<<<
Chronological Index
>>> <<<
Thread Index
>>>
RE: [registrars] RE: Registrar Approval of Variable Accreditation Fee for 2003-2004
- To: wessorh@xxxxxx
- Subject: RE: [registrars] RE: Registrar Approval of Variable Accreditation Fee for 2003-2004
- From: Tim Ruiz <tim@xxxxxxxxxxx>
- Date: Thu, 4 Sep 2003 04:02:50 -0700
- Cc: donny@xxxxxxxxxxxxxxx, ebroitman@xxxxxxxxxxxx, registrars@xxxxxxxx, stahura@xxxxxxxx
- Reply-to: Tim Ruiz <tim@xxxxxxxxxxx>
- Sender: owner-registrars@xxxxxxxxxxxxxx
Rick, for the me the point is that getting more precise data does not in any way mean that it is more accurate. The congress, and others, seem to be under the impression that one leads to the other. It doesn't. All this will lead to is a better quality of bad data. What is the problem that they are really trying to solve?<br>
<br>
Tim<BR><BR><br>
<BLOCKQUOTE style="PADDING-LEFT: 8px; MARGIN-LEFT: 8px; BORDER-LEFT: blue 2px solid"><BR>-------- Original Message --------<BR>Subject: RE: [registrars] RE: Registrar Approval of Variable<BR>Accreditation Fee for 2003-2004<BR>From: "Rick Wesson" <wessorh@xxxxxx><BR>Date: Wed, September 03, 2003 1:51 pm<BR>To: "Paul Stahura" <stahura@xxxxxxxx><BR>Cc: "'Donny Simonton'" <donny@xxxxxxxxxxxxxxx>, "'Elana Broitman'"<BR><ebroitman@xxxxxxxxxxxx>, "'Registrars List'" <registrars@xxxxxxxx><BR><BR>Paul,<BR><BR>The example you and Donny put forth are both extremes. Postal validation<BR>alone is not 100% accurate and not for any postal system including the<BR>US Post Office. understand that all postal systems recognize this fact.<BR><BR>Any one of the examples below based solely on postal address and phone<BR>numbers are going to have big holes for gaming. You have to go beyond just<BR>evaluating the name and address in testing accuracy of a registrat!
ion.<BR><BR>The big point that must be communicated to the congress critters is that<BR>no matter the method or methodology of a heuristic to test accuracy of<BR>registrant data, none are 100% accurate. They know this, credit card<BR>companies know it and so does any large business that manages customer<BR>lists or looks for terrorists at airports -- but it is good to remind<BR>everyone involved that no system will provide 100% accuracy.<BR><BR>Paul's point (i think) is that even if we filter inaccurate data it is<BR>still posable to commit fraud (ie successfully lie) From my conversations<BR>with the concerned parties is that they understand there will always be<BR>ways to lie but desire a higher standard that what our industry currently<BR>implements which is -- effectively no checking at all.<BR><BR><BR><BR>best,<BR><BR>-rick<BR><BR><BR><BR><BR>On Wed, 3 Sep 2003, Paul Stahura wrote:<BR><BR>> This is the main crux of the problem: it does not work in practice, but,<BR>&!
gt; hey, it looks good.<BR>><BR>> Because even if an address was a precise and a valid address,<BR>> it is not necessarily the address of the person making the registration.<BR>><BR>> This address is a valid address:<BR>> Smith, David<BR>> 25242 Riverside Drive Ext<BR>> Seaford, DE 19973<BR>> Phone: 302-629-9829<BR>> (there are millions of them, just go to infospace.com, I picked this one at<BR>> random)<BR>><BR>> But did David Smith make the registration?<BR>> Or did a bad-guy just type in David's information?<BR>> The bad-guy could just as easily use a valid address anywhere on the planet.<BR>> Only good-guys would enter true information.<BR>> Then, to bad for them, but that true information would be even more valuable<BR>> to the bad-guy whois-harvesters.<BR>><BR>> The only way to know if David Smith is the guy who controls the domain is to<BR>> send David Smith a postal letter at that<BR>> address and have!
David confirm receipt of the letter and confirm intention<BR>> to register the name.<BR>> Even the .uk registry, a monopoly, has stopped sending paper around the<BR>> planet.<BR>> Then you'd have to do the same with the phone number (call it and have the<BR>> person who answers make the same confirmations),<BR>> but even that high-cost operation will be gamed by the bad guys because the<BR>> phone number can be<BR>> the number of a disposable cell phone, public phone near the valid but<BR>> untrue street address etc.<BR>> Sending a message to an email address, though low-cost, proves nothing about<BR>> the registrant's identity besides the fact<BR>> that the person who controls the domain also controls a nearly anonymous<BR>> free email address.<BR>><BR>> The costs are too high and the real benefit too low.<BR>> The only benefit is that we would be seen as "doing something" at the time<BR>> of registration.<BR>><BR>> !
We (I mean the Internet and the public) get more bang for the buck by doing<BR>> the above<BR>> (sending paper, calling phone numbers, sending email, etc) when there is a<BR>> known problem.<BR>><BR>> Paul<BR>><BR>><BR>><BR>> -----Original Message-----<BR>> From: Donny Simonton [mailto:donny@xxxxxxxxxxxxxxx]<BR>> Sent: Wednesday, September 03, 2003 8:15 AM<BR>> To: 'Rick Wesson'; 'Elana Broitman'<BR>> Cc: 'Registrars List'<BR>> Subject: RE: [registrars] RE: Registrar Approval of Variable Accreditation<BR>> Fee for 2003-2004<BR>><BR>><BR>> The biggest problem we have found is getting the address information from<BR>> all of the different countries to be able to have a 100% correct address<BR>> verification system. In the US and Canada and I'm sure other countries you<BR>> can buy address information for a few thousand a year. Then you have to buy<BR>> the phone numbers from somebody else, Neustar if!
I remember correctly. That<BR>> would work fine for US and Canada.<BR>><BR>> But most of our fraud is not in the US or Canada, it's in other countries<BR>> that you are not able to get the address information from their postal<BR>> service. And how would you verify this address anyway? This is a real<BR>> address of one of our customers.<BR>> "120 meters past McDonald's on Rue Flat Road".<BR>><BR>> Yes and it's valid, because a hotel that is also on the same street is 240<BR>> meters past McDonald's.<BR>><BR>> So address and phone number verification is a great idea, we spent almost 2<BR>> months working on it, then you get outside the US and Canada and you run<BR>> into all kinds of issues with trying to verify the address and phone number.<BR>> Good in theory, not good in practice.<BR>><BR>> Donny<BR>><BR>> > -----Original Message-----<BR>> > From: owner-registrars@xxxxxxxxxxxxxx [mailto:o!
wner-<BR>> > registrars@xxxxxxxxxxxxxx] On Behalf Of Rick Wesson<BR>> > Sent: Wednesday, September 03, 2003 9:53 AM<BR>> > To: Elana Broitman<BR>> > Cc: Registrars List<BR>> > Subject: RE: [registrars] RE: Registrar Approval of Variable Accreditation<BR>> > Fee for 2003-2004<BR>> ><BR>> ><BR>> ><BR>> > Elana,<BR>> ><BR>> > do you have a link to information about the hearing?<BR>> ><BR>> > my $.02...<BR>> ><BR>> > doing registrant validation on signup cuts down fraud so if one reviews<BR>> > the amount of chargebacks one gets verses the cost of whois accuracy<BR>> > requirements performing such validation actually saves us more in<BR>> > chargebacks than costs us in performing the validation.<BR>> ><BR>> > We allow just about anything through the signup process and just don't<BR>> > process the fraudulent or highly supcious applications.<BR>> !
><BR>> > We are working on more elaborate techniques to handle bounces and staging<BR>> > other automated means of communication such as: if email bounces and we<BR>> > have a fax, send a fax, if the fax bounces send a postcard, if all<BR>> > attempts bounce note the information is bad and lock the account with a<BR>> > note that will require additional information if the registrant comes to<BR>> > renew the domain.<BR>> ><BR>> > We could get even more elaborate by identifying telephone numbers that are<BR>> > mobile numbers and sending an SMS message but we don't have the volume of<BR>> > registrations to make that interesting yet.<BR>> ><BR>> > best,<BR>> ><BR>> > -rick<BR>> ><BR>> ><BR>> > On Wed, 3 Sep 2003, Elana Broitman wrote:<BR>> ><BR>> > > On the same note, I am again going out to everyone with a request for<BR>> > > some data (even merel!
y anecdotal) on how you comply with whois<BR>> > > accuracy requirements in the RAA and cost of doing so. This is very<BR>> > > important to provide before tomorrow's Congressional hearing in order<BR>> > > help protect us from "unfunded mandates" based on incomplete<BR>> > > information supplied by interest groups pushing for more Whois<BR>> > > verification and availability.<BR>> > ><BR>> > > Thanks<BR>> > ><BR>> > > Elana Broitman<BR>> ><BR>> ><BR>><BR>> </BLOCKQUOTE>
<<<
Chronological Index
>>> <<<
Thread Index
>>>
|