Subject: Re: dictionary attack on nameservers

From: [email-masked] (Ted Lindgreen)
Date: Thu, 29 Jul 2004 12:30:16 +0200

[Quoting Geoffrey Sisson, on Jul 29, 11:36, in "Re: dictionary attac ..."]

> There's a time consideration which this analysis doesn't take into
> account: If `perfect' snapshots (less negligible effects due to routine
> IXFRs) of the owner names in zones can be obtained frequently and with
> low latency, then new possibilites become available.
> 
> It's one thing to have a photo; another to have a film.

I am affraid I have lost it now, please enlighten me:

1. the argument against enumeration is the European (and/or
   other) privacy legislation;
2. it is clear that 99% enumeration on a daily basis is currently
   practice (perhaps not desirable, but real practice);
3. NSEC may provide for 100% correct snapshots, valid in the
   interval between zone-updates.

Do I correctly understand that you are saying that 2 is "a photo"
and 3 is "a film"?

And with that, must I understand the privacy-lawyer's opinion that
for information, which is in the DNS for deliberate publication,
"filmshots at zone-update intervals" are unacceptable, while
"daily photo's" are current practice?

I am affraid I have really lost it...
-- ted

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Florian Weimer <[email-masked]>
Date: Fri, 30 Jul 2004 14:17:18 +0200

>    other) privacy legislation;

I don't think this is an issue.  Most TLD zone data is already
available on request, under terms that aren't too restrictive.  This
woul be impossible if domain names were personally identifiable
information.

>    interval between zone-updates.

IMHO, the most important question is whether NSEC-based enumeration
causes additoinal load on name servers, or if it might result in less
load.

---

From: Roy Badami <[email-masked]>
Date: Fri, 30 Jul 2004 14:12:29 +0100

>>>>> "Florian" == Florian Weimer <[email-masked]> writes:

    Florian> I don't think this is an issue.  Most TLD zone data is
    Florian> already available on request, under terms that aren't too
    Florian> restrictive.

My understanding was that there are many ccTLD operators who do not
make copies of their zones available.

     -roy

---

From: Alex Bligh <[email-masked]>
Date: Fri, 30 Jul 2004 15:24:27 +0100

> make copies of their zones available.

Mine too - further that those who do make it available do prescribe
certain uses contractually, including further publication. I wonder
if CENTR has some stats.

Alex

---

From: Florian Weimer <[email-masked]>
Date: Fri, 30 Jul 2004 23:14:25 +0200

* Alex Bligh:

> certain uses contractually, including further publication.

If the data were privacy-sensitive, it couldn't be shared at all
without explicit consent from the domain name owner (at least
according to most EU law).  Certainly most registries, registrars and
DNS service providers don't share this view.

There might be other reasons to keep zone data confidential.  If this
is the case, they should be named.  Privacy concerns are not an excuse
for everything. 8-)

---

From: Alex Bligh <[email-masked]>
Date: Fri, 30 Jul 2004 23:08:43 +0100

--On 30 July 2004 23:14 +0200 Florian Weimer <[email-masked]> wrote:

> according to most EU law).

Whilst that is true, it isn't true in the sense you imply, as registries
do demand explicit consent for certain limited disclosures in the
contract of registration. See for instance:

  http://www.nic.uk/ReferenceDocuments/TermsAndConditions/

specifically section 6.1(c). Note the PRSS as described (compressed
registry) was suspended as a service for (inter alia) privacy reasons,
and is to be replaced by a public registry search service.

Alex

---

From: Roy Badami <[email-masked]>
Date: Fri, 30 Jul 2004 23:57:52 +0100

>>>>> "Florian" == Florian Weimer <[email-masked]> writes:

    Florian> If the data were privacy-sensitive, it couldn't be shared
    Florian> at all without explicit consent from the domain name
    Florian> owner (at least according to most EU law). 

That's an oversimplistic view of data protection legislation.  One of
the principles in the UK implementation is that personal data can only
be used for the purposes for which it was collected.  There isn't a
binary private/not-private flag; it's very much about exactly what
you're allowed to do with the data that you (legitimately) have, based
on what the purpose of collecting the data was, what you told the data
subjects, what (if any) consent you got from the data subject, what
contractual obligations you have to them, etc.

I'm not making any suggestion as to how (if at all) data protection
legislation impacts the issues being discussed here; just that many
people seem to have an oversimplistic view of what EU data protection
legislation is all about.

In particular, in previous threads, people have claimed that
particular issues _obviously_ couln't be an issue with data
protection...  Any statement like that rings alarm bells; anyone who's
worked with this stuff is unlikely ever to say that something which
involves data that might even remotely relate to people is _obviously_
OK.

I wish people wouldn't believe that the law is as simplistic as
"you're either allowed to publish this or you're not".  No law works
like that.  Quite aside from the fact that although we talk about
"publishing infomation in the DNS", a service that answers queries
doesn't correspond to the traditional legal notion of publishing, and
may well not be regarded as such.  AXFR or NSEC may well be more
likely to constitute publishing.

Though in the UK, in the light of the recent case Durant v FSA, I'd be
inclined to believe that zone files aren't personal data.  I'd have
been far less confident of that last year, though.

IANAL, of course.

	-roy

---

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sat, 31 Jul 2004 00:32:13 +0000

> There isn't a binary private/not-private flag; it's very much about
> exactly what you're allowed to do with the data

This issue was debated at length in the provreg wg. You may not know
this, and may not appreciate the outcome.

In a nutshell, a policy object was adopted for provisioning sessions,
proximal to the p3p compact policy, and a binary toggle was added at
the last minute on data elements. I'm the author of the first proposal,
and I'll let you discover who was the author of the second, and infer
the process issues.

The context was publication via :43, and more generally, bulk transfer
and any other publication mechanism, including zone file publication,
and the protocol EPP.

Cheers,
Eric

---

From: Danny Mayer <[email-masked]>
Date: Fri, 30 Jul 2004 21:11:04 -0400

>and is to be replaced by a public registry search service.

Unless I misread it, this discusses the WHOIS data and says nothing about
DNS which is the subject of this discussion.

Danny

---

From: Alex Bligh <[email-masked]>
Date: Sat, 31 Jul 2004 15:32:06 +0100

> DNS which is the subject of this discussion.

Section 6 says what may be done with personal data (including whois and
PRSS). I made the point as Florian was arguing that "if the zonefile can be
ftp'd under contract, there cannot be a problem with enumeration". That is
simply not the case, as contracts of registration (in the UK and elsewhere)
provide for certain data to be given to limited numbers of other people
under the safeguard of contract - which is entirely different from giving
that data to anyone. Straight from the EU directive that drove the
implementing legislation (for instance) you cannot export the data outside
the EU without certain protections. So sadly Florian's argument (that if
you can ftp under contract lawfully, there is necessarily no problem with
enumerability) is just plain wrong in law.

A much better argument to make Florian's point would be that the data is
not personal data. That is at least arguable. Our advice is that it may
well be.

But as we said last time we went around this big loop - it isn't just a
data protection issue, it's also a publication of database copyright issue,
and a POLICY issue on (inter-alia) privacy, It is entirely possible that
(for instance) site-finder infringed no national law, but offended the
internet community's views on policy.

I am not sure this "why is there the requirement" debate is either
productive or useful. I'd prefer we did "what is the requirement" (from
those who have it), and what are the proposals to fix it. Then, if some
have the requirement, and others, incomprehending of the reasons for it
(and who knows perhaps they are right) don't, it boils down to "does the
next revision of the protocol include the option". No-one has yet suggested
an enumerability option is a bad thing, apart from the protocol complexity
it generates.

I use requirement in the singular above - however, if we are reopening cans
of worms, I would have thought it might be a useful requirement for large
zone file operators to have features which minimize the CPU required to
sign zonefiles where a minimum number of the delegations themselves require
signing - this would ease transition to DNSSEC and encourage deployment; I
note that sub 5 minute zone updates are now becoming the norm (or at least
are on people's near term work plans), whereas they weren't (AFAIK) when
this was last discussed. I have deliberately phrased the above without
mentioning previously suggested implementations or -arends.

Alex

---

From: Greg Hudson <[email-masked]>
Date: Sat, 31 Jul 2004 10:47:05 -0400

> data protection issue, it's also a publication of database copyright issue,

I'd like to understand this point better.  Who would be infringing upon
whose copyright?

(Separately, I don't know the status of database copy protection laws
around the world; traditionally, information such as you'd find in the
phone book is not subject to copyright.  But my main question isn't
related to that issue; I can't understand how there would be a copyright
issue with a TLD or SLD publishing its own database.)

---

From: Alex Bligh <[email-masked]>
Date: Sat, 31 Jul 2004 16:06:39 +0100

> issue with a TLD or SLD publishing its own database.)

It isn't about the TLD infringing it's own copyright, it's about later
enforceability of copyright. IANAL but AIUI it works this way: there is a
separate copyright on a compilation and/or database than on its constituent
items. So if, for instance, you compile and publish a compendium of poetry,
you hold a copyright on the compiled work, even though you may only have a
license to use the poems therein. [I think database copyright is
technically different from compilations but not such that it matters here].
If, however, you then publish the work to all and sundry without specific
terms of license, it dilutes your ability to enforce license terms against
use of the work later.

As a concrete example (which I could not comment on before as it was at
trial), Nominet recently took action in Australia against a number of
companies and individuals allegedly involved in a data mining attack;
Nominet alleged the information was then used, inter alia, for provision of
misleading invoice-like documents, contrary to various Australian trade
practices legislation (I think you can guess the picture). 4 out of 5 who
admitted liability just prior to trial, one went to trial and we await
verdict. We have taken similar action before, and will continue to do so in
the future (even though they may each cost many hundreds of thousands of
dollars if not more) on public policy grounds. How they got the data is not
relevant here, but, at least for some of the claims, a key factor was not
only that they obtained copies of a database, but also that they had a no
license to do so. If it were the case that we published the database as a
whole without license requirements (i.e. without proscribing the activity a
malefactor performed), it would make it harder to make a successful claim
which rested on the use of the database without license. For these
purposes, it is not necessarily relevant whether some fraction of the
database (even a large fraction) could be compiled from other sources (for
instance Paul's in-addr.arpa or google logs), because Nominet would not
themselves be publishing those - that's someone making their own
compilation. The reason for the public policy is many fold, but for one,
those supplying the data that generates the compilation do so on the basis
of it being used for certain purposes, and not for others - they simply
don't want the data they supply used for spam, scams, etc.; that's not a
legal driver (so if Nominet were a for-profit body after the last dollar
possible this problem would no doubt be solved in the market place for a
suitable number of $), that's a policy driver.

There are some other issues to do with the triangular relationship between
governments, ICANN and ccTLDs - see all the hoo-haa about ccTLD zonefile
escrow a year or two ago - but I don't propose to go into those here as
they are long and seriously off-topic. Drop me a line off list if you
really want to know.

Alex