here - CIRA

A Report to CIRA
Perceptions of CIRA’s Proposed IDN
Launch Policy Parameters:
Summary of Comments and
Submissions from the IDN Consultation
Website: www.idnconsultation.ca
Phase I
December, 2011
Table of Contents
Section
Page
Project Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3
Report Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
5
A. Overview of Main Reasons for Supporting the Introduction of IDNs . . . . . . . . . . . .
6
B. Overview of Main Concerns about CIRA’s Proposed Approach . . . . . . . . . . . . . . . .
8
Feedback on Question 1: Sunrise Period and Trademark Protection . . . . . . . . . . . . . .
13
Feedback on Question 2: CIRA’s Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
17
Feedback on Question 3: CIRA’s Existing Policies, Rules and Procedures . . . . . . . . .
20
Feedback on Question 4: Any Other Comments or Concerns . . . . . . . . . . . . . . . . . . .
21
Alternative Proposed Approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
25
2
Project Background
Background and Objectives
The Strategic Counsel is pleased to provide CIRA with the following summary of findings from comments and submissions
made on CIRA’s IDN consultation website (www.idnconsultation.ca). Prior to any launch of a new policy governing the
implementation of IDNs, CIRA is undertaking a broad public consultation through which it welcomes comments on any
aspect of the proposed elements of the launch, including the elements of the suggested phases and proposed timeframes.
At present, CIRA only offers .CA domain names in ASCII, otherwise known as non-accented Latin-based script (a-z). CIRA
is considering the implementation of French Internationalized Domain Names (IDNs) at the second level (to the left of the
.CA). Initially CIRA is only contemplating the registration of the following Latin Supplement-1 Unicode characters to provide
the opportunity for Registrants to register domain names correctly in French:
1.
é, ë, ê, è
2.
â, à
3.
ô
4.
ù, û, ü
5.
ç
6.
î, ï
All interested Canadians were invited to comment and/or make a submission on the IDN consultation website from
September 20th-December 5th, 2011. A total of 500 people registered to use the site. There were 308 comments and 56
submissions on the questions posed by CIRA, and 4,600 page views.
3
Project Background
Consultation Questions
Feedback was invited on four key questions:
1.
Does the proposed Sunrise period unfairly favour existing Registrants over trademark owners? Should trademark owners
be provided further rights protection? An alternative Sunrise process could include trademark owners. For example:
a. In addition to existing .CA Registrants as described in the Sunrise process, owners of registered Canadian trademarks
containing French characters would also be provided the opportunity to apply for the registration of their exact trademark
during the Sunrise period (e.g. the right to the domain name grâce.ca would be reserved, during the Sunrise period, for the
owner of the trademark Grâce).
b. Validation of all trademark applications would be required.
c. Conflicting requests (where there is more than one potential Registrant with the same trademark, or where an existing
.CA domain name and a registered trademark owner both apply to register the same IDN domain name) would be resolved
through random selection.
2.
Are CIRA’s objectives appropriate? Is there anything that you would suggest be added or removed?
3.
Given CIRA’s mandate and existing Policies, Rules and Procedures, have we left out any issues that need consideration
prior to developing a draft policy on the launch of IDNs?
4.
Do you have any other comments or concerns about any other elements of the proposed launch?
4
Report Organization
In addition to summarizing feedback specific to each question posed by CIRA, the following sections provide an overview
of the main reasons for supporting the introduction of IDNs, the main concerns about or reasons for opposing CIRA’s
proposed approach, and alternative proposed approaches to introducing IDNs. Each section includes point/topic
summaries followed by selected verbatim comments (or excerpts from comments) from site contributors to illustrate the
points being made.
A. Overview of Main Reasons for Supporting the Introduction of IDNs
B. Overview of Main Concerns about CIRA’s Proposed Approach
C. Feedback Specific to Each Consultation Question
i. Question 1: Sunrise Period and Trademark Protection
ii. Question 2: CIRA’s Objectives
iii. Question 3: CIRA’s Existing Policies, Rules and Procedures
iv. Question 4: Any Other Comments or Concerns
D. Alternative Proposed Approaches
5
A. Overview of Main Reasons for Supporting the Introduction of IDNs
Despite the fact that most contributors to the discussion on the IDN consultation website voiced concerns about CIRA’s
proposed launch policy parameters, fewer oppose IDNs in principle. In addition to believing that IDNs will help to support
and protect the French language, those who support the introduction of IDNs most commonly mentioned the following
reasons:
1. There is a desire among many French businesses and organizations to use IDNs.
Some contributors commented that they and/or their clients have businesses that operate and cater to customers in
French and that IDNs would be a welcome feature:
“Bien que d'une commission scolaire francophone, nous trouvons que l'ajout des caractères accentués dans les noms de
domaine serait attrayant…. »
“I'm in favor if this solution. Perhaps because my last name has 2 accents of a 4 letters word... Non the less, I do
international business, business in Canada and also in the 3 major French speaking provinces, you cannot imagine how many times
French speaking clients asked me... eh! Can I purchase my domain with the ''é''... Even English speaking client that have a café (coffee
shop)...
To me this is a plus, it is indeed a good selling feature for CIRA, it might be targeted to the French speaking province, not
only Québec, but New Brunswick and big part of Ontario as well, besides, who care if CIRA introduce a product to make money, we are
all in business for money, if you think the accents with be a detriment to your business, by all means, do not by it.
I see this as a very good idea form the bilingual business aspect. The use is in the owner's hands. By that I mean if a
''English'' company want to buy a domain with accent, it might be awkward, and more than likley will not care. What good can it do.. But a
''francophone'' business that the original name has accent.. eh! Let's get the domain!!”
6
A. Overview of Main Reasons for Supporting the Introduction of IDNs
2. Accents can change the meaning of words and so the ability to use them is important.
It was noted that accents can change the meaning of words, and that historically, accents may not have not been used
because of technical limitations:
« Je crois qu'il est essentiel que les noms de domaines puissent comporter des caractères accentués.
Nonobstant les anciennes règles, encore en usage en France, où l'emploi de accents sur les majuscules n'est pas pratiqué, en
français, comme dans d'autres langues, les accents peuvent changer le sens des mots. Les traducteurs ont d'ailleurs du se
battre pour faire admettre à la compagnie Christie au Canada que malgré l'usage, un BISCUIT SALE et un BISCUIT SALÉ ne
veulent pas dire la même chose.
La pratique de ne pas accentuer les majuscules nous vient du temps où les touches de dactylo ne pouvaient pas taper des
majuscules accentuées jusqu'à l'arrivée des IBM Sélectric avec les boulettes de caractères qui remplaçaient les touches
individuelles. Les appareils de dactylographie étaient principalement fabriqués aux États-Unis et en Grande-Bretagne et les
fabricants n'avaient pas imaginé la nécessité des accents et n'avaient fait concession que pour les minuscules.
Même chose pour l'informatique avant l'arrivée du Macintosh et de son système en langues multiples vers le milieu des
années 1980. Aujourd'hui il n'y a plus aucune raison grâce aux systèmes dans toutes les langues d'ignorer la capacité de
produire des caractères accentués, minuscules comme majuscules. Les noms de domaine ont conséquemment besoin de
subir le même sort… »
“Simply an example of how welcome this will be. It's the French version of the website MissingKids.ca. The French is
EnfantsPortesDisparus.ca, which stands for “enfants portés disparus” (btw, chosen because EnfantsDisparus.ca was already
taken). The middle part “Portes” without the accent means “doors”, which has nothing to do with what we’re talking about. So
the target users of this domain name, i.e. French-speaking Canadians, are obviously not well served by the existing system.”
7
B. Overview of Main Concerns about CIRA’s Proposed Approach
Contributors to the discussion on the IDN consultation website raised a number of concerns and/or questions about CIRA’s
proposed approach to launching IDNs. The following points summarize the main concerns:
1. There is a potential for significant costs associated with the need to register accented domain name variants.
More so than any other issue, numerous contributors commented on the potential expense of needing to register multiple
domain name variants in order to protect the original domain name from phishers and cybersquatters. Some people noted
that there could be hundreds of variants of certain domain names, and that the costs associated with registering these,
both in terms of money and time, might be prohibitive for individuals or small businesses. Many contributors view CIRA’s
proposed approach as a “cash grab”:
“Small businesses are getting squeezed from a new direction every time another variation possibility is developed. Our budgets
can only be spread so thin...”
« De plus cela deviendra très coûteux pour un entrepreneur de se lancer en affaires et de s'assurer
d'enregistrer tous les noms de domaines nécessaires au bon fonctionnement de son entreprise. »
“Your proposed changes will now force me to purchase 36 additional domain variants to prevent squatters from these 8 existing
domains. Pity on those who own domains with more than one or two "a" "e" "u" and "i“”
“I represent a very small, volunteer-run, non-profit organization. We can barely afford the website and domain name as it is.
Fortunately, our name does not involve accents, but I live in Quebec and I'm sure there are many organizations such as ours
living on a shoe-string budget.”
“This idea is totally ridiculous. CIRA should be honest and admit that this action has for sole
purpose and objective to sell more domain names by forcing their customers to react in panic and purchase all the possible
variants of their already paid ASCII based domain names.”
“I do not want to have to register all the diacritical variations I can think of (and probably miss a few) just to protect my established
business. This is an unfair burden, both in productive time and in cost.”
8
B. Overview of Main Concerns about CIRA’s Proposed Approach
2. The introduction of IDNs will increase the potential for fraud, abuse, phishing and cybersquatting.
Many contributors believe that introducing IDNs will enhance opportunities for domain name fraud and abuse, such as by
cybersquatters who purchase variants after the Landrush period ends, and phishers who attempt to re-direct traffic to
confusingly similar sites:
“I am emphatically against increasing the variations available for domain names, it is already difficult enough for companies to
keep up with the new extensions. The proposed changes regarding accents will only further complicate matters, increase costs
and offer opportunities for cyber squatters to "blackmail" legitimate owners of domain names into paying exhorbitant sums for
non-legitimate gain. The process for going after cyber squatters is complicated, cumbersome and expensive, so why offer them
additional opportunities to game the system...”
“I certainly support bilingualism in Canada but this will just open up a "can of worms"
for all the legit domain users out there as the cyber squatters will be all over the accented names.”
“I think it's a good idea to allow accented characters as an alternate spelling of non-accented ones. * But I think it would be a
really bad idea to allow préside.ca and preside.ca to be two distinct domain names. All kinds of confusion will ensue. Even native
speakers of French, and non-native speakers evenmore so, are often terrible at spelling accents right.* Allowing such domain
names would also make phishing much easier. Suppose there is an entity called ottawabank.ca. In order to protect themselves
from phishing attacks using internationalized domain names, this entity would now have to register 53 new domain names…If
they don't register every one of them, someone will use it in a phishing attack. The cost and burden of registering 53 new domain
names just to protect a single existing one is unreasonable.”
“Accented domain names are a good idea providing that they resolve to the same domain name as the unaccented name:
otherwise they are a recipe for disaster. Why? PHISHING. I look forward to receiving future emails directing me to ébay.ca,
goôgle.com, sçotiabank.ca, and cíbc.ca…”
“That said, I would imagine that special characters are going to invite a fair number of not-so-legitimate language-oriented
domain name submissions, not to mention opening up a whole new can of problems with Domain Name squatting, which
despite CIRA's so-called "strict" guidelines is still very much a problem with Canadian Domain Names.”
9
B. Overview of Main Concerns about CIRA’s Proposed Approach
3. The introduction of IDNs will increase confusion and will inadvertently marginalize French domain names.
Many contributors believe that allowing IDNs will be confusing for website users, such that they might have difficult
correctly recalling a website address, and/or be directed to the wrong website by search engines that do not or cannot
properly search for domain names with accented letters. A few also commented that, in some instances, accented
lowercase letters look similar to their unaccented counterparts and might be difficult to see properly on a small screen (for
example, on a mobile device). Because of these concerns, a number of contributors believe that IDNs might be “bad for
business”, by making it difficult for consumers to reach a website, and having the unintended consequence of
marginalizing Francophone businesses:
« L'idée des accents n'est pas la meilleure. Ainsi, le propriétaire d'un domaine grâce.ca pourrait différent différent du domaine
grace.ca. Je crois que nous évitons beaucoup de confusions auprès des consommateurs en ayant un standard international au
niveau des URL. Tout à l'heure je pourrais être le propriétaire de Grâce.ca, alors qu'un autre aura gràce.ca... et que dire de élève.ca
ou elève.ca ou éleve.ca? Trois différents domaines? Non, je crois que nous devons nous en tenir aux écrits internationaux (sans
accents). »
« Je crois que l'utilisation de caractères accentués nuira à la facilité d'utilisation des noms de domaines. L'utilisateur devra toujours se
demander si le nom de domaine contient des accents ou non. Il devra faire des essais successifs et cela découragera l'utilisateur.
Pour ma part, si cette politique est adoptée je conseillerai toujours à mes clients de ne pas utiliser d'accents. Si on pense marketing,
les essais successifs pour accéder à un site sont mortels. »
« Je ne vois pas du tout l'intérêt d'introduire les caractères accentués dans les noms de domaines. Cela ne fera qu'augmenter la
confusion au sein du public qui aura à retenir une donnée supplémentaire pour la saisie des noms de domaine. Le utilisateurs
risqueront plus que jamais de se retrouver sur des sites qui ne sont pas ceux qu'ils cherchaient. Et les gestionnaires de sites web
auront à acheter des noms de domaine supplémentaires pour sécuriser leurs marques et leurs urls. Vraiment, totalement inutile pour
tous! »
“I completely disagree with the implementation of the French character Internationalized Domain Names (IDNs) at the second level.
This will create confusion, not only globally, but also at the national level. If these domains are created, people from non-French
speaking environments will be confused as they most likely will not use the accents (or not know how to use them). For the people
who do use the accents, they already know how to find the websites they need, therefore this addition is not necessary. Please take a
cue from the French themselves who make their websites resemble as many English names and characters as possible to ensure
visibility. From an user standpoint , I can see no benefit to this addition, but I can see significant challenges if this addition were to be
allowed.”
10
B. Overview of Main Concerns about CIRA’s Proposed Approach
4. The introduction of IDNs raises technical issues and security concerns.
Some contributors engaged in detailed discussions about technical implementation issues, and it is clear that CIRA needs
to provide information about how it intends to introduce IDNs from a technical standpoint. There are also concerns about
the security implications of adding IDNs, from spyware and viruses, to security holes and homograph attacks:
“I am against IDNs. I do not believe the security implications have been worked out properly. See for example
http://en.wikipedia.org/wiki/IDN_homograph_attack
Also you have people will take advantage of this to put spyware and virus on your computer tracking cookies. lets say you want to
go to exâmple.ca and your type example.ca some one can set up a malicious site in order to catch people going to that site. It
would be great for me cause I remove virus for a living practically but I still rather not have to explain to people the difference
between "a" and "â". leave things they way they are!”
“The potential for opening new security holes in pretty much every existing web application out there is more than likely above
zero, which is far to much.
Many types of code and other data formats use the domain as a namespace and the CIRA has no way to test this concept
properly across all potential iterations.
We don't know if all the browsers out there... not just the top three or four, but all browsers, including ones on three year old
phones etc will crash and burn if they are sent a domain with accented characters.
Unless I've completely missed something, execution on this will create a major technical and market failure.”
11
B. Overview of Main Concerns about CIRA’s Proposed Approach
5. Many Internet users do not know how to enter accented letters using an English keyboard.
A number of contributors commented on a broad lack of awareness or understanding among English-speaking Internet
users about how to type accented letters using an English keyboard:
“Although I completely understand the desire from the francophone community, this is going to play merry hell with people trying
to get to a domain with accented characters if they are on a non french keyboard. It's only value is that proper names in french
can use accented characters (not a bad thing really) but it excludes a large portion of the population.
This has been pointed out many times already in this comments section. Several people have stated that they can type
accented characters on non french keyboards. They are correct, but they are also thinking very narrowly about the problem from
their own skill set. I can assure everyone that 95% of the people I deal with (let alone know personally) would have no idea that
their keyboards could do it. Even if they did know (as I do) I would have no idea which key combination to hit in order to get the
right accented character. It would also be just about impossible to do from a mobile device.
So, despite comments to the effect of it being a non-issue, it most certainly is an issue!”
“My concern is that most keyboards do not readily show these 'internationalized' characters. One poster suggested something to
the effect that, to get accent grave 'e', all one has to do is type in something like 'alt 130 ='. Really?? Are you serious? Are you
proposing we go back to writing code so we can communicate?”
“I think adding those different characters will make it difficult for many to enter the website address. How do you enter those
characters? I don’t know and I am sure 90% or more of other people don’t know.”
12
C. Feedback on Question 1: Sunrise Period and Trademark Protection
CIRA’s first consultation question about the proposed Sunrise period was framed relatively narrowly, asking if it unfairly
favours existing Registrants over trademark owners. While some contributors answered this question, many others submitted
comments relating to other aspects of the proposed Sunrise period, such as its length and the ensuing Landrush period. The
following points summarize the discussion and/or submissions relating to CIRA’s question about the Sunrise period and
trademark protection, as well as the Landrush period:
1. Trademark owners will already own any related domain names and so do not require further rights protection.
Most commonly, contributors do not see any need for CIRA to open the Sunrise process to owners of registered Canadian
trademarks containing French characters:
“Considering the vast majority of trademark owners will already own an ASCII variant of their trademark, this seems like an
unnecessary concern.
I would also expect verifying trademark ownership prior to or during the sunrise period to be very labour-intensive.”
“I believe the Sunrise process as laid out is sufficiently fair to trademark owners. It carries the principle of precedence consistently
from the current non-accented domain milieu into the proposed accented domain milieu. That is, the trademark holders were able
to register the non-accented versions of their trademarks in the old milieu. Many did, as the non-accented playing field was all that
was available. Those who did not do so, for whatever reason, do not need to be given an advantage that is not generally available
to potential registrants. An additional argument against it is the point 1.c), using random selection for resolving conflict. Random
selection is never a good process. If trademark owners were to be given greater consideration in the Sunrise period, CIRA would
have to develop principles, even a few basic simple ones, to resolve conflicts.”
“Also, I firmly believe that trademarks should have no bearing on this.
Trademark holders who place a great deal of importance on their trade-names will already have registered the necessary
domains.”
“I think that in the case that an existing registrant and a trademark holder both apply for the same domain during the sunrise period,
the existing registrant should absolutely get the domain. The reason for that is that the trademark owner has either not bothered to
defend the mark by disputing the existing registration or has disputed it and lost. Thus, the existing registrant may have just as
good (or better!) claim on the diacritical name as the trademark holder does.”
13
C. Feedback on Question 1: Sunrise Period and Trademark Protection
2. CIRA should extend the Sunrise period from 12 weeks to longer or indefinitely.
Numerous contributors commented that a 12-week Sunrise period is insufficient and/or that the Sunrise period should extend
indefinitely, thereby allowing only existing Registrants to purchase variants of their domain name(s). The latter approach
would be seen to shelter Registrants from the costs associated with purchasing variants solely for the purpose of protecting
their domain name from abuse, while creating an opportunity to use an accented version if they choose:
« Le délai de 12 semaines est trop court. Il faut 26 semaines (6 mois), voir 52 semaines. »
“Sunrise period should simply be the ONLY period. The registrant who owns the non accented version, and ONLY that registrant, may,
at their option, register and also use accented versions. And then have that as the working model in perpetuity. There is no need or
benefit to a "landrush" stage where anyone and everyone can register variants.”
“The proper thing to do would be to compare new domain name applications with replaced (ASCII normalized) accent characters and
extend the sunrise period indefinitely, i.e. only the owner of royalbank.ca would ever be able to register royalbànk.ca or rôyalbànk.ca,
etc. If this is not done we (as members of CIRA) are asking for a lot of troubles in the future.”
“I agree that French words with accents should be permitted to be used in domain-names, but I do not agree that people should be able
to help themselves to one of my domains merely by adding an accent to one of the vowels. If I have a domain "grace.ca", then nobody
should be permitted to register "grâce.ca". Somebody using a French keyboard, intending to reach my website, may inadvertently
reach a competitor who has registered the new, accented version of my name. So, I firmly believe that all domains registered without
accents should be permanently protected from having anybody else register an accented version of the same name.
This should apply equally to the Landrush stage as it does to the Sunrise period.”
14
C. Feedback on Question 1: Sunrise Period and Trademark Protection
3. Registration of .CA domain name variants should be available only to the owner of the original domain name
unless permission is granted.
Similar to the view that the Sunrise period should extend indefinitely, some contributors commented that CIRA should not
allow purchase of domain name variant containing a registered trademark without permission of the owner:
“If I own CACA as a trademark then you can not allow any variation of that without my permission,
I do not have to pay for any language variations, plain and simple I have to approve it or it can not be used. I might opt to sell
CÁCÁ to another party but CIRA can not just give it away.”
“People should NOT be able to purchase variants of ANY existing websites UNLESS THEY ALREADY OWN
THE UNACCENTED ONE!!
To do any other thing is TOTALLY UNFAIR. There is not one person here who has not misspelled a word like google and
ended up somewhere they don't want to be! It's bad enough that this practice exists, who wants to propagate more of the
same?? “
“CIRA must protect current .ca domain name registrants from having to "compete" against squatters or others who
might buy up similar domain names that only vary by the diacritical marks. So, as Ian Allen suggests, once you own a .ca
domain name, then this should prevent anyone else from buying a domain name that has only the diacritical variation. “
« re: "Je recommande que les accents selon la liste prévue soient acceptés, mais que toutes les combinaisons d’accents
soient réservées au propriétaire du domaine SANS accent." J'appuie cette idée, avec la nuance suivante: Je recommande que
les accents selon la liste prévue soient acceptés, mais que toutes les combinaisons d’accents soient réservées au propriétaire
du premier domaine qui a été enregistré avec les mêmes lettres.
Donc, si francoischarron.ca a été le premier domaine à
être enregistré comportant ces lettres, toute variante serait réservée à ce titulaire. De même, si le premier domaine a été
françoischarron.ca, personne d'autre que lui ne pourrait enregistrer francoischarron.ca, francoischârron.ca, etc. »
15
C. Feedback on Question 1: Sunrise Period and Trademark Protection
4. It is not appropriate to resolve conflicting requests through random selection.
A few contributors argued that resolution of conflicting requests through random selection is not fair or appropriate:
“I recognize that the landrush idea is intended to be "fair" to all comers, but it really is not any fairer than the first come,
first served method used for current registrations. The random factor introduced for conflicting requests is no more fair than the first
one getting in and trademark owners should not receive any priority over anyone else…”
“And in any discrepancies wherewith a trademark owner and a potential registrant both register the exact domain name, it shall be
resolved through “random selection”?....I do not speak for all Canadians but don’t you agree that they may feel a little unfair to
those who have been in good standing for many years, or conducted business internationally or worldwide being “equalized” or
“downsized” maybe not in such a context, but an overwhelming feeling of vulernability or instability towards their longstanding
business only to feel “inferior” to maybe those who may be just starting the beginning of an ardous and lustrious career in business,
only to have the matter resolved through “random selection?” That would be my first argument. I think the resolve should not be a
roll of the dice but deliberate and intentional, in all fairness…”
16
C. Feedback on Question 2: CIRA’s Objectives
The second question posed by CIRA was whether its objectives are appropriate and whether anything should be added or
removed. CIRA’s six objectives for the launch of IDNs are:
•
To provide the opportunity to Registrants to register domain names correctly in French, one of Canada’s two Official
Languages;
•
To continue to develop the .CA domain space as a key public resource for the social and economic development for all
Canadians;
•
For the IDN launch policies and procedures to reflect current world wide best practices;
•
To ensure the policies and procedures of the launch be as consistent as possible with existing policies and procedures;
•
For the policies and process not to be unduly complex;
•
To reduce the potential for phishing and user confusion.
Not all of the discussion following this question related directly to CIRA’s objectives, and non-related comments or points raised
are included in other sections of the report. Most of the comments on the objectives were about the last one: to reduce the
potential for phishing and user confusion. While people support this objective, numerous contributors believe that the launch of
IDNs will increase the potential for phishing and user confusion and/or that the only way to reduce it is to allow only one
Registrant to hold all domain name variants. The other objectives are also viewed as appropriate, although for some contributors
it is not clear how CIRA intends to achieve these:
“ I agree with the Objectives, but I don't believe that Registrants should need to register the accented variants of their names.
To protect their presence on the internet from look alike sites, and phising A registrant may have to register an unreasonable number of
sites. Allowing them to be registered to 3rd parties and then dealing with the abuse complaints the process of removing them could be
costly for CIRA. The owner of cibc.ca should get cìbc.ca and all the other variants be default. They should not need to register them,
they should just all resolve to the ascii (non IDN) equivalent. Personally, I want to bank with http://cìbc.ca NOT http://cibc.ca (opps, sorry
got that backwards, you can see the issue... :->)”
“To reduce the potential for phishing and user confusion. (ISN'T IT THE OPPOSITE ? –
they will now have more ways to trick the users)”
17
C. Feedback on Question 2: CIRA’s Objectives
“The objectives are fine, and as the Administrative contact for the Department of National Defence and Canadian Forces, I fully support
equal and fully bilingual access to all government websites. However, we specifically register DND.CA, FORCES.CA, and well over a
hundred variant parked (non-resolving) addresses that we don't want hijacked for non-DND/CF use (the only approved, resolving
addresses being .FORCES.GC.CA and .FORCES.CA) . I do not want my technical administrators having to now consider both
DEFENCE.CA and DÉFENSE.CA when also trying to stomp down DEFENSE.CA (which is phish) – obviously, while these costs are
trivial compared to my organization's yearly budget, they do come out of the taxpayer.”
“Si on reprend dans l'ordre les objectifs de l'ACEI: Pouvoir enregistrer un nom de domaine en
francais puisque c'est une des deux langues du Canada – OUI.
Stimuler l'expansion de l'espace de domain .CA - Si ca veut dire faire plus d'argent pour le CIRA, ca à l'air vrai dans la proposition, pour
le reste, je ne vois pas la stimulation.
Faire en sorte de refléter les meilleures pratiques internationales - Tout à fait d'accord.
Veuiller a ce que les pratiques et procédures soient harmonisées avec celles existantes - Si vous le dites, mais je ne vois pas comment.
Eviter de complexifier outre mesure les politiques et procédures - Je ne vois pas du tout de quoi ne rien faire complexifierait les
politiques. Au contraire ce qui est proposé est assez complexe.
Réduire les possibilités d'hameçonnage et éviter de semer la confusion chez les utilisateurs - Quand on voit l'ensemble des
commentaires sur tous les points de discussion du site, cet objectif ne peut être atteint que si toutes variantes accentuées ou
non d'un nom de domaine appartiennent à la même entité. »
18
C. Feedback on Question 2: CIRA’s Objectives
“I just wanted to add my voice to the many who have already stated the serious phishing, confusion, and
"huge number of variants on any domain name" problems.
In answer to the question, "Are CIRA's objectives appropriate?" I would say no -- "reduce phishing and user confusion" should be
moved to the very top of the list. Fortunately, French does not have nearly as many homographic letters as some other languages do,
but the accented lowercase 'i' is a serious problem. The accented variants look similar enough to the un-accented lowercase 'i' that
homograph attacks will certainly happen.
There is absolutely no question that, very shortly after IDN's are allowed, someone will register (for example) 'cîbc.ca', and then get an
HTTPS security certificate for it. This *will* happen -- recent events have shown that certification authorities absolutely cannot be trusted
to prevent this.
In light of this, I firmly believe that CIRA should, if it chooses to roll out IDN support, treat IDN variants of existing domain names in
exactly the same way as it currently handles matching provincial variants. For example, it is currently not possible to register cibc.bc.ca
if someone else owns cibc.ca . This is automatic; no humans are involved in preventing this kind of registration. This same, automatic
system is how accented characters should be handled -- if there is an existing domain that differs only in accents from a new domain
someone is trying to register, that registration should be rejected. If someone queries the WHOIS for the availability of cîbc.ca, the
response MUST be "unavailable".
People and organizations should absolutely NOT need to register countless domain names just to prevent squatting and phishing.”
“Considering one of your main objectives is to reduce potential for phishing and user confusion, your plan contradicts that completely. It
is pretty obvious that having preside.ca not being the same as préside.ca is going to confuse a normal user. If it wasn't clearly a cash
grab on your part, what you would do is this (assuming there is even a point to allowing special characters in the first place): make all
special characters equivalent to the base character. I.e, préside.ca, prèsïdë.ca, prësîdê.ca and preside.ca (as well as how many other
permutations) will all resolve to the same domain.”
19
C.
Feedback on Question 3: CIRA’s Existing Policies, Rules and
Procedures
The third question posed by CIRA was, given its mandate and existing Policies, Rules and Procedures, has CIRA left out
any issues that need consideration prior to developing a draft policy on the launch of IDNs. There were few comments or
submissions related directly to this question, beyond the view of a few contributors that CIRA did not ask if Canadian
Internet users want the introduction of IDNs:
« Vous avez omis la plus importante des question. Elle se pose comme suit:
Est-ce que les Canadiens désirent seulement IDN et à mon avis la réponse est "NON". IDN ne sert que les intérets de CIRA et de
ses registraires. Les seuls à payer le prix énorme que IDN imposera sont les propriétaire de noms de domaines actuels qui devront
investir des sommes faramineuses pour s'assurer posséder toutes les variantes accentuées des noms de domaines qu'ils possèdent
déjà.
“ The answer to your question is YES.
In fact you have left out the biggest issue: WE DO NOT WANT IT”
One contributor asked about Registrants who might want a variant of existing third and fourth level domains, and if
there is anything preventing the use of IDNs in host names. A DNS server operator responded to his question:
“This may turn out to be more of a technical than a policies question, but in light of the dropping of third and fourth level domains by
CIRA last year, where does that leave registrants who might want a variant of some of those existing names. On a related technical
question, if you are managing the DNS of a second-level domain such as gc.ca or a third-level domain like gov.nb.ca is there
anything currently preventing you from using IDN in host names? Like the examples here: http://idn.icann.org/ I believe the IDN
names in the org tld are already well supported, and so there may be no technical issue at least with punycode versions.”
“As a DNS server operator, I can answer the question about subdomains. IDNs work just fine as subdomains.
The query to your name server will simply be the punycode form of the subdomain. I have actually tested this with my own domain in
the past and it worked just fine. So you'll have something like <punycode>.example.ca where <punycode> is the encoding for the IDN
subdomain. It requires no support from the parent domains to do so.
This works because the way IDN name resolution works is that the actual query to the name servers is always the punycode version.
It is never the bare unicode version. (Anything that fails to translate it before sending the query does not support IDNs anyway.)
In essence, for a subdomain of your own domain, you are the registry so you control what goes there. CIRA is working out how to
deploy IDNs at the ".ca" level but that does not prevent using them as subdomains.”
20
C. Feedback on Question 4: Any Other Comments or Concerns
The final question posed by CIRA is if there are any other comments or concerns about any other elements of the
proposed launch of IDNs. For the most part, site contributors responded with comments/discussions in keeping with
those posted in response to other questions, and which are summarized in Part B: Overview of Main Concerns About
CIRA’s Proposed Approach. Feedback distinct to this question was as follows:
1. The character “œ” should be included in the list of Latin Supplement-1 Unicode characters CIRA is
contemplating.
This omission was noted by a French-speaking contributor, and a subsequent contributor agreed:
« Un commentaire. Il semble que le « e dans o » manque dans la liste des caractères. On pourrait discuter longuement de son
statut comme lettre plutôt que comme ligature, je pense tout simplement qu'il n'en coûte rien de l'ajouter et d'éviter de longues
discussions et de satisfaire les gens qui disent que ville-de-belœil.ca et îles-de-contrecœur.ca sont les graphies correctes (c'est
certainement vrai en typographie de qualité). »
« En effet, l'œ est nécessaire en bon français et devrait être compris dans la liste des caractères à ajouter.
Les IDN étant prévus pour fonctionner partout dans le monde, il n'y a pas lieu de se limiter à un sous-ensemble de Latin-1. »
2. Other top-level domain registries have introduced IDNs without major technical or user problems.
There was much debate among some contributors about the best technical approach for implementing IDNs, as well as
concerns about the potential for confusion when Internet users are trying to reach a site. In response, a few people
commented that other top-level registries have implemented IDNs with few issues:
« L'argument de la confusion est brandi depuis bien avant la création des IDN, a toujours été battu en brèche par les faits mais
revient quand même toujours à l'avant-scène, relancé par ceux qui n'ont nullement étudié la question mais réagissent au quart
de tour à une proposition progressiste.
Cf. par exemple l'étude de l'APWG mentionné sur ce site
(http://www.antiphishing.org/reports/APWG_GlobalPhishingSurvey_1H2010.pdf). "On notera aussi que les registres .com et
.net, ainsi que de nombreux registres nationaux, admettent les IDN depuis de nombreuses années (au moins 2005 pour .com
et .net) et que la catastrophe appréhendée n'a nullement eu lieu. Ceci est la réalité, pas de la spéculation. »
21
C. Feedback on Question 4: Any Other Comments or Concerns
3. Some contributors raised questions about whether and/or how email addresses with accents will work.
Further to the discussions about the technical implementation of IDNS, a few contributors raised the issue of email
addresses with accents:
“Having domain names with accented characters would then "force" people to also have email (SMTP) addresses with accented
characters. This would created the following issues (at least) :
1 - Many people will not know how to type the accented characters.
2 - Many email servers/systems might not support such email addresses.
Issue 2 might cause wide-spread issues.”
“Unless I've completely missed something, execution on this will create a major technical and market failure.
Email addresses and URLs based on issued domains are handled and stored in millions of systems worldwide. There is absolutely *no
chance* that any significant portion of these systems will be updated to accommodate the Canadian authority's desire to make this
change.”
“One question, which oddly enough I can not find a clear answer for in any of the documentation, is "What happens when I want to
send an email to, or search for www.preside.ca, but it has changed its domain name to www.préside.ca. Is www.preside.ca now a
'wrong spelling"? Will I still reach the company?". If the answer is "No, you can not" then I would suggest the whole exercise is
seriously flawed.”
4. It will be difficult to see accented characters on small screens, such as on mobile devices.
One contributor commented on the issue or concern of being able to see accented characters on mobile devices:
“ I’ve read a large number of the replies and an area that seems to be missed is mobile devices.
Small screens with limited resolution, limited characters and the desire to access sites quickly.
Can you see an accent character on your BB or Iphone? Do you actually want to switch to the alternate character screen?
Is there a chance that it could cause car accidents for drivers emailing? Would CIRA be liable for damages?”
22
C. Feedback on Question 4: Any Other Comments or Concerns
5. One contributor asked if SSL certificates will work and if site administrators will need more than one.
As with other questions, this is a topic on which CIRA will need to help educate Internet users and site administrators:
“What about SSL certificates? Will they work and will you need more then one?”
6. One contributor commented that CIRA’s proposed approach is inadequate with respect to protecting
intellectual property rights holders.
He expressed the view that, just as corporations must not register names that are confusing to consumers, CIRA must not
allow domain names that are confusing:
“CIRA, operating under the auspices of Industry Canada, is not adequately addressing the problems they are creating for
corporations which have invested significant time, effort, and money into their name. Corporations must not register a name
which may be confusing to consumers; CIRA must not register a domain which may be confusing to consumers.
I'm not proposing that each registrant provide a NUANS report before registering their domain, but intellectual property
rightsholders MUST be given more respect than the current CIRA proposal gives.
I'm all for offering a corporation the *ability* to register an accented name. I'm very much opposed to offering anyone the
opportunity to do so where it causes confusion with intellectual property rightsholders (the same, of course, working equally for
accented- and non-accented domain names): I would oppose a third party registering a non-accented name where the rights to
the accented name are held by another party.”
23
C. Feedback on Question 4: Any Other Comments or Concerns
7. There were questions about how upper-case letters will be treated.
Some contributors noted that, traditionally, upper-case letters are not accented, and they wondered how upper-case
letters will be handled under CIRA’s proposed approach:
“Are accented characters case-insensitive, as unaccented characters are in DNS?”
“No, actually, and there is a legitimate possible issue here that nobody has touched on.
First, DNS is not actually case insensitive. It is case insensitive for matching, but it preserves case. This is different than simple
case insensitivity, and is part of why there's a problem. (If it were truly case insensitive, we could just say "everybody uses lower
case from now on", and it would not make any difference.)
IDNA2003, which was the first version of IDNA, mapped upper case to lower case (that is, it did a Unicode case fold operation).
Any time you entered an upper case, you actually registered or looked up the lower case version.
IDNA2008, which might be what CIRA is actually planning to deploy (we don't know from the policy document they published,
unfortunately, but I hope that's what they plan) actually just doesn't allow upper case characters. In the language of IDNA2008
(if you're not familiar with this, see RFC 5890, http://tools.ietf.org/html/rfc5890, which has all the terminology defined), upper
case characters are DISALLOWED, so they're not legal in a U-label, and therefore they can't be registered or looked up.
However, two different mapping proposals, one from the IETF and one from Unicode, both recommend that applications map
candidate labels to lower case before attempting to invoke the U-label/A-label transformation, so in practice upper case is
mapped to lower case anyway…”
24
D. Alternative Proposed Approaches
As noted in Section A, while most site contributors expressed concerns about CIRA’s proposed approach to introducing
IDNs, fewer are opposed in principle to IDNs. A number of contributors offered alternative approaches that they feel would
better protect the interests of existing .CA Registrants than CIRA’s proposed Sunrise and Landrush periods. Most
contributors prefer an approach that includes a longer or unlimited Sunrise period, and that will not oblige them to purchase
variants of their existing domain names for the sole purpose of protecting the names from potential cybersquatters,
phishers and other fraud. Most do not appear to object to paying an additional cost if they want to use (and not just protect)
an IDN. The following are examples of alternative proposed approaches submitted by contributors:
I propose that:
-- non-accented domain holders have exclusive rights to all accented variants until they sign away those rights
-- non-accented domain holders must pay to use accented versions of their domains,
or else they remain dormant, i.e. "Not found“
This way CIRA can make some more money, but no one is forced to buy domains they don't want, and they are still protected from
cybersquatters and phishers.
“Allowing préside.ca to be owned by someone other than the owner of preside.ca does not make sense. Canada is a biligual country
and french characters have their place. We can add them without confusing, squatting, phishing, and frustration.
You own predise.ca? Then you may register préside.ca
You own grâce.ca? Then you may register grace.ca.
This should be the rule from beginning to end.”
25
D. Alternative Proposed Approaches
“I believe there is a simple way that CIRA can meet all of the objectives outlined in the policy…
I personally believe the only way to effectively satisfy all of these criteria is to automatically assign responsibility of the IDN "similar" names
to any current domain registrant. For example, if I own (as in an example above), "cibc.ca", I should automatically be given authority over
"cîbc.ca" and "cïbc.ca"; to do anything else would violate condition #6 (likely the most important of the criteria). This doesn't mean that I
_own_ those two domains; if I wanted to do that, I would have to register them and administer them appropriately. It only means that I have
authority over them. If someone else wants to register one of those domains, I would be contacted and could release it if I wanted to.
Alternatively, if whomever wanted to register either "cîbc.ca" or "cïbc.ca" thought I was being unreasonable, they could file a protest and
have the matter decided by CIRA directly based on perceived similarity, not necessarily just on copyright. Copyright is something that
many current domain holders do not need to protect their brand/site/image/etc. They own their domain and control it. To allow a
typographically similar (and effectively equivalent) domain to be registered dilutes that protection. Similarly, following IDNs implementation,
if I want to register "été.ca" as a place to list summer events, I should have authority over "ete.ca" (and should probably register it). As a
franco-anglophone living in Montreal who uses an English keyboard, the latter is what I'm going to type all the time!
The current suggestion of having these "non-accented-but-otherwise-equivalent" domain names open can be nothing more than a money
grab, forcing anyone with a domain name with non-accented characters to register all accented variants (regardless of whether they are
legitimate French or English words) to protect their rights. This isn't helping consumers or business. I wouldn't want to be the owner of
"aeiouc.ca" faced with the possibility of having to register all 720 possible variations. It might be fine for "google.ca" to purchase the extra
20 domains it would need to protect itself, but they shouldn't be forced to either.
We can do better. So, yes, allow IDNs to be registered, but DO NOT implement the current launch strategy; it hurts everyone but the
registrars.”
“ There is a simple way to support Francophone domains while preventing homograph phishing attacks and allowing registrants to prevent
problems with SMTP, older systems, and user error: 1) Do not allow accented domains to be issued that conflict with existing unaccented
domains.
2) Anyone who registers a new domain with accented characters automatically gets the unaccented equivalent too, so they can configure
their servers to accept both if they wish.
3) Any existing holder of an unaccented domain is entitled to 1 (one) accented variant for free / nominal fee.
Without a rule preventing homographs falling into the wrong hands, Canadian ecommerce businesses will be exposed to a new set of
phishing attacks. So far I don't think any phishing victims have sued a registry, but that's one thing we don't as a "Canadian first" if we can
help it. Better to be a leader in protecting against such attacks.
I can't think of another way to do this that would be fair all round. I'd be willing to pay more for my .ca domains to cover the cost of these
protections and to be safe in the knowledge that CIRA is taking steps to protect us from fraud.”
26
D. Alternative Proposed Approaches
“The proposed policy to allow international characters in domain names creates a situation ripe for confusion. Existing
domain name holders may be required to acquire additional names just to protect their domain from those who may seek to benefit from the
popularity of the existing domain. Although the Sunrise policy enables existing domain name holders an opportunity to protect their domain
name in advance of a perceived threat to their name, they may be forced to purchase an additional domain needlessly.
A more effective and proactive way to offer the protection is that if someone seeks to purchase a domain name that is
identical to an existing domain name except for one of the Latin Supplement-1 Unicode characters, the existing domain name holder is
notified by email of the request, and has a two week period in which to secure the modified name. For example, the existing Registrant of
preside.ca would be notified if anyone sought to register préside.ca, prèsïdë.ca, prësîdê.ca, etc, and would have a Sunrise period of two
weeks that commenced on the date the email notifying them of the request was made. People who sought to register the new name, would
be notified that their requested name is similar to an existing name, and they will have to wait for the Sunrise period to expire. If the current
domain name owner does not register the new name within one month, the request for the new domain will be granted.
With the knowledge that existing domain holders will be notified of any attempt to capitalize on their domain name by an
unscrupulous operator, the activity of unscrupulous operators will be greatly reduced.”
« Je suis plutôt d'accord avec l'introduction des IDN. Par contre, comme d'autres ont mentionné, je crois que l'achat d'un nom de domaine
avec caractère accentué devrait être limité au propriétaire de la version non accentuée (ou vice versa, selon celui qui a été acheté en
premier).
Un peu de la même façon qu'on ne peut pas enregistrer domaine.qc.ca et domaine.ca était déjà enregistré.
Donc, si un membre possède livre.ca, il devrait pouvoir acheter sans difficulté livré.ca. Par contre, si un autre membre tente d'acheter
livré.ca, il ne devrait pas pouvoir le faire sans le consentement du propriétaire de livre.ca.
Autrement, ça crée une obligation d'acheter la version accentuée d'un domaine, de peur qu'une autre personne ne l'enregistre et y place un
autre site. Je pense que c'est une des raisons principales qui fait que plusieurs personnes ne semblent pas aimer l'idée des IDN. »
27