Re: [gnso-thickwhoispdp-wg] Dangers and risks of thick Whois

[Volker Greimann <vgreimann@xxxxxxxxxxxxxxx>]

> > *Data integrity and security:***It is quite true that having more 
> > repositories means that any one is more likely to be penetrated or 
> > altered maliciously. However, that very replication makes it much 
> > less likely that any such change will be un-noticed or unrecoverable. 
> > In the particular cases we are looking for. I am quite comfortable 
> > that Verisign is able to build and support a more robust repository 
> > than many of the smaller registrars.
Not only that, but the registrars obligation to collect, maintain and 
escrow this data would not go anywhere. In case of compromise, the data 
can easily be rebuilt by reaching out to the registrars.
Also note that there is no replication in thin whois. Every registrar 
holds only that bit of data that concerns the domain names registered 
through him. Domain names registered through another registrar are not 
part of the whois requirements of any other registrar. So basically, you 
have to keep thousands of repositories secured, not just one. I also 
think a change of a few domains at one registrar is more likely to go 
unnoticed than an intrusion at Verisign.
> > If we posit that Verisign is a better target than a small registrar, 
> > and conceivably they could have a security lapse (which I am *not* 
> > predicting), having a copy of the data at the registrar adds an extra 
> > level of security. If both of them get hacked simultaneously, then 
> > the registrar alone would have been an even easier target.
Agreed, however the data will also be held by the registrar under its 
requirements under the RAA. The only changes that will happen is that:
a) The registrar will no longer publish an authoritative whois (and in 
my opinion, no longer be required to publish a whois at all)
b) The registry also will hold a copy of the data and publish an 
authoritative whois record.
> When considering a policy position on data integrity and security 
> (especially with privacy concerns being my main issue of concern), my 
> opinion is not based on VeriSign's competencies, but on any registry 
> for any gTLD with a large number registrations like ".com". Even in 
> the case of ".com", VeriSign is not the first registry for this 
> specific TLD, and I don't see how we can guarantee that it will be the 
> last. So even if we share a sense of confidence in their competence, 
> we cannot now claim the same for future registries, and would prefer 
> not to advocate for policy without taking that into consideration.
The privacy issue is another problem. I agree just handing the data to 
Verisign will be problematic, however there are ways to handle this in 
compliance with data protection requirements.
> > *Impact on Privacy:* I completely understand the many concerns that 
> > have been raised with Whois with respect to privacy, but I fail to 
> > understand how the transition from a thin to a thick registry impacts 
> > this. *ALL* of the information that we are talking about sending to 
> > the registry is public. Not only is it public and freely accessible, 
> > but it is already replicated in untold repositories around the world, 
> > and particularly in repositories in the country where the registries 
> > in question reside. I agree that if data is sitting on a server in 
> > the US, managed by a US company, that company may be subject to US 
> > law and demands from US law enforcement or governments. But all they 
> > can reveal is information that is already public. Where is the 
> > additional harm?
I completely agree. As the data is already "out there" and registrants 
have agreed to its publications through their registration agreements, 
the question of who holds it should not increase the potential of 
possible harm.
Also, as Whois privacy is provided the same by all sorts of providers 
for thick as well as thin registries, anyone interested in keeping their 
data private can opt to do so, and thereby safely keep the data out of 
the hands of the US provider.
Volker