4 ms·

This is probably unpopular but I think domains should just cost more. We don't all need our own name as a domain. Make them cost $500 or $1000 a year. [This mon

This is probably unpopular but I think domains should just cost more. We don't all need our own name as a domain. Make them cost $500 or $1000 a year. [This money goes to ICANN, W3C, etc.] That is nothing for a business but would make scammers and link farms (more) unprofitable. You could still make .org free but it requires sending 501c3 (or similar) documentation to the registrar. If you want a phone line you have certain fees for 911 and other regulations to help pay for the infrastructure and this is very similar in terms of a naming and communication service.

badrabbit 7y ago
That opinion is unpopular for good reason. A financial barier to prevent crime implies lack of petty money is the cause of the crime. You can make 10x what you said with the simplest scam targeting a few million valid recipients within a week. Even if your solution would solve the problem, it would destroy the purpose of the system. Throwing the proverbial baby with the bath water. If I want a phone line it costs me $10 to get a sim card from walmart. Most reputable TLDa cost a ton more. I mean what is it with this lazy way of solving real problems. What's next, tax domain registrations? Require a government ID? How ridiculous, this is what happens when humans give up their basic freedoms to goverenments and ruling classes. By what authority are you even regulating my free speech here? If I put up a website, I am not engaging in commerce unless I sell or buy something using that site. It is the equivalent of me calling myself a name and making a speech in public and you want to charge me £1000 for the right to call myself a name or to label the soap box I stand on a name so others can distiguish me. The fact that scammers also stand in soap boxes and make false claims for profit does not magically give you, your ruling class or the goverenmen t authority to regulate soap box labels and tax speech. Even if this has popular support, free speech is a natural right. You can police harmful/false speech retroactively but you can't inhibit speech proactively to deter a possible crime unless you can guarantee your measure affects only law breakers.
- snarf21 7y ago
  You are welcome to disagree but I guess I am missing your point. Having a website doesn't require a domain. DNS is a vanity layer on top to make it more user friendly and provide an abstraction layer. Domain registration costs money today. According to your argument that should be free or it is limiting your speech. I never said anything about speech or what you use the domains for. If it is yours, do whatever you want with it. Ethos bought .org for $1B. Why should a private equity company be able to own DNS suffixes? Are you okay with that? The issue at hand is that these domains are being created specifically to deceive. This is an issue of consumer protection and greater good. The US just passed bigger fines for robo-callers. Everyone seems fine with not getting scam phone calls from their own phone number. Is this a restriction of free speech? Everyone isn't allowed to run their own tv or radio station, it is regulated. Is that limiting your free speech? You can't make up your own phone number. If you want a special 800 number that is more memorable, you have to pay the phone company lots of extra money for it. I'm merely suggesting similar.
  - saagarjha 7y ago
    Domains are fundamentally different from phone numbers, because you interact with people you don’t necessarily “know” all the time while you only infrequently call people who aren’t in your contact list. Clicking on links would work, of course, but trying to remember the address of “that one dude who writes about maps” gets quite a bit harder.
  - imtringued 7y ago
    >Having a website doesn't require a domain. Are you even listening to yourself? Your idea was to make domain names hard to obtain so scammers can't have them. The only way that idea will be effective is if people only go to sites that are part of the validated domain name system. This means that if you don't have a domain, nobody will go on your site (this is already true today). So why on earth are you saying those legitimate websites should look like scams?
wolco 7y ago
A lot of these domains are rented rather than purchased where someone can use them for 45 days and return them.
- imtringued 7y ago
  I've seen a lot of sites give you offer for registering a domain name for the first time. Sometimes it's an absurd price like 1€ for the first year.
dane-pgp 7y ago
I actually like this idea, and I wonder how low the cost could be while still deterring the spammers. From what I've read, the cost of domains is a factor that spammers are sensitive to, especially if they are abandoning them after 24 hours, so increasing the cost by just an order of magnitude could be enough to make many campaigns unprofitable. This article somewhat supports my assertion: https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/ https://krebsonsecurity.com/2018/06/bad-men-at-work-please-d... saying "domains in the remaining five [out of ten] Top Bad TLDs can be had for between 48 cents and a dollar each." so I would suggest a one-off $100 fee rather than $500 or $1000 a year. A more interesting approach would be to make the fee act as a bond, which is returned to the registrant after a year of good behaviour. Unfortunately, determining "good behaviour" is almost as hard as determining "bad behaviour", but perhaps a domain could opt in to having anonymous metrics recorded of how many users visit their site or send emails to that domain. That would put a substantial amount of trust into the hands of whichever organisations were responsible for recording these metrics, but the only harm they could do to a registrant is forcing them to pay their $100 bond to charity.
- FDSGSG 7y ago
  Phishing is so lucrative that a $100 fee on domain registrations would do literally nothing to combat it. 20-30 victims can easily earn the phisher $1000
  - dane-pgp 7y ago
    That's an important number to note, thank you. Do you have an estimate for how many victims a single domain is likely to trick (before it gets blacklisted by Google Safe Browsing or similar)?
    - FDSGSG 7y ago
      Depends on who's being spammed and what kind of techniques the phishing site employs to resist safebrowsing. Single-use links and various browser fingerprinting techniques are common and fairly effective. Beyond that it comes down to who's being spammed, with the right demographics your link could last very long without being reported by anyone. I hack phishing sites for fun, anything between 0-500 hits seems common for the type of phishing seen in the OP (mostly depending on the quality of the leads).

badrabbit 7y ago

That opinion is unpopular for good reason. A financial barier to prevent crime implies lack of petty money is the cause of the crime. You can make 10x what you said with the simplest scam targeting a few million valid recipients within a week. Even if your solution would solve the problem, it would destroy the purpose of the system. Throwing the proverbial baby with the bath water. If I want a phone line it costs me $10 to get a sim card from walmart. Most reputable TLDa cost a ton more. I mean what is it with this lazy way of solving real problems. What's next, tax domain registrations? Require a government ID? How ridiculous, this is what happens when humans give up their basic freedoms to goverenments and ruling classes. By what authority are you even regulating my free speech here? If I put up a website, I am not engaging in commerce unless I sell or buy something using that site. It is the equivalent of me calling myself a name and making a speech in public and you want to charge me £1000 for the right to call myself a name or to label the soap box I stand on a name so others can distiguish me. The fact that scammers also stand in soap boxes and make false claims for profit does not magically give you, your ruling class or the goverenmen t authority to regulate soap box labels and tax speech. Even if this has popular support, free speech is a natural right. You can police harmful/false speech retroactively but you can't inhibit speech proactively to deter a possible crime unless you can guarantee your measure affects only law breakers.

snarf21 7y ago
You are welcome to disagree but I guess I am missing your point. Having a website doesn't require a domain. DNS is a vanity layer on top to make it more user friendly and provide an abstraction layer. Domain registration costs money today. According to your argument that should be free or it is limiting your speech. I never said anything about speech or what you use the domains for. If it is yours, do whatever you want with it. Ethos bought .org for $1B. Why should a private equity company be able to own DNS suffixes? Are you okay with that? The issue at hand is that these domains are being created specifically to deceive. This is an issue of consumer protection and greater good. The US just passed bigger fines for robo-callers. Everyone seems fine with not getting scam phone calls from their own phone number. Is this a restriction of free speech? Everyone isn't allowed to run their own tv or radio station, it is regulated. Is that limiting your free speech? You can't make up your own phone number. If you want a special 800 number that is more memorable, you have to pay the phone company lots of extra money for it. I'm merely suggesting similar.
- saagarjha 7y ago
  Domains are fundamentally different from phone numbers, because you interact with people you don’t necessarily “know” all the time while you only infrequently call people who aren’t in your contact list. Clicking on links would work, of course, but trying to remember the address of “that one dude who writes about maps” gets quite a bit harder.
- imtringued 7y ago
  >Having a website doesn't require a domain. Are you even listening to yourself? Your idea was to make domain names hard to obtain so scammers can't have them. The only way that idea will be effective is if people only go to sites that are part of the validated domain name system. This means that if you don't have a domain, nobody will go on your site (this is already true today). So why on earth are you saying those legitimate websites should look like scams?

wolco 7y ago

A lot of these domains are rented rather than purchased where someone can use them for 45 days and return them.

imtringued 7y ago
I've seen a lot of sites give you offer for registering a domain name for the first time. Sometimes it's an absurd price like 1€ for the first year.

dane-pgp 7y ago

I actually like this idea, and I wonder how low the cost could be while still deterring the spammers. From what I've read, the cost of domains is a factor that spammers are sensitive to, especially if they are abandoning them after 24 hours, so increasing the cost by just an order of magnitude could be enough to make many campaigns unprofitable. This article somewhat supports my assertion: https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/ https://krebsonsecurity.com/2018/06/bad-men-at-work-please-d... saying "domains in the remaining five [out of ten] Top Bad TLDs can be had for between 48 cents and a dollar each." so I would suggest a one-off $100 fee rather than $500 or $1000 a year. A more interesting approach would be to make the fee act as a bond, which is returned to the registrant after a year of good behaviour. Unfortunately, determining "good behaviour" is almost as hard as determining "bad behaviour", but perhaps a domain could opt in to having anonymous metrics recorded of how many users visit their site or send emails to that domain. That would put a substantial amount of trust into the hands of whichever organisations were responsible for recording these metrics, but the only harm they could do to a registrant is forcing them to pay their $100 bond to charity.

FDSGSG 7y ago
Phishing is so lucrative that a $100 fee on domain registrations would do literally nothing to combat it. 20-30 victims can easily earn the phisher $1000
- dane-pgp 7y ago
  That's an important number to note, thank you. Do you have an estimate for how many victims a single domain is likely to trick (before it gets blacklisted by Google Safe Browsing or similar)?
  - FDSGSG 7y ago
    Depends on who's being spammed and what kind of techniques the phishing site employs to resist safebrowsing. Single-use links and various browser fingerprinting techniques are common and fairly effective. Beyond that it comes down to who's being spammed, with the right demographics your link could last very long without being reported by anyone. I hack phishing sites for fun, anything between 0-500 hits seems common for the type of phishing seen in the OP (mostly depending on the quality of the leads).