At 2/26/02 9:08 AM, George Kirikos wrote:

>I was wondering if this was still a planned feature, to prevent
>tranfers (like eNom has). When one wants to enable a transfer, one can
>toggle the protection off, to let it go through [by default, it should
>be off, in order to require a positive action to enable it], with the
>proper verification at the gaining/losing registrars.


I have a little feedback on this (which are perhaps too late to make it 
into the implementation already planned by OpenSRS, but still...)

I'd like to offer transfer locking to my customers, but I don't want to 
interfere with legitimate transfers. Specifically, what I would hope to 
avoid (which I can predict to be a common problem) is:

1. Customer turns on locking but forgets about it
2. Customer tries to transfer somewhere else
3. Transfer is rejected
4. To restart the transfer after turning off locking, the transfer request
   must be resubmitted from scratch at the other registrar

As someone who has resubmitted far too many transfer requests from 
scratch (until OpenSRS fixed the "declined transfers" screen to allow 
resubmissions -- thanks!), it seems to me that it would be desirable for 
the lock to have a five-day grace period, just like the current transfer 
system.

That is, if a customer tries to transfer a domain that is locked, he gets 
a message telling him so,  but the transfer is not immediately rejected: 
he would have five days to turn off the lock in the manage pages, using 
the password. If he did so, the transfer would be approved, as normal; if 
he didn't, it would be denied.

This gives the customer a chance to fix his mistake without a lot of 
extra hassle, while still being secure even against admin e-mail address 
hijacking.

If the lock system is going to actually be at the registry level, perhaps 
this can't be done. But it seems that perhaps it's better implemented not 
so much as a registry lock system, but rather as a flag that changes the 
default-ack to default-nack for transfers for certain domains.

Anyway, just a thought. OpenSRS's efforts to implement this, whatever the 
details, are appreciated.

--
Robert L Mathews, Tiger Technologies

"The trouble with doing something right the first time is that nobody
appreciates how difficult it was."

Reply via email to