CAUCE

Who Are Domain Names For?

Last week, the Libyan government seized and disabled Violet Blue's "sex-positive" vb.ly URL shortener. I've discussed URL shorteners before, but what does Libya have to do with it?

Actually, that part's pretty simple. The .LY domain belongs to Libya, so their laws apply -- even if the registrant or their web site isn't physically in Libya. The company which manages registrations in .LY decided to permit registrations by companies or people outside of Libya, but they still own it.

Originally there were only a handful of "global" or "generic" top-level domains, known as gTLDs, available to anyone in any country: .COM, .NET, .ORG, and .EDU. .GOV and .MIL were effectively only for the United States. .INT, reserved for organizations created by international treaty, is rarely seen.

Each country has their own ccTLD, based on the ISO two-letter country codes. Some are fairly obvious to English speakers: .US for the United States, .CA for Canada, .UK for the United Kingdom, .AU for Australia. Some seem a bit more obscure, due to differences in language or conflicts with other names: .TD for Chad, .RS for Serbia, or .ZA for South Africa.

Each ccTLD authority sets their own rules for who is allowed to register one of their names. Island nations Tongo (.TO) and Tuvalu (.TV) have reportedly made some pretty good money by permitting non-local registrations. After splitting from Yugoslavia (.YU) and Serbia, Montenegro opened .ME in hopes of attracting English speakers -- and sold over 320,000 domains between 2008 and 2010. Colombia's .CO, which attracts typos of .COM, sold half a million in two months -- mostly to registrants in the United States.

But none of this addresses the real question: what do actual users care about?

In March the most popular search term on Google, Yahoo!, and Bing was "facebook". Other top searches across all three, according to Experian Hitwise, included youtube, myspace, craigslist, ebay, and gmail. Perhaps ironically, "google" was the second most popular search on Microsoft's Bing.

Does it matter whether Facebook is facebook.com, fb.me, facebook.ca, facebook.co.za, et cetera? Well, unfortunately, it kind of does. If a bad guy registered facebook.ql (which is just an example, there's no .QL ccTLD), then they could put up a site that mimics the real Facebook, and send phishing email which might have a better chance of fooling users than the usual nonsense domains. And, of course, there are the usual trademark issues. So, Facebook has had to register in all of these.

To put it another way: big brands are effectively required to register their trademark in every gTLD and ccTLD they can, because most users are completely unaware of gTLDs and ccTLDs. If the TLDs effectively separated different types of organizations, as was originally imagined, then this wouldn't be necessary.

There's also another type of user to consider. Violet Blue chose to register vb.ly because she wanted something short and easy to remember, and was following the trend set by bit.ly, jl.ly, et cetera. Unlike .ME or .TV the value wasn't that vb.ly has any particular meaning, but rather that it's short and appeared to be easy. URL shorteners are for the people who don't type "facebook" into google, and do want to share links to specific things. Of course, if web designers considered the length of URLs when designing their sites, this wouldn't be as much of an issue.

ICANN, the quasi-non-governmental organization which oversees these top-level domains, has introduced quite a few other gTLDs in recent years. Many of these are restricted in some fashion, which helps to reduce the land rush; for example, .MUSEUM is only for museums, though of course most museums already have domains under .ORG, .EDU, .GOV, or an appropriate ccTLD.

Only two of the newer gTLDs are unrestricted: .INFO, and (for most purposes), .BIZ. When was the last time you saw a company put their primary site in .BIZ or .INFO, rather than having it be a redirect to their site in .COM? Oh hey, it was Return Path -- and we switched a few years ago to returnpath.net, because most of our neighbors in .BIZ were spammers or phishers. .INFO has the same spam problem; some spam filtering software sees the mere presence of .BIZ or .INFO as increasing the likelihood that a message is spam.

Ignoring these concerns, ICANN has decided to open up the namespace further and permit pretty much anyone with $185,000 and a bunch of nameservers to register their own gTLD -- likely before next March. It's unclear if anyone actually wants this except the potential new gTLD registries, who stand to earn a lot of money over trademark concerns. For example, the .CO registry initially offered a "Specially Protected Marks" program, permitting companies to register their trademarks ahead of the general populace. .CO claims "100% Participation by Leading Brands", and any new unrestricted gTLDs can surely expect the same.

Even if a company creates a new gTLD for their own use, such as .IBM, they'll still need to keep ibm.com, lotus.com, et cetera -- everything they have now, plus the same trademarks in every other gTLD.

Once all that dust has settled, and the registries and ICANN have made their money, we'll still be left with an ever-greater threat of phishing or other brand hijacking. Most end users will still expect to find their friends by typing "facebook" into google, while a smaller number will still want shorter URLs.

If domain names are for end users -- if, indeed, the internet is for end users -- then why do we need more TLDs?

(This article was originally published on The Received: Blog, and has been reproduced here with permission from from Return Path.)

How Your Privacy Is Exploited Online and How To Protect Yourself

I spotted a disturbing headline which reminded me to repost a recent series about online privacy in the Wall Street Journal.

Suit alleges Disney, other top sites spied on users - CNET News

A lawsuit filed in federal court last week alleges that a group of well-known Web sites, including those owned by Disney, Warner Bros. Records, and Demand Media, broke the law by secretly tracking the Web movements of their users, including children.

...

Among the laws that were allegedly violated by Clearspring and the other defendants are the Computer Fraud and Abuse Act, California's Computer Crime law, and that state's Invasion of Privacy Act.

(CNET uses trackers themselves. Using the Firefox plugin Ghostery, we see that they monitor using Twitmeme, Comscore Beacon, Revenue Science, Yahoo Buzz, Facebook Connect, Google Analytics, and Chartbeat to monitor your surfing)

The article above references a multi-part series I highly recommend you read if you care about your online privacy (just for the record, the Wall Street Journal uses the following trackers: Facebook Connect, MSN Ads, Chartbeat, Peer39, Fox Audience Metrics,  Google Analytics, Omniture, WoprdPress Stats.

CAUCE uses Google Analytics and Bit.ly, and Typepad, where we are hosted, inserts Quancast tracking into our posts.).

The New Gold Mine: Your Personal Information & Tracking Data Online - WSJ.com

How to Outsmart Tracking Cookies on the Web - WSJ.com

What They Know About You - Personal Information Tracked Online - WSJ.com

Analyzing What You Have Typed - WSJ

Facebook, Privacy, and the Loss of Trust

Image by Compound Eye via Flickr

Facebook sure is getting beaten up recently. There's even a crowd-funded initiative to replace it with something open, called Diaspora -- everyone on Facebook is talking about it.

Yet it wasn't even two full years ago that Facebook was the darling of the ditherati. For a while it seemed as if nearly everything Facebook did was hailed as the future of messaging, perhaps the future of the Internet — or maybe the Internet didn't matter anymore, except for Facebook. Even obvious scams got VC funding, so long as they were on Facebook. But with just a few missteps -- which they appear to believe were nothing more than misunderstandings -- everything's changed.

The first tipping point, it seems, was Facebook founder Mark Zuckerberg's statement that he doesn't believe in privacy, with the obvious connotation that therefore he doesn't have to concern himself with it. But as researcher danah boyd responded, privacy isn't just about whether or not you share stuff -- it's whether or not you have any control over what you share, and who you've shared it with.  And besides, it doesn't matter whether Zuckerberg believes in privacy.  Facebook's users still do.

The problem Facebook has created for themselves is not that nobody wants to share information about themselves; it's quite obvious that there's a lot of sharing going on. It's that with each new feature, Facebook changes the social dynamic. Before, Facebook users felt and believed that they were sharing with their friends, and with particular networks they'd chosen; it was a closed environment, with borders that were clearly defined and understood. And if a few advertisers got to peek in, well, that was the price of admission. But now, after many changes, much of that same information is entirely public -- unless each user individually goes through a set of complex steps to opt out.

It's akin to sending email to a private mailing list, only to have it forwarded to a reporter and published. Sure, it's always possible that that can happen, but we can either trust each other to abide by the social contract to not do such things, or we can't trust each other at all.

Facebook's staff may well have thought to themselves that if they asked users to opt in to having their data shared with a much broader audience, the users would decline -- and they were probably right. But by ignoring that insight and making it opt-out instead, they showed a severe lack of respect for their users. Without that respect, there can be no trust. Without that respect, your users will turn on you -- because they were never really "your" users to begin with.

Once trust is lost, what do you do? Can it ever be regained? Or will trustworthy behavior have to be forced upon them by regulators?

We at CAUCE have pondered this same question over the years in terms of companies who used to send spam, and have since learned not to. Some people will never forgive them, no matter what they do. Others won't see what the big deal is, because the spam never affected them personally. But most will fall somewhere in the middle, never quite trusting the company not to spam them again.

That middle area is the most Facebook can hope for at this point, and the way to gain it is to start viewing everything in terms of "what do users think is going on," rather than "what do we want users to think is going on?" More than anything else, they have to ask themselves: "are we being respectful towards our users?  Are we allowing them the choice and control they believe they already have?"

It sounds like they're already thinking in this direction, or at least they want us to think they are -- but that doesn't mean users' perceptions will change overnight. Facebook won't be forgiven that easily, especially if their PR tactic is essentially "oh, you just didn't understand what a wonderful thing we're doing." They'll have to patiently explain their thinking in an honest way, keeping corporate doublespeak to a minimum -- and stay consistently respectful for a very long time.

Even then, success may not be measured by a decrease in angry blog postings. It also won't be measured by a decrease in the number of people deleting their accounts. Trust is much more nebulous than that. If anything, it'll be measured by whether anyone's willing to try new features when given the opportunity to opt in -- and that, too, could take a long time.

If they stick with it, and they're open and transparent about the change, then they could continue to be the largest and most successful proprietary social network that has ever existed...at least until some other tipping point occurs.

Related articles by Zemanta

• Mark Zuckerberg may have wanted this kept private (trueslant.com)
• The best article ever about Facebook (fakesteve.net)
• Facebook Should Follow Its Own Principles (eff.org)
• Facebook's follies: A brief history (news.cnet.com)
• Taking permission (wordtothewise.com)

ARIN makes a sane decision about IP WHOIS

The recent ARIN XXV meeting in Toronto had two positive developments related to WHOIS privacy and accuracy of data.

A decision was rendered about contentious proposal 2010-3: Customer Confidentiality https://www.arin.net/policy/proposals/2010_3.html which allowed for commercial IP holders to have hidden WHOIS records, ostensibly to prevent client poaching between ISPs. As one commenter said at the meeting 'if you are losing customers, fix your business'.

Both CAUCE and MAAWG were opposed to this proposal, which was withdrawn by the submitter, Aaron Wendel, after some discussions with representatives of the LEA community. The proposal made provision for decloaking WHOIS records upon request, court order, etc. by law enforcement, a hopelessly naive understanding of the current situation with regard to anti-abuse work. It was impressed upon the assemblage that grass-roots anti-spam investigations were behind the majority of takedowns of malicious sites, for example. Tom Grasso, an FBI investigator who was in attendance commented, "95% of our successful cases are as a result of grassroots investigators. Limiting ARIN WHOIS to LEA is not a good idea"

Despite having been withdrawn, a vote was taken, and nonetheless, defeated roundly.

Of the 133 attendees to the meeting, 5 voted in favour, 70 against.

A second bit of good news was related by Leslie Nobile, ARIN Director of Registration Services who noted that ARIN would commence a process of confirming all WHOIS email points of contact, beginning in June, 2010, and that this would become an annual process.

CAUCE Director Matt Sergeant was in attendance at ARIN to represent our position as a signatory and supporter of the MAAWG position statement.

Download MAAWG Comments ARIN Draft Policy 2010-3

Email User Safety At Risk - MAAWG Consumer Survey 2010

The 2010 version of the now-annual Messaging Anti-abuse Working Group (MAAWG) ‘Email Security Awareness and Usage Report’ was released yesterday. While un-belied by the title, the vernacular name might get a bit more attention: ‘The MAAWG Consumer Email Survey”.

The key findings of this comprehensive study can be found here, and the full report downloaded here.

Consumers were surveyed in North America and across Europe with a variety of questions from computer expertise and savvy, to their preferences of email.

Many of the findings are both shocking and disturbing; despite efforts to the educate, consumers are well unaware of the consequences of their actions, and a painful percentage continue to click on spam, knowingly, instead of deleting it immediately. Such actions has, of course, lead to the gargantuan increase in botnet presence on the ‘net and zombie’d computers continue to steal millions of bits of personal and confidential business information as a result.

Clearly, a concerted effort to heighten consumer awareness of the very real dangers on the net is needed; involving all stakeholders, marketers, receiving sites, government, and NGO consumer advocacy groups. The resources are out there, for example StopSpamHere.ca and Onguardonline.gov (more resources below), but do not appear to be used, or sage advice heeded.

Equally striking are the findings about the email consumers actually want and care about. it has long been CAUCE's contention that email is about personal communication. The survey's respondents from across the world agree.

On page 14 of the full report consumers state their preferences for various types of email; clearly one-to-one communications is still the cock of the walk when it comes to the type of email we all like to receive, messages from friends and family were ranked as ‘extremely or very important’ to 82% of respondents.

Strikingly, marketing email was only rated similarly by 15% of those surveyed; however, 32% did view such mail as ‘somewhat important’.

Graphic courtesy of MAAWG.org,reproduced with permission

This seemingly speaks to some fundamental issues that the marketing community must deal with if they are to better themselves in the eyes of consumers, irrelevant content and over-mailing are serious issues that enlightened marketers are working hard to deal with, but much more can be done, industry-wide to address them.

Other End-user oriented Resources (please help promote them!)
StaySafeOnline.org
StopBadware.org

T'is the Season for Apartment Rental Scam Spams - Consumer Alert

Summer tends to be moving time here in Montreal, as it is elsewhere. This year, I have decided to move, and thought it would be an opportune time to share a warning about some scams that are related to this seemingly harmless activity.

First off is the 'Too good to be true' Craigslist posting (or Kijiji, or any other public listings site!). Last time I moved, I went searching on CL for a new place, as so many do. I found a nice listing, and emailed the purported landlord. I got an email back from someone claiming to be on missionary work in Africa, and if I would just send him or her some money, the place was mine; I could pick up the key when the cheque cleared.

I researched a bit further, and found that what the scammers had done was re-post a previous listing on CL from a few weeks past, dropping the price enough to make the offer seem great, but yet remain credible. A call to the landlord and an email to Craigslist Abuse had the listing and a few others taken down.

Scam two: Advance Fee Fraud - I am now subletting my place, and today, a very nice lady ostensibly in Benin is offering to send me money to reserve my flat, sight unseen. No doubt, it will be a cheque, which I would deposit. Then, complications will arise, she will ask for her money back, less a fee for the hassle. The cheque would take some time to clear, but by then, the money would be safely in the hands of the scammers.

Bottom line: Never rent an apartment or house from someone who isn't present to show you around, and pay with a cheque noting the address, and the date of the first month of rental. Here in Quebec, we have government issued lease forms available everywhere, always use them, and make sure the person renting has the authority to do so. Otherwise, come moving day, you may find yourself without a place to live.

Never pay out money from cheques you receive before your bank has had time to clear the payment, and are 100% willing to state the transaction is legitimate. Otherwise, you will find yourself on the hook for the money.

As always, the old saw 'if it seems too good to be true, it probably is' applies. Remain skeptical, especially in your online dealings.

Neil Schwartzman
Executive Director, CAUCE

A Word of Warning about your Donation to Charity

Many of us have seen the heart-wrenching scenes from the world’s latest natural disaster, in Haiti, and want to help.

Unfortunately, there are some who would take advantage of the situation, and people’s charitable nature, and put fraudulent requests for money online. As Linda McGlasson over at the Bank Info Security blog said ‘there Is a special place in hell’ for people like this.

Let’s hope so, because the sad, awful truth of it is that Symantec is reporting this morning that they have already seen spam fraudulently claiming to be from the Red Cross, soliciting donations for Haitian Earthquake relief funds. There have been sporadic reports of fraudulent tweets on Twitter, and some Google search results have been skewed in an attempt to divert people to malware and phishing sites.

Do not use links to potentially fake charities from anywhere but the most trusted of reliable sources.

To be safe, check the list of charities at www.whitehouse.gov

If you are in Canada, the Canadian government is matching private donations – you can find more information here.

If you are in another country, check out your federal government’s or local newspapers’ websites to find out where best to send funds.

Lastly, and most importantly, don’t let these bad actors scare you off from doing the right thing. Please donate generously, if for no other reason than to prove the world is a better place than they make it out to be.

By the way, please feel free to repost or tweet this article.

A Look Inside the European Response to Spam

by J.D. Falk

Last week the European Network and Information Security Agency (ENISA), which assists the European Commission and its member states with network and information security issues, published its third Anti-Spam Measures Survey. The survey provides insight into how network operators in Europe are responding to the continued onslaught of email spam.

Nearly all respondents consider spam to be a significant part of their security operation, primarily because it reduces the quality of their service for their customers. This makes spam prevention effectiveness a key selling point, and a competitive advantage. It also impacts customer service operations, and adds to infrastructure management and costs. A quarter stated that their anti-spam budgets exceed €10,000 yearly; one reported theirs at €50,000. This does not include customer service, and I'd suspect it doesn't include personnel.

The majority provide "clear contact details for reporting e-mail abuse", and these complaints are the most common method for detecting spam. The next most common are to monitor for peaks in traffic, traffic anomalies, and spam signatures. Nearly 40% use spam traps. All of these methods are more common with the larger providers.

Everyone provides inbound spam filtering of some type. The most common is the use of blacklists, followed closely by content filtering. Blacklisting of URLs is more common than I'd expected, while reputation systems are far less common than I'd expected. The larger the provider, the more likely they are to use a reputation system and a whitelist.

Those who do use reputation systems are more likely to use their own internal database, followed closely by free reputation systems. Commercial reputation systems are a distant third. Because the report didn't list specific reputation system operators, it's unclear whether they'd consider something like Sender Score to be free or commercial.

Sender authentication is in third place for detecting spam, though the most common forms of authentication are SMTP AUTH and SMTP TLS. AUTH is only useful in preventing outbound spam (by ensuring that users attempting to send email are authorized to do so), while TLS doesn't provide a trust identifier in the same way as DKIM or SPF, so I'm not sure how to interpret this. I suspect the ENISA researchers may be conflating some unrelated concepts.

DKIM usage has increased from about 5% to 17% since 2007, and SenderID from 5% to 9%. SPF dropped a bit in usage, though still close to 40%. It is not clear from the report what the respondents actually do with the results of checking DKIM, SenderID, or SPF.

More than 60% of SMTP connection attempts are aborted due to blacklists; after factoring in invalid addresses and greylisting, fewer than 20% of connections are accepted. After accepting the connection, nearly 80% of messages are filtered out as spam. In total, 95.6% of messages are blocked or filtered. This is very similar to the MAAWG metrics.

Surprisingly, fewer than 80% forbid their users from spamming in their terms & conditions, or otherwise inform them of the legal risk of spamming. More than half rely on technical methods including blacklisting users from sending mail, limiting outbound mail volume, virus scanning, and blocking or otherwise managing port 25.

Even more surprising is the finding that 89% of respondents still process abuse reports manually -- an increase from 73% in 2007! Only 16% offer feedback loops to other organizations. 8% -- all large or very large providers -- use ARF. Looks like we have some work to do.

Another difference from North America, and particularly the United States, is the concern that there's an inherent conflict between filtering spam and protecting privacy. The report reminds us that the European Commission's Article 29 Data Protection Working Party determined in 2006 "that spam-filtering can be justified under the EU's legal framework", and recommends greater publicity of these findings. Even so, it's likely that the privacy framework in Europe removes some options, such as complaint feedback loops to senders, which are already common in the United States.

The ENISA report also makes some important recommendations, centering on increased collaboration between providers and reporting spam sources to law enforcement authorities. Email marketing was not mentioned at all.

CAUCE applauds ENISA and its participants for collecting and interpreting this important, useful data, and we sincerely hope things improve before the next report in 2011.

Huge US fine for NZ spammer - CAUCE President John Levine Assists in Case

The New Zealander identified by the United States Federal Trade Commission as the ring leader of an international spam network has been ordered to pay $US15.15 million by a US federal judge.

A year ago Lance Atkinson, who lives in Pelican Waters, Queensland admitted his part in the spamming operation in the High Court in Christchurch and paid a financial penalty of $NZ100, 000 plus costs of almost $NZ8000. The FTC took separate action against him but not his brother Shane and Christchurch courier Roland Smits who just last month were ordered to pay $100,000 and $50,000 respectively for their parts in the operation.

These settlements marked the final stage of Operation Herbal King, an investigation conducted by the Department of Internal Affairs’ Anti-spam Compliance Unit, the FTC and other overseas agencies. Within three months of the passing of the Unsolicited Electronic Messages Act in 2007, the Department had shut down the New Zealand component of what the anti-spam organisation, Spamhaus, ranked as the largest pharmaceutical spamming operation in the world. The spam gang deceptively marketed products such as male-enhancement pills, prescription drugs and weight-loss pills.

The operation organised and paid affiliates around the world to send spam emails marketing Herbal King, Elite Herbal and Express Herbal branded pharmaceutical products. These were manufactured and shipped by Tulip Lab of India, through a business known as the Genbucks Affiliate Programme. This business was operated by Genbucks Ltd, a company incorporated in the Republic of Mauritius.

Lance Atkinson’s American accomplice in the network, US resident Jody Smith, has had to turn over nearly all his assets to the FTC. He will pay approximately $US212,000 and will also assign any rights he has to $US91,000 frozen in the name of one of his co-defendants, and $US547,000 that may be held for his benefit in an Israeli bank. In addition to the $US15.15 million that Atkinson and his company, Inet Ventures Pty Ltd, have been ordered to pay, the three companies affiliated with Smith are liable for $US3.77 million. Smith is awaiting sentence on a criminal charge of conspiracy to traffic counterfeit goods and faces up to five years in prison.

Internal Affairs Deputy Secretary Keith Manch said the Department appreciated the co-operation its Anti-Spam Compliance Unit received from the FTC.

“The FTC provided technical information making it possible for our investigators to identify the spammers and obtain evidence of the offending,” he said.

The Department would also like to acknowledge the assistance of the following in the investigation: Telecom New Zealand; Vodafone New Zealand Limited; Safecom services; DMZGlobal (TelstraClear Ltd); Phil Hay, Senior Threat Analyst, M86 Security Labs; consultants Dr John R. Levine and Henrik Uffe Jensen; CSL NRW.NET Computer Service Langenbach GmbH; email compliance and anti-spam company, LashBack; Simon Cox and Richard Vadon, British Broadcasting Corporation.       

The (Possible) Future of International Spam Laws

by J.D. Falk

After more than a decade of fits and starts, fear and doubt, lies and lobbying, legislative attention towards spam now seems to arrive in regular waves.

Our friend Dennis Dayman reports on deliverability.com that a new law has taken effect in Israel, requiring (in short) opt-in — and so according to the International Herald Tribune, Israeli marketers were rushing to re-confirm questionable subscriptions before the deadline this past Monday. In Canada, Internet law expert Michael Geist lambasted his government for continuing to fail to pass any anti-spam legislation, four years after he and the National Task Force on Spam — which also included our own Neil Schwartzman — strongly urged them to take immediate action. And this week at the Internet Governance Forum in Hyderabad, I've heard representatives from more than a dozen governments from all over the world discussing not whether "cyber crime" legislation is necessary, but rather how it should be formulated to fit their local legal standards and culture.