Subject: typo attack (was Re: Opt-in wg last call)

From: Derek Atkins <[email-masked]>
Date: 04 Apr 2002 10:26:08 -0500

[email-masked] writes:

> > What makes this troublesome is that the victim, in this case monopoly.int,
> > is at risk becuase of a policy decision made by some one else (.int).  It
> > is not a matter of .int shooting themselves in tht foot, but .int shooting
> > one of the legitmate delegations in the leg.
> > 
> > So, it seems that opt-in allows one organization to put another at risk.
> > 
> 	Twas ever thus. A parent can always mess with direct delegations.
> 	Children (these days) generally have no recourse if the parent
> 	makes a policy that the child is unable to accomodate. 
> 	The question might be more interesting if you could claim that
> 	opt-in allows one organization to place another at risk when
> 	the relationship between the two organizations is not
> 	parent/child.
> --bill

Bill,

The issue with the typo attack is that:

 - Assume that monopoly.int exists, and an attacker is trying to
   defaud them.

 - Assume the attacker tries to defraud by registering a "close"
   domain name.  There is nothing illegal with registering a "close"
   domain name, however there are laws against fraud.  If the parent
   allows m0n0p0ly.int to be registered, but the courts rule of fraud
   against monopoly.int, then there would be a legal recourse to
   remove the domain.  In other words, there are laws to prevent
   fraud, and monopoly.int could use them to protect itself.  In this
   case, the remedy could be the removal of m0n0p0ly.int from the
   domain.

 - However, if the parent domain used opt-in, then an attacker could
   poison caches with m0n0p0ly.int in order to defraud, and there is
   no protection.  The only protection against this attack is
   authenticated denial of the fraudulent domain.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>