrants who have had their transfers
blocked by this practice (which violates the
registry/registrar/accreditation agreements) and have been forced to
renew their domains with Verisign against their will.

- -- 
Best regards,
William X Walsh <[email-masked]>
- --
Webcertificates.info
SSL Certificates for resellers from $49ea

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 00:48:21 -0600
From: [email-masked] (Kristy McKee)
Subject: Re[3]: [ga] Domain Transfers

At 10:36 PM 12/12/2001 -0800, William X Walsh wrote:
>Wednesday, Wednesday, December 12, 2001, 10:17:16 PM, Kristy McKee wrote:
>
> > At 10:01 PM 12/12/2001 -0800, William X Walsh wrote:
>
> >>Oh please, you want to make transfers impossible Kristy?
> >>
> >>Registrars employ secure means, and for almost all of them, the
> >>Administrative contact is the only one who is allowed to authorize a
> >>domain transfer from one registrar to another.
>
> > Well, personally, I agree that the Administrative Contact only should have
> > authorization for such a move.
>
>As do I.
>
> > I am absolutely opposed to the idea that any Registrar would not require
> > authorization from their client to modify any information concerning any
> > domain registered between them.  The power must reside in the consumer's
> > hands within this policy.
>
>They do.

I do not want this to change.

- ---------------

>Don't believe what the Verisign Registrar tried to claim that
>transfers were taking place that were not authorized.  This claim has
>been refuted by EVERYONE but them, including the registrants they
>cited when asked for examples.
>
>This was nothing but an attempt by Verisign to slow the flow of
>outgoing transfers, by engaging in a practice that made if more
>difficult to transfer out and has permitted them to collect what must
>be huge renewal fees from registrants who have had their transfers
>blocked by this practice (which violates the
>registry/registrar/accreditation agreements) and have been forced to
>renew their domains with Verisign against their will.

This issue is indeed something I would prefer not come up again.  I have 
not accessed any proof of the details; but it seems awfully 
anti-competitive and mean-spirited.

:)

~k

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 13:48:22 -0500
From: "John Berryhill" <[email-masked]>
Subject: RE: [ga] Domain Transfers

> Anyone who wants to change their Registrar should have to sign a document
> with detailed about, from and to information and this document should be
> notarized.

...and every registrar should speak every language so that they can read
notarial certificates from any country?

If the registrant is "Xiaolu Chin", what would you expect their name to look
like, let alone their signature, or the words on the notarial certificate?
How about "Abdullah Ajami" or "Vladislav Krietskova"?

In any event, of what use is a notarial certificate in any jurisdiction
outside of the one in which it was issued, unless the notarial certificate
is legalized by the relevant consulate?

Do you know what notaries in some countries cost?  Most people transfer
registrars to save money.  $35 per year for a domain name is *nothing* next
to notary fees in a lot of places.

Registrants are much more secure with something along the lines of a
password-protected web interface than knowing that any teenager with a
printer, a pen, and a seal from the stationary store can take any domain
name they want.

> Only the Technical or Administrative Contact should be allowed to
> instigate
> a change like this.

And just how do you propose that anyone OTHER thant the registrant is going
to be able to bind the registrant to the terms of the receiving registrar's
domain name registration contract.  That's like saying the only people who
can sell my house should be my accountant and my plumber.

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 00:57:54 -0600
From: [email-masked] (Kristy McKee)
Subject: RE: [ga] Domain Transfers

At 01:48 PM 12/13/2001 -0500, John Berryhill wrote:

> > Anyone who wants to change their Registrar should have to sign a document
> > with detailed about, from and to information and this document should be
> > notarized.
>
>...and every registrar should speak every language so that they can read
>notarial certificates from any country?
>
>If the registrant is "Xiaolu Chin", what would you expect their name to look
>like, let alone their signature, or the words on the notarial certificate?
>How about "Abdullah Ajami" or "Vladislav Krietskova"?
>
>In any event, of what use is a notarial certificate in any jurisdiction
>outside of the one in which it was issued, unless the notarial certificate
>is legalized by the relevant consulate?
>
>Do you know what notaries in some countries cost?  Most people transfer
>registrars to save money.  $35 per year for a domain name is *nothing* next
>to notary fees in a lot of places.

Hey John,

No, I do not know where notary fees exist or how much they are.  In the USA 
any bank will notarize for no charge.

>Registrants are much more secure with something along the lines of a
>password-protected web interface than knowing that any teenager with a
>printer, a pen, and a seal from the stationary store can take any domain
>name they want.

Agreed.  The best solution is the one that currently exists.  Everything 
instigated from the Registrant or their Authorized Representative 
(Administrative/Technical Contact; although William and I have already 
agreed that the best scenario would be for the Admin only).

> > Only the Technical or Administrative Contact should be allowed to
> > instigate
> > a change like this.
>
>And just how do you propose that anyone OTHER thant the registrant is going
>to be able to bind the registrant to the terms of the receiving registrar's
>domain name registration contract.  That's like saying the only people who
>can sell my house should be my accountant and my plumber.

We agree.

:)

~k

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 12 Dec 2001 23:04:15 -0800
From: Eric Dierker <[email-masked]>
Subject: Re: [ga] Domain Transfers

William would you do yourself a favor;

Reread the post, think about it.  Your many post a day gut reaction antagonism is
heartfelt but hard to believe cranially inspired.  You have some good points here
and if put forth in a constructive manner may even lead to a better understanding
and a Transfer TF representative to be better able to present your view.

I personally will put this in a file to remind me that if I work on tf and/or
have a chance at input that I remember your very valid point.

But please, it takes three readings to get past your initially hateful comments.
I mean we are consensus based and I am sure you know on an intellectual basis
your antagonistic approach does not lend itself to said consensus.

Please stop being so personal in criticism, I only ask if you would please.  If
you don't understand what I am referring to I would be happy to rewrite your post
so you do understand.  Once you practice it, it is not hard to be helpful and
pleasant and encourage participation.

At your service,
Eric

William X Walsh wrote:

> Oh please, you want to make transfers impossible Kristy?
>
> Registrars employ secure means, and for almost all of them, the
> Administrative contact is the only one who is allowed to authorize a
> domain transfer from one registrar to another.
>
> Also, stop thinking so US Centric.  The domain industry has to work
> for registrants from all over the world, access to affordable notary
> service is something that is much rarer outside the industrialized
> western countries.  Your plan would make the costs of transferring a
> domain name prohibitively expensive to gain a security that is really
> far and above what is necessary to provide for secure transfers.
>
> Wednesday, Wednesday, December 12, 2001, 9:37:22 PM, Kristy McKee wrote:
>
> > Anyone who wants to change their Registrar should have to sign a document
> > with detailed about, from and to information and this document should be
> > notarized.  Any mail service should be allowable.  When digital signatures
> > become mainstream they should part of a secure form solution for those who
> > prefer using digital media.
>
> > Only the Technical or Administrative Contact should be allowed to instigate
> > a change like this.
>
> > :)
>
> > ~k
>
> > --
> > This message was passed to you via the [email-masked] list.
> > Send mail to [email-masked] to unsubscribe
> > ("unsubscribe ga-full" in the body of the message).
> > Archives at http://www.dnso.org/archives.html
>
> --
> Best regards,
> William X Walsh <[email-masked]>
> --
> Webcertificates.info
> SSL Certificates for resellers from $49ea
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 12 Dec 2001 23:02:43 -0800
From: Bret Fausett <[email-masked]>
Subject: Re: [ga] Why no sanctions?

Because we should be encouraging this kind of behavior?

Before calling for sanctions just because it's Verisign, keep a few things
in mind.

- - The kind of promotion than Verisign proposed is common in the brick and
mortar world. A manufacturer may keep its wholesale price stable while
offering promotional credits back to individual retailers as a means of
rewarding increased sales. Rest assured that when you saw that great deal
Footlocker was offering on Nikes in the local paper, Nike did not have to
vet the discount it had provided with the Central Shoe Authority. And when
you received free HBO last month from your local cable company, the FCC
didn't have to sign off on that either.

- - The overall effect of the promotion may have been to lower prices to
consumers.   

- - The fact that Verisign wanted to create an incentive for registrars to
promote .com and .net now that .info and .biz are live is a sign that
competition is beginning -- only beginning -- to take shape. At the first
sign of registry-to-registry price competition though, we've had the
regulator step in and stir the pot.

Forget for a minute that it's Verisign and forget that the contract may (or
may not) have required Verisign to vet with ICANN a plan to award marketing
credits to registrars. Ask the larger question of what kind of environment
we've created when companies doing business servicing domain names have to
seek permission for marketing initiatives.

My initial reaction is to be very dismayed at this report. I'd like to hear
more from ICANN about what in Verisign's original promotion was rejected,
what was allowed, and why. I'd also like to see a more general conversation
within the DNSO about whether ICANN should be regulating business
initiatives at this level of detail.

    -- Bret

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 14:49:35 -0500
From: "John Berryhill" <[email-masked]>
Subject: RE: Re[2]: [ga] Domain Transfers

> Okay, I know in the US I can walk into any bank and have paperwork
> notarized for no fee.
>
> I have no idea what the situation is outside the US as I've never
> used the
> service while traveling abroad.  It would be helpful if those who know
> could add to.

http://www.usembassy.org.uk/cons_web/acs/scs/uk-notary.htm

Now mind you, the 12 pounds referenced there is merely the legalization fee
for having a UK notarized document in an acceptable form for use outside of
the UK.

First, you have to find a UK Notary:

http://www.blackhursts.co.uk/notary.htm

"At present (May 1999) the recommendation of the Council of The Notaries'
Society is that the hourly rate for time should be ?135 with a minimum fee
of ?35. VAT will be added if appropriate."

Okay, so we have a minimum of 47 pounds per domain name.  That's 68 dollars
today.

Now, what did you want to spend on postage?

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 00:03:25 -0800
From: Eric Dierker <[email-masked]>
Subject: Re: [ga] Domain Transfers

This post is very helpful and insightful.

If I work on this TF i will incorporate such ideas and WXWs and Kristy's and I
will encourage them here and report every few days here.  I will forward these
to one of our sublists.  Only for ease of research and contribution, as a case
specific archive.

I am learning that we can still create a proper forum.

John and WXW do you have a reality check on these multilingual problems.  You
point out appropriate problems.  Would you care to be held up to ridicule for
some appropriate (experimental solutions)?

Please continue to contribute.

Sincerely,
Eric

John Berryhill wrote:

> > Anyone who wants to change their Registrar should have to sign a document
> > with detailed about, from and to information and this document should be
> > notarized.
>
> ...and every registrar should speak every language so that they can read
> notarial certificates from any country?
>
> If the registrant is "Xiaolu Chin", what would you expect their name to look
> like, let alone their signature, or the words on the notarial certificate?
> How about "Abdullah Ajami" or "Vladislav Krietskova"?
>
> In any event, of what use is a notarial certificate in any jurisdiction
> outside of the one in which it was issued, unless the notarial certificate
> is legalized by the relevant consulate?
>
> Do you know what notaries in some countries cost?  Most people transfer
> registrars to save money.  $35 per year for a domain name is *nothing* next
> to notary fees in a lot of places.
>
> Registrants are much more secure with something along the lines of a
> password-protected web interface than knowing that any teenager with a
> printer, a pen, and a seal from the stationary store can take any domain
> name they want.
>
> > Only the Technical or Administrative Contact should be allowed to
> > instigate
> > a change like this.
>
> And just how do you propose that anyone OTHER thant the registrant is going
> to be able to bind the registrant to the terms of the receiving registrar's
> domain name registration contract.  That's like saying the only people who
> can sell my house should be my accountant and my plumber.
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 02:45:44 -0800
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] Why no sanctions?

Bret and all assembly members,

Bret Fausett wrote:

> Because we should be encouraging this kind of behavior?

  No.  Allow for perhaps, but encourage, definitely not.  Such
encouragement would possibly lead ( And I would agree with Danny,
likely lead) to more of the same from other registrars and the contract,
as terribly flawed as it is, would be abrogated to the point of being
nearly worthless.  We could end up having a Registrar version
of the microsoft fiasco.

>
>
> Before calling for sanctions just because it's Verisign, keep a few things
> in mind.

  I don't believe that Dannys comments and concerns were central
to Verisign.

>
>
> - The kind of promotion than Verisign proposed is common in the brick and
> mortar world. A manufacturer may keep its wholesale price stable while
> offering promotional credits back to individual retailers as a means of
> rewarding increased sales.

  I would rather see these supposed "Credits" as either a direct reduction
in registration fees or rebated back to existing registrants.  But none the
less comparing such to the brick and mortar world seems a bit of
a stretch in any event.

> Rest assured that when you saw that great deal
> Footlocker was offering on Nikes in the local paper, Nike did not have to
> vet the discount it had provided with the Central Shoe Authority.

  There is not central shoe authority.  Hence this comparison as an
example is not really valid in this context.  But I do gather your point.

> And when
> you received free HBO last month from your local cable company, the FCC
> didn't have to sign off on that either.

  ICANN is not the FCC, nor is it a regulatory authority.

>
>
> - The overall effect of the promotion may have been to lower prices to
> consumers.

  MAY, yeah.  IS, is yet another thing all together.

>
>
> - The fact that Verisign wanted to create an incentive for registrars to
> promote .com and .net now that .info and .biz are live is a sign that
> competition is beginning -- only beginning -- to take shape. At the first
> sign of registry-to-registry price competition though, we've had the
> regulator step in and stir the pot.

  Good point here.

>
>
> Forget for a minute that it's Verisign and forget that the contract may (or
> may not) have required Verisign to vet with ICANN a plan to award marketing
> credits to registrars.

  Yes but the other part of this is that the Registrar and registry competition

is not open.  As such, only the ICANN "Accredited" Registries or Registrars
by contract to DOC/NTIA, via ICANN recommendation, have a closed
market place here.

> Ask the larger question of what kind of environment
> we've created when companies doing business servicing domain names have to
> seek permission for marketing initiatives.

  They shouldn't have to if and only if those marketing initiatives are within
the
existing laws dealing with such marketing or advertising....

>
>
> My initial reaction is to be very dismayed at this report. I'd like to hear
> more from ICANN about what in Verisign's original promotion was rejected,
> what was allowed, and why.

  I would as well as our legal staff would.  But now I am afraid that we
will never get the straight scoop on this at this juncture.

> I'd also like to see a more general conversation
> within the DNSO about whether ICANN should be regulating business
> initiatives at this level of detail.

  ICANN cannot regulate anything, only recommend presently to DOC/NTIA.
And DOC/NTIA does have some latitude here.

>
>
>     -- Bret
>
>
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

Regards,

- --
Jeffrey A. Williams
Spokesman for INEGroup - (Over 121k members/stakeholdes strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number:  972-244-3801 or 214-244-4827
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 00:48:49 -0800
From: Roeland Meyer <[email-masked]>
Subject: RE: [ga] Domain Transfers

|> From: Eric Dierker [mailto:[email-masked]]
|> Sent: Wednesday, December 12, 2001 9:05 PM

|> [email-masked] wrote:
|> > Tucows has prepared a formal response to the 11/29 
|> > VeriSign letter on transfers.  This document and 
|> > others are cited at:
|> > http://www.dnso.org/clubpublic/registrars/Arc01/msg01647.html
|> >
|> > Perhaps those seeking to represent the GA on the transfers 
|> > TF would care to comment on this document.
|> 
|> These are the August comments regarding this matter by Louis 
|> Touton.  Herein lies the problem.
|> 
|> I would like at this time to ask anyone to step forward and 
|> speak of any DN Holder who has been upset with their ISP for 
|> switching from on Registrar to another.  I think we have 
|> transferred thousands and the only time we have received a 
|> complaint is when there was a problem coming from a Registrar
|> bothering the Holder.

I have been reserving my comment on this subject because I think that the
entire issue is mindless nonsense. At least, for the corporate sector. No
one in that sector buys names from their ISP. Often they go direct to the
registry, or the most reliable and cheapest registrar. On their internal
networks, they are their own registry, for their own domains. It's a
security thing. I have personally sold a few root server clusters to support
such operations. No one with a competent network operations support staff,
outsources that function. Rather, they buy subsystems to support that
function internally.

As far as residential and Mom&Pop operations are concerned, they mostly
don't care. But, there have been many cases where the ISP makes themselves
the Admin Contact for the domain, against the best interests of the
registrant. Those issues are real. However, the ISPs choice of registrar has
little to no bearing on the ISPs customer's choice of registrar. if the
customer choses to use their ISP as a registrar then that customer deserves
what they get. IMHO, anyone acting the part of a registrar should be made to
qualify the same as any other registrar, or they shouldn't be allowed to
register for third-parties. This includes all ISPs.

Where transfer issues do come up is from registrar to registrar, where
registrars try to employ customer retention tactics. These sorts of games
are why MHSC still uses the NSI registry, for all of the domains that we
own. This is also one of the main reasons MHSC doesn't agree with the
existance of the registrar system. It's only psuedo-competitive. But, that's
yet another can-o-wyrms. MHSC, along with a few thousand others, don't much
care for yet another layer of bureaucracy forced between us and the
registry.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 00:55:29 -0800
From: Roeland Meyer <[email-masked]>
Subject: RE: [ga] Why no sanctions?

|> From: Bret Fausett [mailto:[email-masked]]
|> Sent: Wednesday, December 12, 2001 11:03 PM

|> My initial reaction is to be very dismayed at this report. 
|> I'd like to hear more from ICANN about what in Verisign's 
|> original promotion was rejected, what was allowed, and why. 
|> I'd also like to see a more general conversation within 
|> the DNSO about whether ICANN should be regulating business
|> initiatives at this level of detail.

That's easy Bret. No one should be regulating prices, in a free-market.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 01:05:15 -0800
From: William X Walsh <[email-masked]>
Subject: Re[2]: [ga] Domain Transfers

Thursday, Thursday, December 13, 2001, 12:48:49 AM, Roeland Meyer wrote:

> Where transfer issues do come up is from registrar to registrar, where
> registrars try to employ customer retention tactics. These sorts of games
> are why MHSC still uses the NSI registry, for all of the domains that we
> own.

You mean NSI Registrar.

Funny, you use the one Registrar who has been the most gross offender
of the anti-transfer tactics, and then use the existence of such
tactics as a reason to stay with them.

That's rather like saying that the reason you stay a customer of a
company is because their customer service is the worst.

You are no safer at NSI Registrar, in fact the argument can easily be
made that you are in the most danger at NSI Registrar, who have had
the largest incidences of domain hijackings, even to this day.
Further, you are no safer with them as a result of Verisign owning the
NSI Registrar and the Registry, since the NSI Registrar uses the EXACT
same interface as all other registrars, with no inside advantage.
There is no inherent benefit at all, except in your imagination.

- -- 
Best regards,
William X Walsh <[email-masked]>
- --
Webcertificates.info
SSL Certificates for resellers from $49ea

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 16:13:02 -0500
From: "John Berryhill" <[email-masked]>
Subject: RE: [ga] Domain Transfers

>
> Agreed.  The best solution is the one that currently exists.

No, it isn't.  Not by a long shot.  The main obstacle to obtaining a decent
solution is the fact that the ICANN process puts policy making power into
the hands of people who do not face the technical realities on a daily
basis, and generally have no idea of what is really going on out there in
the real world.

One problem with NSI is the legacy problem of confirming via email contacts.
What typically happens is a domain name registrant will change ISP's, and
only later realize that they no longer have access to the email address at
which NSI will seek to verify a transfer.  It's their own fault?  Uh, no.
Last week 4.1 million AT&T broadband customers had their email address
changed when Excite@home dumped AT&T broadband.  Each and every single NSI
domain registrant among those 4.1 million people is now screwed.  Big time.
Incidentally, this is a reason why, in at least one UDRP dispute I defended,
the complainant was claiming the domain name was "not being used" and "the
contact details are false".  The ripple effects of this NSI legacy problem
are wide and thoroughly not appreciated by people who should not be running
this system, but are.

There is a flip side to NSI's alleged "stickiness" in not letting domain
names go, and that is the real problem of hi-jacking (forget "slamming" for
the moment).  Asking Company B to verify that I am the authorized customer
of Company A is an idea so dopey, that it could only have come from an ICANN
"consensus" process.  The way hi-jacking used to work was pretty simple.
You would go to a registrar, request a transfer of some NSI registrant's
domain name, and if NSI didn't get an answer in five days, the transfer
would go through.  So, you could steal any domain name from anyone who had
either lost access to the relevant email address, or from anyone who had a
five day lapse in reading email from the same address which gets all of the
spam pursuant to having an email address in a domain name registration.

Okay, well, the registrars caught on to that, and if a hi-jacking victim
complained loud and long enough, the domain name would be transferred back.

So, the hi-jackers got smarter, and this is how the game works now.  This
happens more often than you would believe.  First, you sign up with someone
like SnapNames to "backorder" a domain name, or you acquaint yourself with
the timing of intentional name deletions and registry drops (which is
different from normal expiration drops).  Then, you go and do something
along the lines of the first method.  However, this time when you get the
domain name transferred to the new registrar, you immediately delete the
domain registration (using a registrar which permits deletions).  Finally,
what you do is you then hope that SnapNames snags it, or you snag it
yourself on the basis of your accumulated deletion timing data.

The beauty here is three-fold.  First of all, the old registar can't come to
the new registrar and claim that there was a transfer error.  What transfer
error?  This is a NEW registration, not a transfer!

Secondly, under the rules a new registration CAN'T be transferred back to
the old registrar, because new domain names can't be transferred to another
registrar for 60 days.  So not only did you steal the name in a manner which
helped you cover your tracks and avoid getting it transferred back to the
old registrant, but the registrars need to get the registry's permission to
break a rule in order to fix the problem.

Third, many of the registrars don't like each other very much.  They are,
after all, in competition with each other - they aren't supposed to
cooperate.  Fixing this sort of hi-jacking requires cooperation.  There are
no policies requiring any of these people to lift a finger to get that
domain name back, and if the original registrant is successful in doing so
without having to hire a lawyer to deal with this kind of three-ring circus,
then I'd like to shake their hand.

And, if the domain name was registered with OpenSRS, and you can't get all
of the other registrars involved to sing the same tune within thirty days,
and to sign a legal document OpenSRS requires (and which some other
registrars do not understand beyond the concept that they are being asked to
sign a legal document) then OpenSRS will tell you very clearly to get lost.
Several months ago, I watched some twenty or so domain names become
permanently registered with OpenSRS because the point person at the original
registrar - BulkRegister - was spending more time working on his career move
to Neulevel while lying to me than working on his job.  I hope he's reading
this, because he knows who he is.

The only advice to those wishing not to have their domain names stolen is to
steer well clear of BulkRegister.  Not only have I found them to be the
least cooperative of all of the registrars I have dealt with on this issue,
but their people are so astoundingly incompetent that they recently
transferred a domain name to a UDRP complainant who LOST the dispute.  The
moron in charge of implementing UDRP decisions at BulkRegister is unable to
comprehend what "complaint denied" means.  That is the level of people they
hired since their re-organization several months ago.  I have seen more
domain names stolen from those unresponsive idiots than from anyone else in
the business.

The same new BulkRegister employee sent me a message promising to "look
into" a domain name that had been hi-jacked from them, and then "get back to
me".  That was, oh, about two and a half months ago.  Thank goodness I found
a way to work around them.  You will get nowhere with them until you contact
their outside counsel and keeper of the magic phone numbers.  And, no, I
will not give you the magic BulkRegister phone numbers.

I've got five bucks in my pocket that says the overwhelming majority of the
folks on the TF task force have never seen, dealt with, or even heard of
this common scenario, even among those members who are able to understand
it.  It would be amusing to know who among them has ever registered a domain
name, or transferred a registered domain name.  There are some good people
on that TF, though, and they know who they are, too.

Asking a bunch of "competitors" to come up with a "consensus policy" will,
in all likelihood, simply hand another road map to hi-jackers.  My concern
about the ease with which someone might save themselves twenty bucks over
the course of a year pales next to my concern about how I have seen domain
name registrants permanently lose their domain names to thieves because the
people steering this ship have never seen an iceberg.

Cheers,

John

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Thu, 13 Dec 2001 01:35:16 -0800
From: Roeland Meyer <[email-masked]>
Subject: RE: Re[2]: [ga] Domain Transfers

|> From: William X Walsh [mailto:[email-masked]]
|> Sent: Thursday, December 13, 2001 1:05 AM
|> 
|> Thursday, Thursday, December 13, 2001, 12:48:49 AM, Roeland 
|> Meyer wrote:
|> 
|> > Where transfer issues do come up is from registrar to 
|> > registrar, where registrars try to employ customer 
|> > retention tactics. These sorts of games are why MHSC 
|> > still uses the NSI registry, for all of the domains 
|> > that we own.
|> 
|> You mean NSI Registrar.

That's exactly my point. Note that I have had my share of criticisms, of
NSI, in the past. Also, the NSI DDRP is what got me involved in these issues
in the first place. But, that was before your time.

|> Funny, you use the one Registrar who has been the most gross offender
|> of the anti-transfer tactics, and then use the existence of such
|> tactics as a reason to stay with them.

If you look at it from a risk minimalization view, it makes sense. In that
regard, the tactics are working. I never claimed that they didn't.

|> That's rather like saying that the reason you stay a customer of a
|> company is because their customer service is the worst.

Not at all. Yes, it's a hostage situation. No, we don't think that $35US is
worth risking the business for. Add a couple of zeros to that and I will
assuredly change my mind. MHSC has had enough of externally caused outages
for one year, thank you. $40 per name server got us adequate expedited
service when our upstream went out of business, last 8Feb01 (a date I will
never forget), from NSI. Total outage was almost 8 weeks. MHSC lost a lot of
business over that (speaking of ISPs, SpeakEasy sux) and our new ISP isn't
as capable. 

|> You are no safer at NSI Registrar, in fact the argument can easily be
|> made that you are in the most danger at NSI Registrar, who have had
|> the largest incidences of domain hijackings, even to this day.
|> Further, you are no safer with them as a result of Verisign 
|> owning the
|> NSI Registrar and the Registry, since the NSI Registrar uses 
|> the EXACT
|> same interface as all other registrars, with no inside advantage.
|> There is no inherent benefit at all, except in your imagination.

That is where you are wrong. As has been documented in this very forum,
changing registrars is fraught with risk. Risk that MHSC is not prepared to
add onto the risks that we are already taking. I pay a whole lot more than
$35US for Liability, Errors, and Omissions coverage. We've had our primary
domain since 1995, it isn't going anywhere (although, Adam keeps asking to
buy it). An error in transfer will take MHSC down for the duration of that
error. This time period is typically measured in weeks. That costs
significantly more than $35US. The status quo is stable and I'd like to keep
it that way.
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #923
************************