[dbound] Re: Related origins in Webauthn

[Andrew Sullivan <[e-mail]>]

On Thu, Apr 23, 2026 at 01:52:00PM -0500, Jeffrey Walton wrote:
>well known url.  I think dbound attempted to partition the set of all
>domains (and not just group related ones).  Corrections, please.

I don't think DBOUND was able to agree on what it was doing.

The original ideas I had were really intended to group related ones and to state definitively that a given grouping was _not_ in effect.  The use cases I was most interested in were things like what this well-known url is intended to do (I'm not keen on this answer mostly because I think it's at the wrong level of abstraction), but also for a delegated zone to be able to assert its independence in the event a parent misbehaves.  (I first started playing with these ideas before the last gTLD round, and I was worried that failing registries would attempt to force delegated domains to accept services, presumably paid, that they didn't want.  This didn't come to pass, so I'm happy that my worry was for nothing.

Others in DBOUND were much more interested in problems arising from anti-abuse especially in the context of email.  This use case very much requires a  domain to have the ability to assert what should happen in its subordinate namespace.  Nobody had any proposal that would solve both use cases, and the mail folks were just totally uninterested in the issues I cared about.  The WG also suffered from a surplus of people who wanted to solve neato problems that, in my opinion, mostly boiled down to, "I will get my name on the top of this," and so nobody was willing to give up their hobby horse.  For reasons I don't fully understand, the mail case didn't get any traction anyway.

Hope that helps,

a

-- 
Andrew Sullivan
[e-mail]