Re: [regext] Privacy and HR considerations for draft-ietf-regext-verificationcode

["Gould, James" <[e-mail]>]

Andy,

>    I thought the token was passed by the EPP client (registrar) to the
>    EPP server (registry), the purpose of which is to show that the
>    verification occurred before the transaction.

Yes, draft-ietf-regext-verificationcode defines the structure of the verification code that is passed between the EPP client (registrar) to the EPP server (registry) to show that the verification occurred before the EPP transaction.   
 
—
 
JG



James Gould
Distinguished Engineer
[e-mail]

703-948-3271
12061 Bluemont Way
Reston, VA 20190

Verisign.com <http://verisigninc.com/> 

On 12/18/18, 4:05 PM, "regext on behalf of Andrew Newton" <[e-mail] on behalf of [e-mail]> wrote:

    I am admittedly not as versed on EPP as others in the wg, but is this
    true? From your privacy text:
    
    "This document describes an extension designed to share the data of (or
    generated by) a registrant with the Verification Service Provider (VSP),
    which is a third party."
    
    The intro section of the draft states:
    
    " The Verification Service Provider (VSP) is a certified party to
       verify that data is in compliance with the policies of a locality.  A
       locality MAY require the client to have data verified in accordance
       with local regulations or laws utilizing data sources not available
       to the server.  The VSP has access to the local data sources and is
       authorized to verify the data.  Examples include verifying that the
       domain name is not prohibited and verifying that the domain name
       registrant is a valid individual, organization, or business in the
       locality.  The data verified, and the objects and operations that
       require the verification code to be passed to the server, is up to
       the policies of the locality.  The verification code represents a
       marker that the verification was completed."
    
    I thought the token was passed by the EPP client (registrar) to the
    EPP server (registry), the purpose of which is to show that the
    verification occurred before the transaction.
    
    -andy
    
    On Fri, Dec 14, 2018 at 10:37 AM Gurshabad Grover
    <[e-mail]> wrote:
    >
    > Hi,
    >
    > Thank you for your comments on the proposed Human Rights Considerations
    > section. Please find the draft text below (with an accompanying Privacy
    > Considerations section which will also be useful); hope it is a good
    > starting point for consensus.
    >
    > Privacy Considerations
    > ----------------------
    > This document describes an extension designed to share the data of (or
    > generated by) a registrant with the Verification Service Provider (VSP),
    > which is a third party. The scope of information shared with and stored
    > by the VSP is dependent on the policies and regulations of the locality
    > and the VSP. The extension has no built-in mechanisms for registrants to
    > express preference for what information should shared with the VSP. In
    > certain cases, this will lead to the exposure of registrants' sensitive
    > personal information directly linked to the identities of the
    > individual, such as contained in the contact mapping object, without
    > user control. This may impact users' expectation of confidentiality of
    > their information. This personal information may be further correlated
    > with other data sources available to the VSP.
    >
    > If a service provider seeks to implement or offer this extension, it
    > MUST inform the registrant about about the exact information to be
    > shared with the VSP.
    >
    > Human Rights Considerations
    > ---------------------------
    > The use of this extension may have negative implications for the human
    > rights of potential or actual registrants, depending on the
    > implementation and policies used by the registrar and the VSP.
    >
    > * In particular, the extension might be employed as, or contribute to, a
    > domain name filtering and censorship mechanism. This can negatively
    > impact registrants' freedom of expression, and may further impede their
    > freedom of assembly and association, and social and economic rights.
    >
    > * Depending on the information shared with the VSP and data sources
    > already available to it, the extension may also allow the VSP to
    > discriminate against registrants based on registrants' personal
    > characteristics, beliefs, or opinions. Even when such restrictions are
    > not applied, knowledge of the information being shared with the VSP
    > could create chilling effects on registrants' freedom of expression, and
    > freedom of association and assembly.
    >
    > * The VSP may be a third party entrusted to carry out sensitive legal
    > decisions. Due to the lack of mechanisms in this extension that can
    > facilitate appeal and redressal of a rejection, the registrants' right
    > to legal transparency and remedy will also be impacted in such a situation.
    >
    > Implementers should consider the potential human rights impacts of
    > offering and normalising this extension when advertising support for it
    > in EPP.
    >
    > /.
    >
    > Thanks to Mallory, Niels and Adam for their feedback off-list. The text
    > above may not reflect their opinion.
    >
    > Thank you.
    > Gurshabad
    >
    > _______________________________________________
    > regext mailing list
    > [e-mail]
    > https://www.ietf.org/mailman/listinfo/regext
    
    _______________________________________________
    regext mailing list
    [e-mail]
    https://www.ietf.org/mailman/listinfo/regext