In message <20151103134248.GE47126@cilantro.c4inet.net>, "Sascha Luck [ml]" <aawg@c4inet.net> wrote:
On Tue, Nov 03, 2015 at 02:28:03PM +0100, David Hofstee wrote:
In that line of thought: I would like email validation on a regular basis. There are so many email addresses that do not work properly (what then is the sense of registering invalid data?).
There are LIRS that register many thousands of objects. Even small LIRs can have many hundreds. Is the idea that they employ someone full-time to solve captchas for the NCC (another idea from this discussion)?
Frankly, I'd rather have the spam, at least I can filter that.
This seems to be a compltely valid question/point/argument. I'm frankly not sure how the idea of using CAPTCHAs even got mixed up in all this. I have trouble understanding how CAPTCHAs would be either necessary or useful in this context. (Maybe someone can enlighten me.) I am laboring under a huge disadvantage because, to be honest, I don't even understand the _current_ process... and that's probably the basis for my befuddlement about CAPTCHAs. Hos is an ORG-*-RIPE record currently created? Who creates it? In my own idealized version of future reality, which I freely admit may bear no resemblence to either current practice or even future possibility, the party that needs to have a specific ORG-*-RIPE record would start by creating an account someplace... maybe, you know, like at www.ripe.net or something. The party who needs the record would be the party who the record will represent. So if "Vladimir's Tool and Die Company" had reason to need an ORG- record, Vladimir himself, *not* his LiR, would start by creating an account someplace. Once he had that, then, while he's logged into that account, Vladimir would poke some button which would begin the process of creating the ORG record. He would then be asked to fill in a form with his contact details... name, company name, address, phone, e-mail. He would do this and then poke the submit button. Not long after that Vlad would get an automated phone call telling him that his magic cookie is 734926. Now... and this is the important part... WHILE HE IS STILL LOGGED IN, Vlad would poke some button that says "Validate", whereupon he would be presented with a really simple web form containing only a single small text entry box. Valdimir would put his magic cookie into the box and then poke the submit button. That would complete the validation. In this scenario, there is absolutely no need for any CAPTCHAs. Hypothetical attackers who might try to brute-force the magic cookie wouldn't ever even get the chance to even try, because they would have to be logged on to Vlad's account... using Vlad's login credentials... before they would even get to the screen containing the form where one enters the magic cookie. So, um, what am I missing? Regards, rfg