Re: [DNSOP] Proposal: Whois over DNS

[Ted Lemon <[e-mail]>]

On Jul 9, 2019, at 2:32 PM, John Bambenek <jcb=[e-mail]> wrote:
> Then why do we allow them to have social media accounts, email accounts, etc?
> 
We don’t.
> How many RFCs involve using passwords somewhere in them? We know users pick bad passwords. We know users reuse passwords. And we know credential theft and misuse is a big problem. Were these same considerations given to those proposals? If not, why is THIS proposal that involves basically phone numbers and email addresses getting this scrutiny?
> 
If someone were to propose using passwords in a new specification, I think it would see fairly significant pushback.
> If this is the hangup, then why isn't there a PIA (or related) process for every I-D and RFC? What formal process should I undergo to have this evaluated? Or should there be one created?
> 
There is.  There are several RFCs that you should read that talk about the problem.  You are expected to know about them.

e.g.: https://tools.ietf.org/html/rfc6973 <https://tools.ietf.org/html/rfc6973>
e.g.: https://tools.ietf.org/html/rfc8280 <https://tools.ietf.org/html/rfc8280>
e.g.: https://tools.ietf.org/html/rfc2804 <https://tools.ietf.org/html/rfc2804>
e.g.: https://tools.ietf.org/html/rfc7258 <https://tools.ietf.org/html/rfc7258>

I could go on, but these are the low-hanging fruit.