Re: Registry lock - two-factor or intervention

Patrik Fältström <[email protected]> Fri, 20 Sep 2013 11:47:41 +0200
Newsgroups	gmane.ietf.provreg
Message-ID	<[email protected]>
On 20 sep 2013, at 09:41, Maarten Bosteels <[email protected]> wrote:

> We recently discussed several options with our Registrar Forum and this is what we came up with for an initial version: 
> 
> * a registry lock on a domain name can only be requested by the sponsoring registrar and only via the web interface and will not be visible nor updatable via EPP 

Do separate "turn on" and "turn off" the lock which are in turn separated from making changes while the lock is in place.

I see no problems what so ever to "turn on" via epp, and think that is what should be done.

> * the adminsitrative part (signing agreements, passing around contact details, etc) will be handled manually (exact procedures are still work-in-progress) 

Administrative part of turning on or off or making changes while the lock is set?

> * the registrant chooses who should be contacted when registrar requests to unlock the domain name 
> => IMO this offers the most flexibility: a registrant can choose to let his registrar handle the whole process or he can choose to be involved in the unlocking process himself 

It is important that we have clear terminology here. You say "registrant chooses" but above you say (which I think is correct) that the registrar is turning things on.

I think what you say is that "registrant chooses, and this choice is sent from the registrar to the registry when the lock is turned on". Is that correct understanding of what you wrote?

> * once the administrative part is handled, someone at the registry flags the registration as 'registry locked' 
> => no updates possible to linked registrant nor to the host attributes (NS and A records) of the domain name nor to the DS records (to be investigated if we would allow emergency key roll-overs) 
> * the registrar requests (via the web interface) to unlock a domain name 
> => the registry seeks confirmation using the previously specified contact details. Upon confirmation: registry unlocks the domain name (TBD: indefinitely or for a limited time) 

See above.

> * price: to be decided 
> 
> We don't foresee a two-factor authentication mechanism, although one could consider the pre-specified phonenumber as something you have. 
> (We do however plan to add two-factor authentication to the registrar extranet, covering all possible transaction types not just those related to registry lock.) 
> 
> A further simplification (to speed up the roll-out) could be to handle lock and unlock requests entirely via the customer support system (and not via the registrar extranet). 

I think you absolutely must have a two-factor authentication in the form of two phone numbers, physical surface post or whatever. Something that is extremely hard to socially engineer. Require two persons to be involved or whatever.

> In a later phase (when the feature has enough success) we will consider to facilitate lock and unlock requests via EPP and to send EPP poll messages to notify the registrar when the lock or unlock has been approved. All of this of course preferably using a standardized EPP extension. 

   Patrik

_______________________________________________
provreg mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/provreg
signature.asc (application/pgp-signature, 203 B)