From: Andrew Pitts <[log in to unmask]>
Date: Fri, 1 Jul 2016 14:16:48 +0000
Dear Craig,
Actually, the greatest convenience is to libraries. To add or delete
an IP address takes weeks and a great deal of library resource. If you
are trying to advise up to 1000 different electronic resources that
you need to add a new IP address, that is a huge task. We have
received many messages from librarians wishing us success because they
have just added an IP address and to quote one large US University,
"Having gone through the labor intensive process of updating our IP
addresses, I hope this is a success" We also saw many posts recently
on the difficulty libraries had when EZ Proxy changed IP addresses.
Also, libraries have never really audited their IP addresses and what
is actually help by publishers. Since 1996, IP addresses have been
added and deleted but no real system has existed to ensure they are
correct. The impact this has on the reliability of COUNTER usage stats
is significant; why worry about "double clicking" etc, when those
clicks may be coming from an IP address range on your account that
does not belong to you? The impact on pricing here for libraries is
also far reaching. Some publishers price by usage tiers; imagine if
you had the usage from another library being counted towards your
usage and that had tipped you into the next pricing tier and you have
been overpaying for the last five years. The impact of incorrect IP
addresses, used by 90% of the world's libraries, is far reaching for
both Publishers and Libraries and that is why we are getting so much
support from both sides.
Andrew Pitts
-----Original Message-----
From: Craig Griffin <[log in to unmask]>
Date: Thu, 30 Jun 2016 02:02:17 +0000
Andrew and Joe,
The IP Registry is mostly a convenience to publishers from my
interpretation - global updates to an IP range for subscribers. Sure
that can be done at the publisher level, but a convenience as a global
data update. I didn't see anything in the press release about business
rules around the IP ranges, but assuming there is significant
validation thereof.
To Joe's point, IP auth is perfectly fine to satisfy the first of two
factor authentication ('what you posses') which in turn sets you up
for the second ('what you know,') I don't see how they are mutually
exclusive. I do see that two factor authentication will be difficult
to achieve across the industry, given the velocity of change.
-Craig
On Wed, Jun 29, 2016 at 9:23 PM LIBLICENSE <[log in to unmask]> wrote:
>
> From: Joseph Esposito <[log in to unmask]>
> Date: Tue, 28 Jun 2016 20:28:24 -0400
>
> Andrew,
>
> Don't you think that we will be moving to two-step verification soon
> and will not be using IP authentication any more?
>
> Joe Esposito
>
>
> On Tue, Jun 28, 2016 at 6:22 PM, LIBLICENSE <[log in to unmask]> wrote:
> >
> > From: Andrew Pitts <[log in to unmask]>
> > Date: Tue, 28 Jun 2016 13:13:05 +0000
> >
> > We hope members of this list will be interested in this news, given
> > the concerns about the use of IP addresses as an authentication
> > method for scholarly content.
> >
> > PSI, the organisation which helps publishers eliminate subscription
> > fraud and IP misuse, has announced the launch of a global registry
> > of IP addresses which we hope will benefit the whole community. The
> > IP Registry will make it easier for libraries to communicate any
> > changes in their authentication details to all publishers who sign
> > up to use the service, saving them significant time and reducing
> > errors. The registry already contains 1.5 billion validated IP
> > addresses for over
> > 60,000 content licensing organisations worldwide.
> >
> > The full Press Release can be seen below
> >
> > ************************************************
[SNIP]
|
