Owner Verification - A Proposal

[splashweb]

I’ve been giving some thought to how an owner verification process could be integrated into the .uk name space. This is to address what I believe to be the single most significant, and beneficial, security concern that both Nominet and the UK government currently share.

My thinking is that it isn’t Nominet that’s key to the success of this, rather it’s our friends at the HMRC. My knowledge of internet systems and security can be written on the edge of a postage stamp, so I may be way-off here (be gentle , but I’m keen to start this thread to get opinions from those with more insight. I came up with the following proposal; does it have any merit?

1) Any .uk site that wants to offer owner verification displays a button called “owner.uk” which opens a popup or similar. The button is linked via https to owner.uk (and/or owner.co.uk) and passes a unique encrypted ID, along with the referrer domain. The owner.uk domain is controlled by Nominet.

2) owner.uk displays a “verification in progress” page and the first prompt is to ask the visitor to confirm that owner.uk is visible in the address bar above; if not, get the hell out of there and let us know. [can the address bar be easily hi-jacked?]

3) owner.uk then makes a request of hmrc.gov.uk and passes the unique ID along with the referrer domain. If there’s a match at hmrc.gov.uk for both entities then company owner details are returned to owner.uk. [How secure is domain referrer data within https?]

4) owner.uk also goes to the Nominet WHOIS and then compares registrant data to tax data for relevant matches. [I’m not convinced that this stage actually adds anything to the process, but it “feels” like it does]

5) Results are displayed to the visitor, ie. “The website where you are now is xyz.uk and is owned by ****, registered office in..”.

The ID’s for each business are accessed via their online HMRC account, which I assume to be secure. These codes could be re-issued for each new tax year, if necessary. You would also need to register any referrer domains within this account.

This proposal would be a bit harsh on the current registrant of owner.co.uk, but it currently returns a 404 so I don’t see any existing rights in place, and therefore compensation or compulsory purchase could put that one right.

My thinking here is simply, if you don’t have a UK tax presence then you aint a legitimate UK business. What I also like is the data returned on the business owner could include not only business name and address, but also type of business, number of years trading, directors names and, oh yes, how much tax have they paid in the last 5 years – how topical is that!!

Consumers could not only shop with greater confidence, but also be much more informed about where they may, or may not, want to spend their money.

 

[sdsinc]

Isn't it what SSL certificates try to achieve ?

 

[splashweb]

I'm not sure on the technicalities of that one. I was hoping that someone could look at this proposal and pull it apart or come up with a better one. It seems that this security element of the direct.uk proposal is the most costly one, and it may well be worthwhile coming up with a few cheaper alternatives to the Nominet proposition if we can.

 

[Edwin]

The proposal won't work. Nominet has already watered down the "UK presence" requirement - it's confusing, I know, because they keep changing the FAQ every few days, presumably in response to comments coming in (backpedalling all the way).

From the very latest version of the FAQ:

Are you restricting direct .uk registrations to UK-based businesses?

No. Under the proposals, anyone who has a UK address for service – and whose contact details can be verified - would be entitled to apply for a direct.uk domain name.

http://www.nominet.org.uk/how-parti...y-discussions-and-consultations/direct-uk-faq

 

[ratboy]

So a mail forwarding address for example?

Ace, this gets better.

 

[Edwin]

So a mail forwarding address for example?

Ace, this gets better.

Yes. There are dozens of simple, legal ways to get around the address verification requirement as Nominet is defining it. For example:
- mail forwarding
- lawyer/accountant
- registrar providing an address service
- friend
- relative
etc. etc.

In other words, Nominet's proposal will verify absolutely nothing except whether the postal service is working or not. It won't tell them that a particular registrant is at that address (only that Nominet's one-time message was responded to by "someone") nor will it give them any indication whatsoever of the real identity of the actual registrant.

That's why the way Nominet are presenting the "security" aspects of their proposal to the public, and the media, is such a sham.

 

[splashweb]

I see what you mean about the moving goalposts Edwin, however within their statement lies "and whose contact details can be verified" which sounds like the expensive part to me and needs combatting with an alternative of some sort.

What I'm proposing won't meet Nominet's stated need of verifying contact details, but I think it still stacks up as an alternative approach to the subject of consumer protection.

 

[Edwin]

I appreciate what you're saying, but I'm not sure that it's necessary to develop an alternative to something that is itself deeply, inherently flawed. It may be sufficient to point out very clearly WHY it's flawed, and WHY it can't easily be fixed (i.e. to make that part of the proposal sound "more trouble than it's worth")

Incidentally, what many registrars are proposing for new GTLDs is to verify EITHER email OR phone numbers (law enforcement would prefer both) using automated methods. For instance, email a unique link to be clicked - click verifies validity of email address, or automate a phone call which gives a unique pin to be entered on a site.

Again, neither process provides a single shred of credible evidence about who is actually the registrant, but it would at least prove that the email address worked (once) or that the phone number was answered (by somebody).

AFAIK there have been no credible proposals put forward at the GTLD level for verifying real world, snail mail addresses (though that's something that already happens in other contexts, e.g. various local search companies e.g. Google Pages already try and do this)

There's more about this issue in various transcripts from the recent ICANN45 sessions held in Toronto, e.g. http://toronto45.icann.org/meetings/toronto2012/transcript-raa-negotiations-15oct12-en.pdf

 

[websaway]

It's trying to sort a problem that goes nowhere towards solving the whole issue. The whole .UK proposal is purported to be a security issue. POPYCOCK !