Subject: [regext] I-D Action: draft-ietf-regext-verificationcode-02.txt

From: [email-masked]
Date: Mon, 16 Oct 2017 04:58:10 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Registration Protocols Extensions WG of the IETF.

        Title           : Verification Code Extension for the Extensible Provisioning Protocol (EPP)
        Author          : James Gould
	Filename        : draft-ietf-regext-verificationcode-02.txt
	Pages           : 35
	Date            : 2017-10-16

Abstract:
   This document describes an Extensible Provisioning Protocol (EPP)
   extension for including a verification code for marking the data for
   a transform command as being verified by a 3rd party, which is
   referred to as the Verification Service Provider (VSP).  The
   verification code is digitally signed by the VSP using XML Signature
   and is "base64" encoded.  The XML Signature includes the VSP signer
   certificate, so the server can verify that the verification code
   originated from the VSP.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-regext-verificationcode/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-regext-verificationcode-02
https://datatracker.ietf.org/doc/html/draft-ietf-regext-verificationcode-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-regext-verificationcode-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 16 Oct 2017 18:03:33 +0200

Dear working group,

I remain very concerned about the potential negative impact of this
draft on the right to freedom of association, the right to privacy and
the right to freedom of expression.

Even though this was now brought up several times the author does not
seem to want to explicitly address this, which I think is problematic.

Please also see our earlier blogpost on this:

https://www.article19.org/resources.php/resource/38577/en/corporate-actors-must-not-facilitate-human-rights-violations-through-new-chinese-rules

Best,

Niels

On 10/16/2017 01:58 PM, [email-masked] wrote:
> _______________________________________________
> regext mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/regext
> 

-- 
Niels ten Oever
Head of Digital

Article 19
www.article19.org

PGP fingerprint    8D9F C567 BEE4 A431 56C4
                     678B 08B5 A0F2 636D 68E9

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 16 Oct 2017 16:18:00 +0000

> -----Original Message-----
> From: regext [mailto:[email-masked]] On Behalf Of Niels ten Oever
> Sent: Monday, October 16, 2017 12:04 PM
> To: [email-masked]
> Subject: [EXTERNAL] Re: [regext] I-D Action: draft-ietf-regext-
> verificationcode-02.txt
>
> Dear working group,
>
> I remain very concerned about the potential negative impact of this draft
> on the right to freedom of association, the right to privacy and the right
> to freedom of expression.
>
> Even though this was now brought up several times the author does not seem
> to want to explicitly address this, which I think is problematic.

Niels, I am not the author (we are co-workers), but you and I were exchanging email on this topic back in April. I never did receive a reply from you for the last message I sent requesting clarification on the points above:

https://www.ietf.org/mail-archive/web/regext/current/msg00677.html

Scott

---

From: Niels ten Oever <[email-masked]>
Date: Mon, 16 Oct 2017 18:35:06 +0200

Hi Scott,

> https://www.ietf.org/mail-archive/web/regext/current/msg00677.html

In that email I was not arguing that acquiring a domain is a fundamental
right. I would argue though that having a domain facilitates freedom of
expression, access to information and the right to association.

The VSP enables the verification of a specific domain to a specific
identity, which is not necessary to run the domain or facilitate the
billing for the registrar, but it does have a potential very big impact
on the right to privacy, freedom of expression, and freedom of
association of the registrant. This makes standardizing this in my
opinion a disproportionate risk to human rights.

That not all domains are available for everyone is clear, and there can
be good reasons for that (the ccTLD example can makes sense). But in
order to do that, no VSP was needed. So I am specifically objecting
again the use of a verification provider, and Internet protocols
facilitating the standardization of VSPs.

Subsequently you asked about the different between human rights
consideration and privacy considerations.

Privacy Considerations are outlined here:
https://tools.ietf.org/html/rfc6973
Human Rights Considerations are outlined here (whereas you are correct
that Privacy Considerations can be part of Human Rights Considerations):
https://tools.ietf.org/html/draft-irtf-hrpc-research

Best,

Niels

-- 
Niels ten Oever
Head of Digital

Article 19
www.article19.org