6 ms·

One worry about tying your identity to your own domain, is the security of your identity (aka your domain) hinges on the security of your registrar. If a bad ac

One worry about tying your identity to your own domain, is the security of your identity (aka your domain) hinges on the security of your registrar. If a bad actor can socially engineer their way into controlling your domain, your entire identity is compromised. Here's a blog post about this nightmare happening to someone: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...

ashtonkem 6y ago
I agree that that would be catastrophic, but I’m not convinced that using custom DNS changes my risk factor. If someone took over <my name>@gmail.com, they could do as much damage as they could by taking over <my name>@<my domain>.
- Roujo 6y ago
  Yes, but there's still an increase in the attack surface - it's a lot harder to convince a registrar to turn over gmail.com than <my domain>, for most values of <my domain>. It's not a deal breaker, of course, but it's something to consider when looking at the risk factor.
- cpascal 6y ago
  If you use an email provider to host your domain's email (e.g. Fastmail, GSuite, etc.), I believe you're actually increasing your risk factor. The security of your identity will depend on your registrar, your DNS provider, and your email provider.
toohotatopic 6y ago
So, which ones are the good registrars?
- nucleardog 6y ago
  I generally trust the major cloud providers a bit more than the companies focused on acting as a domain registrar. The domain registrars are generally a race to the bottom and focused on "add-on" sales as most people are shopping on price and that's going to reflect in the overall quality of the things that most people don't really notice like, y'know, security and validation. You don't hear a lot of stories about Amazon/GCP/Azure handing over someone's entire account based on a couple digits of a credit card number and it would be a PR nightmare if they did (hell, look at the flak they catch just for the data that people leave public on their services that ends up released... imagine if they handed it to someone). An active account with 2FA/etc enabled and a secure recovery email is probably safe enough for most people. Spend the extra couple bucks to register through one of those guys instead of JimbosDiscountDomains.
  - mythrwy 6y ago
    So use Google or Microsoft to register your domain? Doesn't that bring us back to the same potential problem though?
    - justinholt 6y ago
      I think the idea is to use their "enterprise", paid offerings as opposed to relying on the "free" services that Google or Microsoft offer.
    - nogabebop23 6y ago
      Google, Microsoft and AWS offer registrar services becuase it keeps you in their ecosystem for their higher margin products. THey generally offer competitive pricing for things like doamin registration and don't pull stunts like charging 2x as much for "privacy protection" or the even more dirty tricks like godaddy and other bottom feeders. I recently trialed hosted email with AWS and while it is very basic it only costs 4/user/month - cheaper than my google apps service. I was also able to register a new domain at market rates and get dns automatically setup (I think?) on AWS as part of the service. Now because I tie my monthly AWS spend with my registrar I'm more confident I can get some customer service as well. staying inside a vendor's ecosystem for very selective services can actually work out quite well, as long as the seller/customer incentives align and they are relatively commodity services.
    - nucleardog 6y ago
      No. The main issue raised several comments up is portability. No provider locks you to only using their email offering/cloud offerings if you register their domain through them. Even if they did, transferring domains is trivial and well-supported everywhere. As far as any other objections people usually raise around using hosted email and the like, a domain really has no comparable privacy implications in the real world (you're not handing Google or Microsoft a huge corpus on your life). It's also through their enterprise offerings where as long as your bill is paid they're generally not going to have some automated review suspend your account with no reason, and if they did they have actual support you can get in touch with. This solves basically all of the problems with using an @gmail.com/@outlook.com/etc email address.
- ztjio 6y ago
  Google is great for this because they will never actually let anyone talk to a human in order to apply social engineering techniques ;)
  - toohotatopic 6y ago
    But do you lose your domain if google bans your account? The requirement is being able to switch email providers, especially google, when they lock your account. You don't secure your flow of email with a domain if that domain is managed by google, too.
    - ztjio 6y ago
      So my statement was a total comedic effort not to be taken seriously, I'd never suggest anyone use a company on the basis of terrible customer support. That's what the semi-colon parentheses at the end was meant to signify. To attempt to actually answer your question, I believe the nature of the governance around registrars would ensure you have recourse to transfer your domain in the case that Google be Google. It might not be slick. I don't know. But, it's unlikely they can override the overarching policies for such things and continue being a registrar.
      - nogabebop23 6y ago
        I think the bigger question is how much work it is to update the DNS servers with your registrar and then change your DNS provider. If google locks you out of your email that you use to manage your domain you could be in trouble...
      - toohotatopic 6y ago
        Sorry, that went over my head.
    - filoleg 6y ago
      If you don't use your google account for anything but domain registration, what could they even possibly ban you for? While I am aware that Google tends to have quite a few false positive account bans, it is one of the most extremely unlikely things to happen, if all you do with it is pay for your domain registration.
- wpietri 6y ago
  I've been happy with Joker and AWS Route 53. I've used Joker for years and years; at the time they seemed sane both technically and as a business, and that's how it still feels. Route 53 is more recent, but it's been solid and reliable for me. And it's been very nice to control it declaratively with Terraform.
- cpascal 6y ago
  I use namecheap which has two-factor authentication, domain locks, and support pins.
  - StavrosK 6y ago
    I use Namecheap too, but they took forever to add 2FA (it was added a few months to a year ago, maybe?) and I don't have any faith they'll add FIDO2/U2F any time soon. EDIT: Oh daaamn it looks like they did it! Huh, faith restored. jgc, CloudFlare should follow! EDIT 2: I'm just full of failures today, CloudFlare supports U2F as well. This is great news all around.
- justinclift 6y ago
  EasyDNS (https://easydns.com https://easydns.com), based in Canada has been around for years, and has a good reputation for not blindly actioning DMCA requests (which can be important for some). :)
propogandist 6y ago
owning your domain and having control of a domain through a trusted registrar is better than relying on the worlds largest advertising company to manage your digital identity (email), which is offered as a free service, that's subject to a catch-all ToS.
- gowld 6y ago
  The article is literally about a user who was attacked because Twitter, Facebook ad GoDaddy have bad security, while his Google account was safe.
  - propogandist 6y ago
    An isolated fail in 2014 by one vendor, primarily due to poor support processes, is not a convincing argument to keep all digital identities in Google's possession. There's also the risk of Google shutting down your account because you do something they don't like. This will lead to a similiar outcome and you won't have any recourse.
  - andrepd 6y ago
    I think that GP's point is that "safe" is a tricky word to use when your data is in the custody of the world's largest non-governmental surveillance network with a a catch-all TOS.
  - StavrosK 6y ago
    Google Domains exists.

ashtonkem 6y ago

I agree that that would be catastrophic, but I’m not convinced that using custom DNS changes my risk factor. If someone took over <my name>@gmail.com, they could do as much damage as they could by taking over <my name>@<my domain>.

Roujo 6y ago
Yes, but there's still an increase in the attack surface - it's a lot harder to convince a registrar to turn over gmail.com than <my domain>, for most values of <my domain>. It's not a deal breaker, of course, but it's something to consider when looking at the risk factor.
cpascal 6y ago
If you use an email provider to host your domain's email (e.g. Fastmail, GSuite, etc.), I believe you're actually increasing your risk factor. The security of your identity will depend on your registrar, your DNS provider, and your email provider.

toohotatopic 6y ago

So, which ones are the good registrars?

nucleardog 6y ago
I generally trust the major cloud providers a bit more than the companies focused on acting as a domain registrar. The domain registrars are generally a race to the bottom and focused on "add-on" sales as most people are shopping on price and that's going to reflect in the overall quality of the things that most people don't really notice like, y'know, security and validation. You don't hear a lot of stories about Amazon/GCP/Azure handing over someone's entire account based on a couple digits of a credit card number and it would be a PR nightmare if they did (hell, look at the flak they catch just for the data that people leave public on their services that ends up released... imagine if they handed it to someone). An active account with 2FA/etc enabled and a secure recovery email is probably safe enough for most people. Spend the extra couple bucks to register through one of those guys instead of JimbosDiscountDomains.
- mythrwy 6y ago
  So use Google or Microsoft to register your domain? Doesn't that bring us back to the same potential problem though?
  - justinholt 6y ago
    I think the idea is to use their "enterprise", paid offerings as opposed to relying on the "free" services that Google or Microsoft offer.
  - nogabebop23 6y ago
    Google, Microsoft and AWS offer registrar services becuase it keeps you in their ecosystem for their higher margin products. THey generally offer competitive pricing for things like doamin registration and don't pull stunts like charging 2x as much for "privacy protection" or the even more dirty tricks like godaddy and other bottom feeders. I recently trialed hosted email with AWS and while it is very basic it only costs 4/user/month - cheaper than my google apps service. I was also able to register a new domain at market rates and get dns automatically setup (I think?) on AWS as part of the service. Now because I tie my monthly AWS spend with my registrar I'm more confident I can get some customer service as well. staying inside a vendor's ecosystem for very selective services can actually work out quite well, as long as the seller/customer incentives align and they are relatively commodity services.
  - nucleardog 6y ago
    No. The main issue raised several comments up is portability. No provider locks you to only using their email offering/cloud offerings if you register their domain through them. Even if they did, transferring domains is trivial and well-supported everywhere. As far as any other objections people usually raise around using hosted email and the like, a domain really has no comparable privacy implications in the real world (you're not handing Google or Microsoft a huge corpus on your life). It's also through their enterprise offerings where as long as your bill is paid they're generally not going to have some automated review suspend your account with no reason, and if they did they have actual support you can get in touch with. This solves basically all of the problems with using an @gmail.com/@outlook.com/etc email address.
ztjio 6y ago
Google is great for this because they will never actually let anyone talk to a human in order to apply social engineering techniques ;)
- toohotatopic 6y ago
  But do you lose your domain if google bans your account? The requirement is being able to switch email providers, especially google, when they lock your account. You don't secure your flow of email with a domain if that domain is managed by google, too.
  - ztjio 6y ago
    So my statement was a total comedic effort not to be taken seriously, I'd never suggest anyone use a company on the basis of terrible customer support. That's what the semi-colon parentheses at the end was meant to signify. To attempt to actually answer your question, I believe the nature of the governance around registrars would ensure you have recourse to transfer your domain in the case that Google be Google. It might not be slick. I don't know. But, it's unlikely they can override the overarching policies for such things and continue being a registrar.
    - nogabebop23 6y ago
      I think the bigger question is how much work it is to update the DNS servers with your registrar and then change your DNS provider. If google locks you out of your email that you use to manage your domain you could be in trouble...
    - toohotatopic 6y ago
      Sorry, that went over my head.
  - filoleg 6y ago
    If you don't use your google account for anything but domain registration, what could they even possibly ban you for? While I am aware that Google tends to have quite a few false positive account bans, it is one of the most extremely unlikely things to happen, if all you do with it is pay for your domain registration.
wpietri 6y ago
I've been happy with Joker and AWS Route 53. I've used Joker for years and years; at the time they seemed sane both technically and as a business, and that's how it still feels. Route 53 is more recent, but it's been solid and reliable for me. And it's been very nice to control it declaratively with Terraform.
cpascal 6y ago
I use namecheap which has two-factor authentication, domain locks, and support pins.
- StavrosK 6y ago
  I use Namecheap too, but they took forever to add 2FA (it was added a few months to a year ago, maybe?) and I don't have any faith they'll add FIDO2/U2F any time soon. EDIT: Oh daaamn it looks like they did it! Huh, faith restored. jgc, CloudFlare should follow! EDIT 2: I'm just full of failures today, CloudFlare supports U2F as well. This is great news all around.
justinclift 6y ago
EasyDNS (https://easydns.com https://easydns.com), based in Canada has been around for years, and has a good reputation for not blindly actioning DMCA requests (which can be important for some). :)

propogandist 6y ago

owning your domain and having control of a domain through a trusted registrar is better than relying on the worlds largest advertising company to manage your digital identity (email), which is offered as a free service, that's subject to a catch-all ToS.

gowld 6y ago
The article is literally about a user who was attacked because Twitter, Facebook ad GoDaddy have bad security, while his Google account was safe.
- propogandist 6y ago
  An isolated fail in 2014 by one vendor, primarily due to poor support processes, is not a convincing argument to keep all digital identities in Google's possession. There's also the risk of Google shutting down your account because you do something they don't like. This will lead to a similiar outcome and you won't have any recourse.
- andrepd 6y ago
  I think that GP's point is that "safe" is a tricky word to use when your data is in the custody of the world's largest non-governmental surveillance network with a a catch-all TOS.
- StavrosK 6y ago
  Google Domains exists.