4 ms·

I once lost my gandi.net password. It took sending copies of 2 photo id, and answering the phone listed in the who is database before they reset it. I just wis

I once lost my gandi.net password. It took sending copies of 2 photo id, and answering the phone listed in the who is database before they reset it. I just wish that their DNS updates were push through faster.

ryanlol 11y ago
That's not good verification. It takes a couple of minutes to produce convincing fake ID scans, and they aren't going to have anything to verify them against. And presumably they wanted you to send those photos to them as an unencrypted email attachment, right?
- celticninja 11y ago
  its better verification than most will require.
  - ryanl0l 11y ago
    Most will require a password reset email, I'd say that's significantly better than asking for ID scans. Edit: Since I'm getting some downvotes I'd really like to know how one could possibly argue that asking for ID scans is better than email resets. You can't really forge the ability to receive email at an address, but you can very easily replace the name on an ID scan.
    - celticninja 11y ago
      Did you read the article? I ask because one of the problems was a compromised email account.
      - ryanlol 11y ago
        I did. It doesn't change anything, email is still a way better verification method than ID scans that the company will be unable to authenticate.
        celticninja 11y ago
        unless your email account has been compromised.
        ryanlol 11y ago
        Even if the email account is compromised it's still stronger proof of identity than ID scans. An attacker can't just pretend to be able to read your email, such ability is too easy to conclusively prove. To be able to read your email they need to hack you somehow. But for a fake ID the attacker only needs to throw your name in a PSD and they're good to go.
- jontas 11y ago
  As someone mentioned above, they publish a gpg key for sending this data. As for fake IDs, yes, it is certainly possible to create them. But when it is so much easier to socially engineer your way into another service like Namecheap, it creates a disincentive for going after Gandi (and other similar hosts). No security measures can be foolproof, possibly short of sending someone to your home to take a DNS sample, but at least they're trying for a better solution.
- Spoom 11y ago
  Other comments in this thread have indicated that Gandi will take GPG-encrypted emails have have published their public key for this purpose: https://wiki.gandi.net/en/gandi/documents https://wiki.gandi.net/en/gandi/documents
- Xylakant 11y ago
  Faking ID scans adds a whole layer of law enforcement on top. I'm uncertain about the situation in the US, but in germany the fake itself is punishable by law (up 10 ten years). It also creates more traces to look at and creates work. You'd also need much more information to create a convincing fake id scan of your intended victim. It's all about increasing the amount of work for the would be attacker.
  - ryanlol 11y ago
    >Faking ID scans adds a whole layer of law enforcement on top. That's why nobody has ever used a fake ID at a bar! > but in germany the fake itself is punishable by law (up 10 ten years). https://dejure.org/gesetze/StGB/267.html https://dejure.org/gesetze/StGB/267.html 5 years. But producing fake scans isn't covered by this law, scans aren't even an official document. In fact, it is illegal for a german company to ask you to send them scans of official documents. > You'd also need much more information to create a convincing fake id scan of your intended victim To fake a good enough passport scan you'd need your victims name. That's all the rep is going to have.
- dorfsmay 11y ago
  That was a few years back when another well-known registrar only required the last 4 digit of the customer's credit card, and would even help them guess if they didn't remember. I sent the ids by fax (yeah a few years back, I still had a fax machine). I thought asking for id's + phoning on the number listed in the whois database was a good cross check, especially back then.
evanosaurus 11y ago
Seriously. Gandi is the only registrar I use anymore.

ryanlol 11y ago

That's not good verification. It takes a couple of minutes to produce convincing fake ID scans, and they aren't going to have anything to verify them against. And presumably they wanted you to send those photos to them as an unencrypted email attachment, right?

celticninja 11y ago
its better verification than most will require.
- ryanl0l 11y ago
  Most will require a password reset email, I'd say that's significantly better than asking for ID scans. Edit: Since I'm getting some downvotes I'd really like to know how one could possibly argue that asking for ID scans is better than email resets. You can't really forge the ability to receive email at an address, but you can very easily replace the name on an ID scan.
  - celticninja 11y ago
    Did you read the article? I ask because one of the problems was a compromised email account.
    - ryanlol 11y ago
      I did. It doesn't change anything, email is still a way better verification method than ID scans that the company will be unable to authenticate.
      - celticninja 11y ago
        unless your email account has been compromised.
        ryanlol 11y ago
        Even if the email account is compromised it's still stronger proof of identity than ID scans. An attacker can't just pretend to be able to read your email, such ability is too easy to conclusively prove. To be able to read your email they need to hack you somehow. But for a fake ID the attacker only needs to throw your name in a PSD and they're good to go.
jontas 11y ago
As someone mentioned above, they publish a gpg key for sending this data. As for fake IDs, yes, it is certainly possible to create them. But when it is so much easier to socially engineer your way into another service like Namecheap, it creates a disincentive for going after Gandi (and other similar hosts). No security measures can be foolproof, possibly short of sending someone to your home to take a DNS sample, but at least they're trying for a better solution.
Spoom 11y ago
Other comments in this thread have indicated that Gandi will take GPG-encrypted emails have have published their public key for this purpose: https://wiki.gandi.net/en/gandi/documents https://wiki.gandi.net/en/gandi/documents
Xylakant 11y ago
Faking ID scans adds a whole layer of law enforcement on top. I'm uncertain about the situation in the US, but in germany the fake itself is punishable by law (up 10 ten years). It also creates more traces to look at and creates work. You'd also need much more information to create a convincing fake id scan of your intended victim. It's all about increasing the amount of work for the would be attacker.
- ryanlol 11y ago
  >Faking ID scans adds a whole layer of law enforcement on top. That's why nobody has ever used a fake ID at a bar! > but in germany the fake itself is punishable by law (up 10 ten years). https://dejure.org/gesetze/StGB/267.html https://dejure.org/gesetze/StGB/267.html 5 years. But producing fake scans isn't covered by this law, scans aren't even an official document. In fact, it is illegal for a german company to ask you to send them scans of official documents. > You'd also need much more information to create a convincing fake id scan of your intended victim To fake a good enough passport scan you'd need your victims name. That's all the rep is going to have.
dorfsmay 11y ago
That was a few years back when another well-known registrar only required the last 4 digit of the customer's credit card, and would even help them guess if they didn't remember. I sent the ids by fax (yeah a few years back, I still had a fax machine). I thought asking for id's + phoning on the number listed in the whois database was a good cross check, especially back then.

evanosaurus 11y ago

Seriously. Gandi is the only registrar I use anymore.