RE: Security vs. Authorization

[Sheer El-Showk <sheer@laudanum.saraf.com>]

> What eludes me most is the reasoning that a registrar operating in a
> competitive system is more at risk of failure or of not complying with the
> registrar/registrant contract than a (single) registrar operating in a
> monopoly system.

Here's my reasoning on this and there are current examples to support
it.  In a monopoly system your registrar is the only one and hence any
problems will be picked up by the internet community at large and worked
on (eg if NSI went under or couldn't maintain itself while it was still
the only registrar there would have been broad government and corporate
intervention to fix the problem).  I'm not saying that they're have a
perfect service, but as the only service they must at least work.  In a
competative model registrars are smaller scale (I'm not sure how strict
the requirements are to be an accredited registrar, but from what I've
seen they don't require that much technical competence).  If one of them
should fail its merely a company going out its business -- a whole
industry won't be affected, merely its clients.  Besides in the single
registrar model all the data is centralized.  If the registrar goes under
it doesn't really matter who owns which domains.  In the multiple
registrar model the registrars are proxying or adding value added services
to the actual registration process, but, in the case of a "thin" registry,
they will hold all the relevant client information.  Hence, if the
registry all its registered domains would still continue to work (ie the
domain system would not collapse) but there would be a lot of angry
customers with no access to their domains.

By supporting examples I just meant that you can look at the current
accredited registrars -- I'm not going to name any, but I think there are
some which seem (from the technical expertise displayed on their
website) like very small and possible incapable organizations (often
offering very poor support).

I'm not trying to promote a monopolistic model in all of this but what I
think is an important point to make (and I would love to hear discussion
on it) is that the registry is consider a "canonical" source of domain
information (as the ICANN registered TLD owner they are responsible if a
user in their TLD is suddenly unable to access his domain).  Registrars
are merely entities that benefit from adding services or acting as a
proxy.  I'm not promoting the "fat" model here; what I'm saying is
essentially the registry is the legally responsible entity and should thus
have a record (in some unforgable format) of the final domain owner (the
registrant) for each domain.

Regards,
Sheer