AI-generated Audio Podcast about ICANN Transfer Policy

Briefing Document: Review of ICANN Transfer Policy Review – Initial Report Comments

Author: Leap of Faith Financial Services Inc.

Subject: This document reviews and summarizes the key themes and arguments presented by Leap of Faith Financial Services Inc. in their comments on the “Initial Report on the Transfer Policy Review – Phase 1(a)”.

Main Themes:

1. Inherent Insecurity of the TAC System: Leap of Faith argues that the current Transfer Authorization Code (TAC) system is fundamentally insecure. They highlight that even with incremental improvements proposed by the working group, the reliance on a shared secret creates vulnerabilities to interception, misuse, and theft.

“The AuthInfo Code, to be renamed TAC (“Transfer Authorization Code”) is inherently insecure, and should be deprecated.”

1. Advocating for a Push-Based System: As a superior alternative to the TAC system, Leap of Faith proposes a push-based transfer system similar to those used in banking and cryptocurrency transactions. This model would involve the losing registrar initiating and authorizing the transfer, eliminating the need for shared secrets and significantly reducing the risk of unauthorized transfers.

“By continuing to rely on a shared secret … ICANN’s own history of policy evolution shows that incremental improvements … fall short of eliminating the systemic risks posed by the shared secret model.”

1. Prioritizing Registrant Rights and Security: Leap of Faith emphasizes the need to prioritize the rights and security of domain name registrants throughout the transfer process. They criticize the working group for proposing changes that could weaken security measures and erode registrant control over their domains.

“This is a very dangerously designed approach, as currently worded, and it really highlights how dangerous the TAC itself is…”

1. Criticizing Working Group Composition and Process: Leap of Faith expresses concern over the composition of the working group, arguing that it is dominated by registrar interests and lacks adequate representation from registrants. They criticize the transparency and fairness of the process, claiming that registrant concerns are not being adequately addressed.

“One of the most significant issues here is the capture of the working group. The dominant participation of registrars, who have their own business interests at stake, has resulted in a skewed process.”

Key Arguments and Proposals:

• Breakthrough Proposal – Pending Transfer ID (PTID): Leap of Faith proposes a system where a unique PTID is generated at the gaining registrar and provided to the registrant. This PTID would then be inputted at the losing registrar to authorize the transfer. This approach eliminates the reliance on a shared secret like the TAC and places control in the hands of the registrant.
• Retaining the Losing Form of Authorization (FOA): While acknowledging the desire for faster transfers, Leap of Faith argues for retaining the Losing FOA as an optional security measure. This allows registrants to choose between speed and security based on their individual needs and risk tolerance.
• Improving Losing FOA Transparency: To provide registrants with a clearer understanding of the transfer’s impact, Leap of Faith suggests enhancing the Losing FOA process by displaying both the “before” and “after” WHOIS information. This allows for better informed decision-making and can help identify unauthorized changes.
• Timelock Access to TAC Generator (“Vacation Mode”): To mitigate risks associated with compromised accounts, Leap of Faith proposes a “Timelock Access” feature, allowing registrants to temporarily disable the generation of TACs for a specific duration. This adds an extra layer of security, especially for inactive accounts or during periods when the registrant is unavailable.
• Embedding Gaining Registrar Info in TAC: To limit the impact of a compromised TAC, Leap of Faith proposes embedding the intended gaining registrar’s information within the code itself. This restricts the TAC’s usage to a single registrar, reducing the attack surface and potential damage.
• Opposing Elimination of Registrant Rights Language: Leap of Faith objects to the proposed removal of language explicitly affirming registrants’ rights to update their WHOIS data and transfer their registrations freely. They argue that this language is crucial for protecting the fundamental property rights of domain name holders.

Call to Action:

Leap of Faith calls on ICANN to:

• Adopt the PTID system as a secure and user-friendly alternative to the TAC.
• Retain the Losing FOA as an optional security measure.
• Implement “Timelock Access” functionality for enhanced account security.
• Embed Gaining Registrar information within the TAC to limit the impact of compromise.
• Preserve language protecting registrant rights within the policy.
• Address the concerns regarding working group composition to ensure fair representation and a transparent process.

Conclusion:

Leap of Faith Financial Services Inc. presents a well-reasoned and detailed critique of the ICANN Transfer Policy Review Initial Report, highlighting serious concerns with the proposed recommendations’ impact on security and registrant rights. They offer practical and innovative solutions, urging ICANN to prioritize the development of a more secure and user-centric domain name transfer system.