On Mon, Nov 23, 2020, at 18:12, Taras Heichenko wrote:
> > This is completely orthogonal to anything related to email addresses.
> > Long gone are the days when only an email sent was enough to trigger a
> > transfer,
> > and for good reasons.
>
> I said nothing about only an email address but complete contact
> information. Most
> of our registrars were checking an entire Contact object to identify
> the user requesting
> a transfer to avoid court.
I fail to see how this authenticates anything
(and to be able to do this any registrar needs to be allowed to do contact:info
on any contact, with a transfer in the future or not, which is surely a privacy
problem at least, or the data must be public in whois/RDAP which is another
privacy
issue also, besides the fact that in this case anyone can just impersonate
anyone
else by reading the output in this model), but in all cases this is completely
irrelevant to the discussion in this thread so no real point discussing one
specific
registry policy around transfers, yes they are many out there, none to my
knowledge
relying only on email value being known/available to reply.
If registrars want to compare contact data before even staging a transfer
request,
and can per registry procedures/policies in which they operate,
then there is no problem regarding EAI: if the customer gives an
"internationalized" email
to the registrar, and the registrar does not handle it, the problem will not be
solved
by anything done at the EPP level, so is completely out of scope here.
The registrar will have to fix its systems first, and we are back to Mr. Levine
point.
Which is fine if registries want to do that, understanding that in that case
some
registrars may decide not to sell their TLDs, which can be fine or not, but a
problem
for the registry to decide and for which this protocol called EPP can not do
anything.
--
Patrick Mevzek
p...@dotandco.com
_______________________________________________
regext mailing list
regext@ietf.org
https://www.ietf.org/mailman/listinfo/regext
