4 ms·

We have a really fun blog post coming out for this next week or so. One of our team found a pretty big bug in certain private registrations. Stay tuned.

• arca_vorago 9y ago
  You say fun, but in the era of swatting and doxxing, private registrations are often the first line of defense for those who don't have a USPS or ups mail address if they don't have a physical office/address. I would be very careful about how you responsibly disclose any such bugs.
  • mxpxrocks10 9y ago
    Good point. Poor word choice on my end. Thanks for the note. The stuff we found is not quite that abrasive but very interesting. How would you recommend disclosing?
    • mynewtb 9y ago
      Let the providers fix it. Contact the people potentially affected if you can.
• ploggingdev 9y ago
  Can you give a gist of your findings? I'll take a guess : customers are given unique whois protected email addresses allowing you to find all the domains owned by the person. Eg- If I own abc.com and xyz.com, both have the same public email address. The problem with such bugs is that there's no way to undo the damage since historical whois records are archived.
  • mxpxrocks10 9y ago
    you nailed it. It goes a little further with what you can see and how easy it is but right on point! If you notice anything else people would find interesting, feel free to post it or email me (in profile).
    • deleted 9y ago
      [deleted]