Domain Administrative Data in Lightweight Directory Access Protocol (LDAP)
draft-newton-ldap-whois-04

  The two sections on access control (section 3.1.3 and section 4.1.3) are very weak.  For example, section 3.1.3, says "The registry TLD DIT only has one access control type."  However, it never really says what access controls are provided.  From the next sentence I can guess that username/password is used for identification and authentication, but that does not tell what how access is limited.  It appears that this document publishes the static username and password to gain access to some portions of the DIT.
 
  I recognize that this document describes an experiment.  However, section 9 should discuss how things would be done differently to issue usernames and passwords.  I assume that the static ones discussed in this document would not be used beyond the experiment.