3 ms·

Here is my idea for a non-broken/secure domain registrar using public-key crypto. a) When you register the domain, you provide a public key. b) The registrar

by javert 6y ago

Here is my idea for a non-broken/secure domain registrar using public-key crypto. a) When you register the domain, you provide a public key. b) The registrar will only ever redirect the domain if they receive a message signed with the corresponding private key. There is a holding period if you stop paying for the domain, before it is released to the public again. You pay for the holding period in advance, when you do the initial registration. This can be built today with existing technology. Can someone please make this? Any feedback? Does this exist already?

technion 6y ago
I've been through this twice this year where a reasonably large non-tech business came to me saying requesting help, only to find the credentials for their domain left with some previous employee and the "password reset" emails went to some @hotmail.com address noone knew how to access. Businesses see that sort of thing as normal and expect you'll just call the registrar and have it sorted it out. I absolutely cringe at how easy it's always been for me, but I likewise think anything like you've described would be just end up with an awful lot of businesses locked out of their domains.
- javert 6y ago
  It's a service for hackers, not for average businesses.
donmcronald 6y ago
That's way too complicated for the average registrant. There are lots of practical options that could strengthen the process for the average registrant. Half the battle is for registrars to quit accepting the equivalent of cold calls from registrants. How hard is it to make a call back to the registrant when they're asking for NS, MX, etc. changes? If the registrant phone number hasn't changed since registration, it's pretty safe to call them back and trust them IMO. If the registrant phone number was changed 5 days ago and someone is calling in asking for changes, that's an easy red flag and could be coupled with a technical restriction that requires escalation for important domain changes. Another option similar to yours but easier would be to set a pin during registration and to require it for making over the phone domain changes. I guarantee those will get lost / forgotten by the average registrant though. You'd be shocked at the number of small businesses that don't know where there domain is registered, who registered it, when it expires, etc.. If a domain is making money use a registry lock. If it's a high value domain making tons of money, pay MarkMonitor or similar to manage it.
- javert 6y ago
  > That's way too complicated for the average registrant. I don't care. It's a niche service. There are at least tens of thousands of security-paranoid developers who would be a target market for this product. This is child's play for anyone involved in the blockchain space.
  - cutemonster 6y ago
    Low cost MarkMonitor But still there're no guarantees that the registrar's own it infra is secure, or insiders with the wrong root access somewhere?
    - javert 6y ago
      Yeah, still no guarantee of that. A blockchain solution is ideal, but requires browsers to do DNS lookup using the blockchain. Namecoin was/is working on this. Another project is mentioned somewhere else in this thread (but it might be a scam, not sure).

by javert 6y ago

technion 6y ago

I've been through this twice this year where a reasonably large non-tech business came to me saying requesting help, only to find the credentials for their domain left with some previous employee and the "password reset" emails went to some @hotmail.com address noone knew how to access. Businesses see that sort of thing as normal and expect you'll just call the registrar and have it sorted it out. I absolutely cringe at how easy it's always been for me, but I likewise think anything like you've described would be just end up with an awful lot of businesses locked out of their domains.

javert 6y ago
It's a service for hackers, not for average businesses.

donmcronald 6y ago

That's way too complicated for the average registrant. There are lots of practical options that could strengthen the process for the average registrant. Half the battle is for registrars to quit accepting the equivalent of cold calls from registrants. How hard is it to make a call back to the registrant when they're asking for NS, MX, etc. changes? If the registrant phone number hasn't changed since registration, it's pretty safe to call them back and trust them IMO. If the registrant phone number was changed 5 days ago and someone is calling in asking for changes, that's an easy red flag and could be coupled with a technical restriction that requires escalation for important domain changes. Another option similar to yours but easier would be to set a pin during registration and to require it for making over the phone domain changes. I guarantee those will get lost / forgotten by the average registrant though. You'd be shocked at the number of small businesses that don't know where there domain is registered, who registered it, when it expires, etc.. If a domain is making money use a registry lock. If it's a high value domain making tons of money, pay MarkMonitor or similar to manage it.

javert 6y ago
> That's way too complicated for the average registrant. I don't care. It's a niche service. There are at least tens of thousands of security-paranoid developers who would be a target market for this product. This is child's play for anyone involved in the blockchain space.
- cutemonster 6y ago
  Low cost MarkMonitor But still there're no guarantees that the registrar's own it infra is secure, or insiders with the wrong root access somewhere?
  - javert 6y ago
    Yeah, still no guarantee of that. A blockchain solution is ideal, but requires browsers to do DNS lookup using the blockchain. Namecoin was/is working on this. Another project is mentioned somewhere else in this thread (but it might be a scam, not sure).