Subject: whois and zone enumeration

From: Miek Gieben <[email-masked]>
Date: Tue, 3 Aug 2004 01:03:05 +0200

Hello,

I've a simple question. If a TLD would shutdown their whois service,
would zone enumeration then still be a problem?

(ignoring the fact that you might not want to do this)

grtz,
--Miek

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Mon, 2 Aug 2004 23:26:25 +0000

> (ignoring the fact that you might not want to do this)

	once, many years ago, I ran a TLD and -expressly- did
	not run a whois server/service for it.  
	
	if that was still the case, I might still be "grumpy" about 
	zone enumeration simply because the IETF, in an attempt
	to be "helpful" specified several roll accounts that are
	expected to be available at each delegation point. put the
	two together and a "double opt-in" list of freshly harvested
	email addresses which I can send my scam'o'the-day.

	so... zone enumeration + IETF BCP'd roll accounts highlights 
	one of the abusive techniques.  No whois needed. 

--bill

---

From: [email-masked] (Geoffrey Sisson)
Date: Tue, 3 Aug 2004 00:47:17 +0100 (BST)

> would zone enumeration then still be a problem?

Yes.  Elaboration of delegation-only zones is a problem in and of
itself.  Lists of owner names may be (and, in Nominet's case, have
been) employed in combination with RFC 2142 local-parts to create
mailing lists that are subsequently used/sold on for for the purpose of
UCE.

Regards

Geoff

---

From: Paul Vixie <[email-masked]>
Date: Tue, 03 Aug 2004 00:57:01 +0000

> mailing lists that are subsequently used/sold on for for the purpose
> of UCE.

what we have here is a divergence of vision.  security is not obscurity,
and obscurity is not an intended feature of either "dns classic" or any
extension ever made to dns.

consider that almost any use made of a domain will subject it to public
view, where it can be and will be recorded.  consider that many uses of
this data are benign or even well intended, like measurements or search
engines.  consider that every bad use (UCE, etc) can be and will be made
whether obscurity is used or not.

if you have information you don't want the world to know the name of, then
don't put it in dns at all, or use "split dns" to limit the viewability of
this data to small trusted population such as your intranet.

some say that nsecX is a way to make dns as obscure as pre-dnssec dns was.

i say that the asserted obscurity of pre-dnssec dns was illusory, and that
our "complexity budget" is best used for actual features.

---

From: Marcos Sanz/Denic <[email-masked]>
Date: Tue, 3 Aug 2004 21:12:42 +0200

Miek,

> would zone enumeration then still be a problem?

As I said in 
http://ops.ietf.org/lists/namedroppers/namedroppers.2004/msg00472.html
fixing (or shutting down ;-) whois will remove whois from the examples, 
but won't dispatch the traversal problem for us.

Best,
Marcos