RE: Security vs. Authorization

["Hollenbeck, Scott" <shollenbeck@verisign.com>]

> -----Original Message-----
> From: Olivier Guillard [mailto:Olivier.Guillard@nic.fr]
> Sent: Wednesday, January 10, 2001 12:03 PM
> To: Hollenbeck, Scott
> Cc: 'Paul George'; Ietf-Provreg
> Subject: Re: Security vs. Authorization

> > [n] The protocol MUST provide services to confirm registrar 
> authorization to
> > [delete|renew|update|transfer] an object.
> 
> What happen if the registrant want to change something and 
> the registrar
> doesn't want to do it?

I don't think this is an issue for a protocol used between registry and
registrar.  It sounds like more of a business or contractual issue between
registrar and registrant.

> What happen if the registrar declare himself has the registrant?

Again, I don't think this is an issue for a protocol used between registry
and registrar and is instead a business or contractual issue between
registrar and registrant.

> Are you sure that the registrar is the only one entitle do 
> performe any
> change?

There should be only one registrar authorized to change an object, but they
should do so either on behalf of a registrant or pursuant to whatever legal
arrangement exists between registrar and registrant.

<Scott/>