Re: [Registrar-announce] Message to registrars

[Lorens Kockum <lorens@xxxxxxxxxxxxxxxxxxx>]

Pursuant to request for comments on FOA:

If one leaves intact the wording of the option "reply by e-mail
to authorize transfer", it is vulnerable to elementary spoofing:
simply request a transfer from a registrar, and some time later
send the registrar an easily forged acceptance note.

This is not acceptable.

To avoid this we have added an authorization code at the end of
the part to be quoted in reply.

I prefer our old way of doing it, namely request that the
contact place in the subject of the mail the word ACCEPT or
REJECT followed by the authorization code; much easier to parse
automatically!

With the new way, there is no (e-mail) possibility for a contact
to flatly reject the request, which I find somewhat worrisome.

Sincerely,
Lorens Kockum
Initials Online