11 ms·

Whois is great for social engineering attackers. You get a name, email, address, and the first service to attack. Meanwhile, the ICANN is working around the cl

• fps 11y ago
  I think the bigger problem is that public information like your name and address is sufficient for proving your identity. If we make whois information private, what about phone books, property records, direct mail databases, etc. etc.
  • VeilEm 11y ago
    If someone has your public name and address you're already at significant risk if you ever say anything controversial that gets attention. You're liable to being swatted, getting fake pizza orders, having people show up at your house, harassing you and much more. See Zoe Quinn, Brian Krebs, lots of less well known individuals, etc.
    • thephyber 11y ago
      Which only proves your comment's parent's point even more. {SWAT, pizza orders, etc} assume that the phone number that shows up on caller ID is authentication of the identity of the phone line on the other end. They could call back the number on caller ID to verify the original caller matched the person who picked up, but they don't. Having knowledge of a Social Security number was assumed to be authentication, but it's increasingly obvious that such an authentication scheme is antiquated and was destined to fail from the beginning. When an identity thief can get a mortgage under my name with little more than credit bureau data on me, it costs only a little more than $15 to destroy my credit, my time, and my future because transactions don't have sufficient authentication. These awfully designed authentication schemes will only magnify the problems as more companies (especially credit bureaus and data marketers) pass around data on me and make it easier for someone to buy it on demand.
      • bigiain 11y ago
        Keep in mind too that Caller ID is trivially blockable (and blocked caller id isn't remarkable enough to be super suspicious), and it's also easily within the capability of many of the 4chan/gg griefers to spoof "correct" Caller ID numbers as well.
        • hollerith 11y ago
          By "gg" you mean what? Gamer gate?
          • Karunamon 11y ago
            I assume so. The "gamergate are women-hating harassers" misconception is still alive and well.
        • deleted 11y ago
          [deleted]
        • deleted 11y ago
          [deleted]
        • XorNot 11y ago
          Caller ID shouldn't be blockable, these days. It's a big ridiculous problem that we've defaulted to "you can intrude with communications anonymously" - and phone calls are definitely intrusive. I'm pretty much a hair away from blocking all calls without caller ID at my house so I can reliably lock out the remaining spam callers.
      • rplnt 11y ago
        Not that I order pizza more than once a few months, but I would probably switch the pizza place that would call back to confirm order each time.
      • the_ancient 11y ago
        >Having knowledge of a Social Security number was assumed to be authentication No the people that designed and implemented Social Security knew it was not secure for identification purposes, the first few decades of the program even had "Not to be used for Identification" on the card. Then the government, and financial industry got lazy and said "well since the majority of people already have these numbers assigned to them lets just use them for Identification as well" and made it a defacto National ID. Something it was never designed for, nor secure enough to be,
    • TeMPOraL 11y ago
      As a counterpoint, see billions of people every day. This is getting to the point of paranoia at this point. You're already at significant risk if you ever say anything that gets attention by virtue of living in a society. But it comes with benefits, too...
  • ams6110 11y ago
    Agree. Your contact info in whois adds little to any number of other public records that will contain your name, address, phone number. It does make good sense to not use your primary "personal" email address in whois, nor your home address. PO Box rentals are fairly cheap and that's what I use for whois registrations.
    • detaro 11y ago
      Sadly, you can't even use PO boxes for all domains, some registries require a "full" address.
      • bigiain 11y ago
        "The street finds its own uses for things." Where I am (Australia) theres a whole bunch of places that'll provide "non Post Office PO boxes" who're perfectly happy for you to address things to "Suite 306" or "Apartment 306" as well as "PO Box 306" at whatever address the box is located. Fools _most_ of the "must be a real address, not a PO Box" restrictions. (Interestingly StartSSL failed me on that once when I gave one of those as a personal address - they mailed me saying "that looks like a business address, we need a personal home address for personal identity validation") - I dunno of they Google Street-viewed it or of they've got some automated system that flagged it...)
        • MaikuMori 11y ago
          Most likely more than x accounts used the same address.
        • DrScump 11y ago
          USA is a little different. To get mail using the street address of the PO, boxholders have to sign an additional agreement, BUT: 1) it's free, and 2) they will also accept UPS/FedEx/DHL/etc shipments on your behalf for no charge! (they will sign for packages, but if "Direct" signature (the named recipient) is required, they can't accept those.) If you just try using "UNIT #" or "APT #" or whatever, or you don't have this additional agreement signed, they can and will return to sender.
  • akerro 11y ago
    https://news.ycombinator.com/item?id=7525198 https://news.ycombinator.com/item?id=7525198 His daughter was also attacked...
  • Your_Creator 11y ago
    It's not just about proving who is who, it can also be about wanting to distance yourself from random people and their nonsense problems.
• mholt 11y ago
  Yes, it's awful. Fortunately, at least one registrar (Google Domains) has free whois privacy for all registrations and I think they prompt you about it by default, too (to agree to some legal terms).
  • tjl 11y ago
    Hover also has free whois privacy by default.
• TheOtherHobbes 11y ago
  A related word of warning: Namecheap updated their registration page last year. Now, when you register a domain it tells you free Whoisguard is included, but it doesn't make it clear that it's disabled by default." Previously it just worked. Now you have to check another box to turn it on. This change makes no sense to me. (If you want free Whoisguard, why would you not want it turned on?) I was white-hot furious* when I discovered that a handful of new domain regs had leaked my contact details, and I began getting the inevitable spam calls and texts.
  • scoot 11y ago
    Worse, they'll happily sell you Whoisguard for domains that don't support it. When you discover it's not usable, they'll give you a refund, then include it again in the next billing cycle. I switched to Namecheap based on recommendations here, and their previous stance on certain privacy issues, but I'm running out of alternatives.
    • newman314 11y ago
      Plus Whoisguard is only free for the first year. There's Google Domains for $12/yr but the dollar and some savings isn't worth the hassle of switching away from Namecheap.
      • deleted 11y ago
        [deleted]
    • veidr 11y ago
      I've always wondered why I never see pairNIC mentioned on the "everybody knows godaddy is garbage but who should I use to register domains?" threads on HN. I have used them since they opened (2002) and never used anybody else after that, because I have never been dissatisfied. (I don't remember if the box is checked by default, but they definitely offer whois privacy, along with services like custom/dynamic DNS and some other stuff, at no extra charge). Their site is kinda barebones and old-school, but there are real humans in the rare case you actually need one, and they've never done me wrong. So for whatever that's worth: another recommendation on HN. [1]: https://www.pairnic.com/about.html https://www.pairnic.com/about.html
• devit 11y ago
  They don't hide the name because you cannot hide the name while legally owning the domain yourself. Services that hide the name actually result in a company (e.g. "Domains by Proxy LLC") purchasing and holding domain ownership for you, which is a very different legal arrangement with different risks.
  • derefr 11y ago
    Treat a domain like money: if you want it held pseudonymously, you put it in the ownership of a shell corporation you control (through power of attorney to the board of directors), but don't own any equity in.
    • BinaryIdiot 11y ago
      While I would love to do that it just isn't feasible for me and probably most others. ICANN really needs to provide better controls to avoid resorting to such workarounds.
      • wereHamster 11y ago
        > ICANN really needs to provide better controls to avoid resorting to such workarounds. Not only ICANN but the whole financial world. Shell corporations provide no real use other than hiding money and ownership.
        • an_account 11y ago
          That's not true at all. Corporations have tons of legitimate uses, including reducing liability.
          • gruez 11y ago
            >Shell corporations provide no real use
        • Your_Creator 11y ago
• DINKDINK 11y ago
  > By the time you find this out, it might occur to you to just type in a different name, but now you're violating ICANN policy. Why not just "sell"/transfer ownership of your domain to another entity (one that you own)?
  • gist 11y ago
    What you need is the following (and no more): a) A valid email address. (A gmail that forwards to your real email will do). b) A valid postal address. By valid I mean "in the proper form". As such the following would get flagged: 1 Main St. Anytown USA 10016 (because it doesn't exist..) 545 Jones St. New York NY 10016 (let's say that's a post office..) is fine.
• notyourwork 11y ago
  > For example, gandi.net (and thus Amazon) Why do you say here and thus Amazon?
  • asymptotic 11y ago
    You can register for domains through AWS Route 53 and it'll automagically register on Gandi with WHOIS protection and link it up inside Route 53. You then don't need to leave the AWS UI, it just seems like it works magically. (I think this is true...I can't remember now actually).
  • josso 11y ago
    I assume it's because AWS uses Gandi as their registrar.[1] [1]: https://news.ycombinator.com/item?id=8116506 https://news.ycombinator.com/item?id=8116506
    • pyvpx 11y ago
      while Amazon itself uses Mark Monitor from CSC.
• twhb 11y ago
  If WHOIS is destroyed, your contact information will still be known by everybody you're in contact with, many you've only met, possibly many you haven't met but want to meet, and millions of employees of companies you've interacted with. There is no meaningful difference between that and public information. It is Amazon's absurd assumption that your contact information is private that is at fault here. Trying to ameliorate this by contacting fewer people is self-destructive, and cannot achieve complete security unless you're willing to eliminate contact with everybody but those you trust with your accounts. Without a doubt it is Amazon's policy that needs to change.
  • panic 11y ago
    There is definitely a meaningful difference between contact info being public and informal disclosure through normal contact. There's a reason doxxing is a thing.
• mangeletti 11y ago
  When we start using block chain to replace DNS and usernames to replace domains, and services to replace hosted servers, a lot of things will change. One is that there will be nobody to force us to verify who we are. These kinds of things serve no purpose other than to hand leverage up the chain.
  • jacquesm 11y ago
    Did I miss an RFC?
• mbrutsch 11y ago
  > For example, gandi.net (and thus Amazon) doesn't hide your name when you have it turned on. Well, yeah, I've been with Gandi for years, that's their published policy: https://www.gandi.net/domain/whois/ https://www.gandi.net/domain/whois/ > By the time you find this out You realize you should have done your homework and read your registrar's policies beforehand? I understand your overall point, but don't make it sound like Gandi did anything wrong here, just because you don't like it.
  • simoncion 11y ago
    I would have left this very comment if you hadn't beaten me to it. :) Gandi is very up-front about every aspect of their services. I found out that Gandi's whois privacy doesn't hide the name you provide as the registrant long before I entered my credit card details to provide payment information. Their whois privacy is structured in this way because for many (all?) TLDs ICANN requires that the entity listed as the registrant be the actual owner of the registered domain.
    • mbrutsch 11y ago
      I love Gandi because they live by their motto: No Bullshit.
• daveheq 11y ago
  Fighting online thieves by putting more innocent people at risk doesn't sound like a way to fight online thieves.
• revanx_ 11y ago
  For me the solution has been to stick with my national ccTLD registry. If your country has strong private protection laws then your national registry will shield your information for your ccTLD domains from public whois. It's not exactly bulletproof, they still make that information available from their whois database but it's just another step someone has to make to get to your information. That much said, on a ccTLD you should be able to get away with only just a name, surname and a valid email address. What are the alternatives? Those fishy private protection companies? Technically once you sign up there, they own your domain, simple as that. OpenNIC? I wish that was the case.
• adrianN 11y ago
  In Germany you have to publish a full address on your website, so even if you don't own the domain, anybody can get you IRL. http://www.gesetze-im-internet.de/tmg/__5.html http://www.gesetze-im-internet.de/tmg/__5.html
  • skrause 11y ago
    Only if you have a commercial site.
    • adrianN 11y ago
      According to the Wikipedia the word "geschäftsmäßig" includes private use website if it is even theoretically possible to get income from them, for example via ads. It quotes the ministry: „Die Anbieterkennzeichnungspflicht muss praktisch von jedem, der ein Online-Angebot bereithält, erfüllt werden. Etwas anderes gilt nur bei Angeboten, die ausschließlich privaten oder familiären Zwecken dienen und die keine Auswirkung auf den Markt haben. Im Zweifel sollten Sie davon ausgehen, dass die Anbieterkennzeichnungspflicht besteht.“ Which roughly translates to: everyone has to do it, unless its a purely private service. So I guess you don't need it for you web-enabled password protected security cam, but you definitely need it for your blog. https://de.wikipedia.org/wiki/Impressumspflicht https://de.wikipedia.org/wiki/Impressumspflicht
    • phphphph 11y ago
      At one point in the past it was argued that hosting your site with a provider that injects ads was sufficient to consider the page "commercial". I don't know what came of it, or what is now required for a page to be commercial.
  • ignoramous 11y ago
    Ditto for TLDs controlled by the Indian Government.
• retube 11y ago
  How does one go about having their details removed from whois?
• lucaspiller 11y ago
  In the UK this and a lot more is public information. As an example of what is available about me online (without paying a penny) just by searching for my name: - The year I was born - The district I was born (not the exact town, although that wouldn't be hard to guess) - My mother's maiden name (which is what most banks et al ask as a security question...) - The areas I've lived (based upon the electoral register, which you can opt out of but supposedly this impacts your credit rating) - That I am a director of a company This is just what is available for free - you can get the full records this is extracted from by paying a small fee. If you know the name of my company (which isn't hard to find out), you can also find for free: - My full name - My address - My date of birth - Roughly how much I make a year TL;DR; If you rely on this to 'identify' someone, you are doing it wrong.
  • wrboyce 11y ago
    Your remark about opting out of the electoral register is not quite correct. It is a requirement to register if requested, the fine for failing to do so is £80. However, it is always an option to not appear on the open register. The open register is publicly accessible, and being absent from it will not be detrimental to your credit rating.
    • garblegarble 11y ago
      >being absent from it will not be detrimental to your credit rating. But it will make identity checks with banks a little more complicated, normally they use the electoral register to confirm your address
      • gmac 11y ago
        I have always opted out of the open or edited register, and have never had a problem with this. Seems like your details can still be used for credit checks and fraud prevention (which I imagine covers confirming identities and addresses) even when you opt out[1]. [1] http://www.electoralcommission.org.uk/faq/voting-and-registration/what-is-the-electoral-register http://www.electoralcommission.org.uk/faq/voting-and-registr...
• akerro 11y ago
  I use https://ititch.com/ https://ititch.com/ for over a year now. You can pay with bitcoin, they don't make much validation around whois input values. I use it for my domain registration and whois protection, they support IPv4 and IPv6 which in my country are not supported by biggest companies like 1and1. Customer support answers in less than 30hours.
• annoying_tech 11y ago
  OVH did this to me, I registered a .pw domain and I though it was WHOIS secure, but after registering... I found my full name, address and email were all public, forever. (Domaintools keeps a record of it) I will never again register a domain with my real info. Sorry ICANN, I don't give a about you or your policy.
• Svip 11y ago
  In Denmark (.dk), any citizen can get their address information removed from publicly available records. That means that any private individual or company cannot get access to your address information unless you manually give it to them. (Note: Government agencies still have access to this information.) .dk-domains are owned by persons, not the registrars, and therefore the whois-information for .dk-domains follow the same procedure as addresses. So if you have 'address protection' as it is called, your personal information is immediately removed from your whois information.
• jitbit 11y ago
  It's not just whois. Our personal info is out there everywhere. Say, you're a developer who signs his OSS software tool with a certificate that comes with your home address...