14 ms·

Dangerous Gift

gwbas1c 4y ago
It stinks that we can't trust people. What's more frustrating is when software designers / product managers / business-ey people forget that "we can't trust people."
- userbinator 4y ago
  ...and what's even more frustrating is when the latter use it as an excuse to force us into their authoritarian dreams.
nicoburns 4y ago
I mean, this is why we have due process and a trial, right? At which you can present evidence that you didn't purchase the domain. Probably it wouldn't even get that far.
- akersten 4y ago
  The point the author is making is that that "due process" happens after your hypothetical front door is kicked down and dog shot, unfortunately.
  - nicoburns 4y ago
    I mean, that may well be true. But is so that's a problem with law enforcement and the justice system in general, not with the domain registrar. I believe for example, that it is extremely rare to have your door knocked down here in the UK. The police will generally politely knock and or ring the doorbell, and only knock your door down if you refuse to let them in.
    - Shank 4y ago
      > The police will generally politely knock and or ring the doorbell, and only knock your door down if you refuse to let them in. I highly doubt that this is going to be the case if the warrant says that you’re wanted for child abuse imagery or human trafficking. I’m sure they’re lovely for small infractions, though.
      - bckygldstn 4y ago
        That’s a surprising pair of crimes to equate, as to me they warrant very different police responses. Police violence ought to be a last-resort tool to e.g. prevent further crime or injury to innocents. Not as a punishment that scales with the abhorrence (or moral panic) of the crime. There’s no need to send the swat team for a non-violent non-organised criminal, monster though they may be. > I highly doubt At least on paper UK police aim to take a more evidence-based light-touch community-building approach to policing, so I'd be curious what reasons you have to doubt this claim? The assumption that US morality and culture applies globally is tiring and misses out on an opportunity for learning through comparison.
    - cgriswald 4y ago
      > I mean, that may well be true. But is so that's a problem with law enforcement and the justice system in general, not with the domain registrar. It is a problem with the justice system. It is also a problem with the registrar. The registrar operates in this environment and is seemingly breaking official ICANN rules.
  - njovin 4y ago
    And after you possibly have assets seized, which you may not even get back even if charges are never filed (in the US).
- dmd 4y ago
  Is this a joke? You don't get due process and a trial in this kind of situation - you've already been shot dead by the SWAT team.
- inetsee 4y ago
  Yeah, but that might involve lawyers and that could get expensive fast.
- cgriswald 4y ago
  Unless the LEA or the judge are savvy enough, a warrant might be issued allowing police to raid your house and seize all your computer equipment. If that happens, you'll get arrested in front of at least some of your neighbors, who might also find out why you were arrested. (Even some of the local cops might think you're just getting away on a technicality.) Eventually being found innocent or not charged may not matter to some of them. You will be in jail, at least for a while. You now have an arrest record. When people ask, "Have you ever been arrested," the answer will be "Yes." You might lose your job. Your computer equipment will be seized and police will go through it. It'll be used against you in and out of court—even things that are legal—if they think it makes you look bad or will get you to talk. Getting that equipment back after charges are dropped or you are found innocent in court may or may not be slow and byzantine. You will need to pay a lawyer, both to defend yourself, and to help you get your equipment back. ...
  - ansible 4y ago
    I wish I could upvote this comment more. Yes, this is all fixable... if you are not poor and not rather unlucky. But it will take time and money. Even if you don't lose your job, I'd estimate that it would cost you $20K on the low end for legal fees. Also, if you've done anything else even slightly illegal, and the LEA finds evidence of that when searching your stuff, even though you've been careful and haven't had cause to attract their attention previously... well... that's another whole bunch of trouble.
    - teakettle42 4y ago
      The justice system in the US is so infuriatingly bad, I don’t even know where to start when it comes to fixing it. The class issues are enormous; if you’re wealthy enough to be able to defend yourself, you’ll still only be treated with something only loosely approximating fairness at absolutely best. However, if you can’t afford tens of thousands for an attorney, experts, etc, you’re pretty much fucked. We need to seriously rethink how we treat the accused in this country, from automatic sanctions that are applied to any accused, to how much leeway the police and justice system have to destroy people’s lives before there’s even been any evidence presented of an actual crime.
- ygjb 4y ago
  Well sure, if you are sufficiently privileged to warrant getting a polite knock on the door rather than an amped up heavily armed borderline hit squad kicking your door in. It's also worth noting that the author specifically called out in the article that the concern here is SWATing which has become such a notorious problem in some circles that the concept has made it into mainstream TV shows covering the practice. Due process only counts when it's uniformly available, and there is ample evidence in the United States, and other countries that have similar policy, that the effectiveness of civil rights protections varies widely by economic status and ethnicity.
- teakettle42 4y ago
  > due process and a trial Good luck with that. Even on completely spurious charges, you’ll spend time in jail, spend tens of thousands on legal fees, and spend months of your life sweating bullets. Afterwards, you won’t even be able to sue the police thanks to qualified immunity.
  - rurban 4y ago
    - teakettle42 4y ago
      > a very risky third-world country Ridiculousness of your general sentiment aside, your use of “third-world” is itself quite … confused: https://en.m.wikipedia.org/wiki/Third_World https://en.m.wikipedia.org/wiki/Third_World
- usefulcat 4y ago
  The point of swatting isn't to get someone convicted, it's to get the police to harass someone. Have you ever seen a no-knock raid? It happened to a house 5 houses down from where I live. They broke down the door and threw a couple of flash-bangs inside. Even from 5 houses away with all doors and windows closed, I could have sworn someone just fired off a cannon. Pretty sure they won't be fixing or paying for any damages either.
  - corrral 4y ago
    > Pretty sure they won't be fixing or paying for any damages either. There was a somewhat-well-publicized incident a couple years(?) back when IIRC a shoplifting suspect (who was armed, I think) was chased by the cops, hid in a stranger's house, the police wrecked the house getting the guy out, and then didn't pay a dime to fix it, let alone anything to compensate for the significant inconvenience of having a messed-up house and having to have a lot of work done to repair it. Can't recall whether there were any successful lawsuits after, but the default was definitely, "nope, that's entirely your problem, we just break stuff, we don't fix it". And that's for someone who wasn't even any kind of target for the police, but an innocent bystander.
cgriswald 4y ago
II.A.1.2: > 1.2 "Designated Agent" means an individual or entity that the Prior Registrant or New Registrant explicitly authorizes to approve a Change of Registrant on its behalf. Unless there is some other mechanism for preventing the Registrar from also being Designated Agent, it might be that R has terms in its EULA where registrants agree that R is also Designated Agent.
opendomain 4y ago
So will ICANN fix this?
bombcar 4y ago
Was this a "privacy protected domain"? Because if you look at GoDaddy (probably R) domains that are "privacy protected" you see the registrant is actually "Domains By Proxy, LLC" and switching that domain to another GoDaddy account would be invisible on the whois system.
- Bytewave81 4y ago
  That's to the public whois system, sure. But LEAs could still obtain court orders to get the actual contact information for the domain owner; registrars are legally mandated to maintain that information, and customers are expected to keep that up to date.
  - bombcar 4y ago
    Yeah, it's just that they probably aren't doing anything against the rules since the "technical" registrant never changed. It's still a silly setup - but then again, we have the same thing in banking - I could send you funds if I know your routing and ACH number (which is available on any of your checks, etc). So if I were a big crime lord I could randomly send money directly to people I didn't like so they'd go down with me.
- albert_e 4y ago
  This does not seem to be an option for some of the newer (cheaper) domains like .link and .click There are available for $5 per year but need to publicly show your details
- dotBen 4y ago
  But you can elect not to have your domain privacy protected. And if a bad actor is trying to grief another person they could list out their entire address, email, phone etc in the public WHOIS then transfer it over to them to create the "ultimate smoking gun".
upofadown 4y ago
How would someone get away with this? Wouldn't this be something like "filing a false police report"?
- dblohm7 4y ago
  It seems to me like, by that point, the damage has already been done.
- cowtools 4y ago
  pretty easy to get away with if you register the original domain using a shell company/pseudonym in a foreign nation
- deleted 4y ago
  [deleted]
- joshstrange 4y ago
  People who swat doesn't care about the person being charged and tried, it's all about making the police kick your door down, kill your dog/pet, and potentially kill you (at least scare the shit out of you).
duxup 4y ago
This feels plausible but if someone wanted to SWAT someone ... there's probably other / likely easier ways to do it. Having to registrar a domain, come up with some content, or just point the domain at some content ... then transfer it ... and then make a big deal out of it (getting attention is hard) and hoping nobody notices the easy to prove explanation that "someone transferred this to me" ... and avoiding getting caught seems like a big ordeal. The story here is "hey random guy also hosts horrible stuff at his domain that he registered in his own name ... well he did". Maybe some folks run with that, but I'm not so so sure. The mechanism here seems "easy" on the surface, but actually rather complicated, and odds of success seems low.
- ghaff 4y ago
  I tend to agree. There are certainly potential bad outcomes but a lot of it boils down to SWATing and there are almost certainly easier and less traceable ways to SWAT someone. And getting attention on Twitter or whatnot presumably means getting the attention of people who can quickly determine that something is amiss. ADDED: While this process should probably be fixed in this case, at the end of the day, there's probably no foolproof way to keep people from sending you illegal stuff in either the physical or digital world in general.
- zitterbewegung 4y ago
  SWATing someone generally involves two things. 1. Somehow you get the IP address of the target maybe by playing a game with them (which can be p2p) or some other way of getting the IP address and then geolocating (this can partially be avoided by using a VPN 2. If someone is live-streaming outside in the real world you recognize where the person is. I haven't heard of someone being SWATed by a nefarious actor inside a company and never really a domain probably because you either purchased some protection plan to avoid spam so that if someone looks you up on the domain they won't find any information and also most people don't self host things using their own domain. With that said that doesn't mean it is impossible to occur. For example Krebs on security has had SWATing attempts due to the content he posts. If you aren't live-streaming video games or doing IRL posts and or not reporting on bad actors you should consider other things to worry about.
deleted 4y ago
[deleted]
mrandish 4y ago
If you want to get ICANN to fix this vulnerability, you could fix it: A. The Proper Way: Find the right person at ICANN, send letters, follow-up, and hope they understand and prioritize the issue so it's addressed in some number of years. or B. The Fast Way: Register a funny yet embarrassing domain name, transfer it to a senior ICANN official, tweet to some journalists idle speculation wondering why this person has such a domain name. The vulnerability will be addressed ASAP. :-)
- linkdd 4y ago
  B. And then get in trouble (or sued) for diffamation once we discover that the domain was initially registered by you. EDIT: Being downvoted because I'm against public shaming, way to go HN! Go on, downvote me.
  - loceng 4y ago
    If there isn't 1) intent for defamation, and 2) identifiable damages (monetary) then there's no viable lawsuit; and arguably any reputation "damage" is deserved if the organization they're in charge of allowed this to happen so easily.
    - roflyear 4y ago
      There doesn't have to be those things to make your life hell, at least not in the US. There just has to be enough of an argument where a judge will be OK with bringing it to court - and even if he isn't OK with it, you'll still have tons of lawyer fees to deal with.
    - linkdd 4y ago
      Either way, I think it's irresponsible to target a random employee and throw journalists at him. No, nobody deserves "reputation damage" for the misbehavior of their company (and here, the one at fault is another company).
      - loceng 4y ago
ianbutler 4y ago
Just did this at another well known registrar, two clicks and my friend transferred 8 domains to me without much in the way of checks. Crazy to think of but here we are.
neves 4y ago
No reason to worry. After this page topped HN all the SWAT teams will be overwhelmed and when they get to your house in 10 years you probably will already have moved.
bena 4y ago
This feels a lot like complaining anyone can send you mail. I can send anyone anything provided I know their name and address. Even illicit materials. Or illegal materials. I don't even have to provide my real name. Or address. I can make it look like anyone is a criminal. Muahahahaha. Did they reset the DNS information? Because that's all that's really needed to prevent the sort of weird malicious behavior he's describing.
- namaria 4y ago
  It really doesn't take much for a motivated person to destroy another person's life. People get away with that all the time. Why is it hard to believe there is yet another way to do it?
  - bena 4y ago
    I don't believe this is a way to do it.
benjaminwootton 4y ago
You normally have to click to accept an inbound transferred domain.
blip54321 4y ago
After 9/11, a clever MIT undergrad grabbed some form of alqaeda.net. Any email sent to the address went to the corresponding @mit.edu email address. You could email professor_alice@alqaeda.net, and it'd arrive at professor_alice@mit.edu. Undergrads sent emails like that for the lols. Recipients got freaked out they'd end up on some government watch list.
- thesausageking 4y ago
  Reminds me of the "iced coffee obama nsa inside job syria" Venmo payment https://www.gawker.com/the-words-that-will-get-you-in-trouble-on-venmo-1738331672 https://www.gawker.com/the-words-that-will-get-you-in-troubl...
  - matheusmoreira 4y ago
    That's terrifying. This is the number one reason why cryptocurrencies liie Monero were invented.
  - hyperdimension 4y ago
    And don't ever, ever mention Iran.
    - deleted 4y ago
      [deleted]
  - Sebguer 4y ago
    There's much more trivial ways (and less funny ones) like just dropping a name from: https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/
  - andorov 4y ago
    I got flagged for paying a friend back for "cuban food"...
gigel82 4y ago
This reminds me of how Apple (and likely Google at some point) scans all your photos for "illegal content" and how the defaults are set up: * WhatsApp will accept incoming messages from accounts not in your contacts * WhatsApp will save all incoming photos to your library * iCloud will upload all photos in your library to the cloud Scary stuff.
- zaik 4y ago
  Does WhatsApp download media from strangers?
  - Operyl 4y ago
    In group chats it appears to.
- bsnal 4y ago
  Apple chose not to scan photos, at least for now.
  - jonny_eh 4y ago
    Wasn't that just scanning on the phone? Don't they already scan photos uploaded to iCloud?
    - corrral 4y ago
      Every cloud service scans media uploaded to them.
      - jonny_eh 4y ago
        Right, but people are asserting that Apple doesn't scan personal photos, which is false for most iPhone users.
- choxi 4y ago
  Apple didn’t end up rolling out the CSAM scanning, but a new EU law might require them to: https://9to5mac.com/2022/05/11/apples-csam-troubles-may-be-back-as-eu-plans-a-law-requiring-detection/ https://9to5mac.com/2022/05/11/apples-csam-troubles-may-be-b...
simonw 4y ago
I've been calling this kind of thing a "reputation attack". They come in all sorts of shapes. Here's a common one: a platform allows you to create teams and invite other users to be members of those teams. The teams that a user is a member of are shown on their profile. Someone could create a team called "Paid up members of the Nazi party" and add people as members! That's why it's crucial to have a "accept invitation" step if you build anything like this. Getting a lot of press these days is the similar thing where you can transfer an NFT to someone's wallet without their permission.
boplicity 4y ago
1. Did the DNS information transfer, or did it get reverted? In other words, could the domain still be pointing at the nefarious server? 2. Do law enforcement, as standard practice, have access to the history of domain ownership? Would they see that it was recently transferred, or not?
justin_oaks 4y ago
Being able to send people things without their approval is a problem on all sorts of things across the internet. Spam email is the most common, but the same problem exists for people sharing things in Google Drive. I had a password manager application that allowed you to share password entries to anyone else who has an account with that password manager company. The app/site actually did require you to approve the incoming entries, but didn't let you know what was in them, how many there were, etc.
- skykooler 4y ago
  I was wondering about this with regards to bitcoin and other crypto currencies (which also have no way to choose whether or not to receive something sent to you). Surely someone could do some crime with coins in a certain wallet, and then transfer them to you; your wallet now contains illegal money and you don't really have a way to prove that you weren't involved.
  - TremendousJudge 4y ago
    Way ahead of you: it's already been done https://bitcoinist.com/hackers-are-now-trying-to-steal-crypto-via-malicious-nfts/ https://bitcoinist.com/hackers-are-now-trying-to-steal-crypt...
joshstrange 4y ago
> These days, one would hope LEA officers would at least look at who owns the domain name, but you just said that the registrar transferred it to you and changed the WHOIS data to use your full name and address. I started to write a comment about how horribly optimistic this is but then I thought about it some more. If it is indeed "Local" police you are probably screwed. They have zero understanding of the internet/tech and even people in positions with titles like "Cyber security" at your local station are probably just cops that got promoted into that role and have very little to zero understanding. Every interaction with my local cops w.r.t. technology has been painful and fruitless. Of course this assumes they would follow up on it in the first place. My LEA outright refused to lift a finger with a harassment case even when provided step by step instructions (and we knew who was behind it) on how to request information from the company the harasser was using (throwaway phone numbers). That said, maybe an instance like the author describes would get them off their butts. If it goes up to a federal level then maybe they would understand the nuance of domain transfers but not before kicking in you door.
quartz 4y ago
This is true of crypto wallets and NFTs as well. More than one project has attempted to send NFTs or assets to high profile wallets (ex: trillions of dog-coins sent to Vitalik's wallet that he ultimately donated to get rid of but not before drawing the intended media attention[1]) and the whole concept of airdrops is based around the idea of permissionless receiving. Unfortunately, re: swatting via an non-tech-savy LEA and domain registrars: you could likely just update the contact details on a domain you own to the intended target and that'd probably be enough. [1] https://www.coindesk.com/markets/2021/10/20/vitalik-buterin-sent-away-trillions-of-unwanted-dog-coins-but-more-keep-rolling-in/ https://www.coindesk.com/markets/2021/10/20/vitalik-buterin-...
- jonny_eh 4y ago
  Also true of text messages and email, which can include unsavory content.
  - simonw 4y ago
    Text messages and email are different because they're private: if someone sends you an abusive text only you can see it. The problem with NFT wallets is that you can send someone something which will then be publicly visible and associated with them, without their consent.
    - munificent 4y ago
      > Text messages and email are different because they're private: if someone sends you an abusive text only you can see it. https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM
      - soco 4y ago
        PRISM is not even needed, a warrant is often enough (and sometimes only pressure).
    - PaulDavisThe1st 4y ago
throwaway787544 4y ago
You don't get SWATed for owning a child porn domain. SWAT teams only break down your door if you might have a weapon and be violent with it. If the police just think you're involved in a crime, they have to get a warrant for your arrest and then knock on your door and wait "a reasonable amount of time". They're also less trigger happy if they don't suspect you of having a weapon.
- munificent 4y ago
  "The 2017 Wichita swatting occurred on December 28, 2017, in Wichita, Kansas, United States. The incident began as an online dispute between Casey Viner and Shane Gaskill, regarding the video game Call of Duty: WWII. During the dispute, Viner threatened to have Gaskill swatted, and Gaskill responded by giving him a false address for his residence, one that was occupied by an uninvolved person, Andrew Finch. Viner then asked Tyler Barriss to make the required fraudulent call to initiate the swatting. Wichita Police responded to the address, and as Finch was exiting his house, police officer Justin Rapp fatally shot him." https://en.wikipedia.org/wiki/2017_Wichita_swatting https://en.wikipedia.org/wiki/2017_Wichita_swatting
  - throwaway787544 4y ago
    "Barriss, identifying himself as "Brian", claimed that he was at the residence at 1033 West McCormick Street, had fatally shot his father, and was holding family members at gunpoint. He asked if police were coming to the house, saying he had already poured gasoline all over the house and was threatening to set it on fire." ^ THAT is why the police shot. Not because someone had registered a domain name called "imakechildporn.com". They need a credible and imminent threat of violence. You can't just roll up on someone who might be hosting a "illegal website" and use that as a pretext to shoot first ask questions later.
    - Beltalowda 4y ago
      I'd argue that someone phoning in such an over-the-top movie scenario threat from an anonymous phone number is also not a "credible and imminent threat of violence". Definitely something that warrants investigation of course, but not something to start pulling out all the guns and start shooting people when they open the front door to see what all the ruckus is about.
abcd_f 4y ago
Tangentially related, but we stepped on a rake by forwarding spam and malware emails to abuse@outlook.com. These morons got our poor mail server blacklisted in some super-exotic way that required several days of escalations to sort out. Moreover, they did it more than once, several months apart, each time causing a week of non-deliverability problems, and it took us a damn long while to add 1 and 1 to see why it was happening. Stopped reporting the abuse to them after that and all is good now.
javajosh 4y ago
Tangentially related, now that SWAT'ing is a known-problem, is it possible to contact local law enforcement and forewarn them "Hey, I think I'm at high risk of being SWATed" such that if they receive a call they do some extra diligence to verify? (Like, for example, call you before dispatching.)
- FemmeAndroid 4y ago
  Yes. I'm sure it works better in some locations and worse in others, but I know at least a few people who have proactively called law enforcement agencies about being a high probability target of SWATing and related activities.
legohead 4y ago
Waiting on the day someone puts some extremely illegal content on a major blockchain...
- l33t2328 4y ago
  People already have. The hash lives on the blockchain, not the thing itself, so it’s a non issue.
  - layer8 4y ago
    There is actual illegal content on the Bitcoin blockchain: https://www.schneier.com/blog/archives/2021/03/illegal-content-and-the-blockchain.html https://www.schneier.com/blog/archives/2021/03/illegal-conte...
  - gpm 4y ago
    It shouldn't be hard to make the actual bits themselves live on the blockchain. It's trivial to make values so that their hashes have certain bits set to 0 or 1 as you chose (as long as you only use a few bits per hash)...
deleted 4y ago
[deleted]
natch 4y ago
> You could instead just tell R, but I can’t really imagine a scenario where even a great tech support person would both understand the problem and be able to get it to the right people on their legal team in an reliable fashion.” That depends…. with the right R I could see it. The tech person I interact with (rarely) at nearlyfreespeech.net deeply gets it — tech, business, legal. I doubt he’s a lawyer of course, but expect he knows when to get them involved. Probably the owner of the whole operation, if I had to guess. And yes I realize they are probably just front ending for the real registrar, but to me they are effectively the registrar; not here to argue about that.
gmiller123456 4y ago
Unless things have changed, this isn't an issue with any particular registrar, you can put anyone's contact info in for the WHOIS information. In fact, just not having your name in the WHOIS won't help with the SWAT problem. Someone could just as easily create any website and just say they are you. I haven't talked to a SWAT team member in quite a while, but I still doubt they're very adept at looking up HWOIS information. I think it'd suffice to say that if anyone creates a website that says "I am ..., this is my plan to commit some serious crime". You're probably getting a visit, rather than an assumption that it's a spoof just because the WHOIS info doesn't match.
gwern 4y ago
https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html https://www.schneier.com/blog/archives/2008/03/the_security_... 'Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that you could get ants sent to you in the mail. I replied: “What’s really interesting is that these people will send a tube of live ants to anyone you tell them to.”'
- tomcatfish 4y ago
  Since you're being modest, I'll follow with the relevant article of yours that I was going to take that quote from: https://www.gwern.net/Unseeing https://www.gwern.net/Unseeing (A collection of musings on the difference in mindset between "Moving the domain to a friend is okay" and "Wait, you can move the domain to anyone? How do you not see the issue with that?")
- zeckalpha 4y ago
  The postal service uses the return address in a similar way. If you don’t have a stamp, swap the return and destination addresses.
  - MerelyMortal 4y ago
    If they don't recognize that the return address is in a different area than where it was dropped off, and that the destination address is in the area it was dropped off, then oh well USPS.
    - sparky_z 4y ago
      Have you never needed to mail something while you were traveling?
  - gwern 4y ago
    Sounds unreliable. You ever try that?
greyface- 4y ago
This is true of real estate titles in many jurisdictions, too. You can quit claim a property to anyone without their consent, and then from that point on they are on the hook for property taxes, compliance with title covenants, etc.

It stinks that we can't trust people. What's more frustrating is when software designers / product managers / business-ey people forget that "we can't trust people."

userbinator 4y ago
...and what's even more frustrating is when the latter use it as an excuse to force us into their authoritarian dreams.

nicoburns 4y ago

I mean, this is why we have due process and a trial, right? At which you can present evidence that you didn't purchase the domain. Probably it wouldn't even get that far.

akersten 4y ago
The point the author is making is that that "due process" happens after your hypothetical front door is kicked down and dog shot, unfortunately.
- nicoburns 4y ago
  I mean, that may well be true. But is so that's a problem with law enforcement and the justice system in general, not with the domain registrar. I believe for example, that it is extremely rare to have your door knocked down here in the UK. The police will generally politely knock and or ring the doorbell, and only knock your door down if you refuse to let them in.
  - Shank 4y ago
    > The police will generally politely knock and or ring the doorbell, and only knock your door down if you refuse to let them in. I highly doubt that this is going to be the case if the warrant says that you’re wanted for child abuse imagery or human trafficking. I’m sure they’re lovely for small infractions, though.
    - bckygldstn 4y ago
      That’s a surprising pair of crimes to equate, as to me they warrant very different police responses. Police violence ought to be a last-resort tool to e.g. prevent further crime or injury to innocents. Not as a punishment that scales with the abhorrence (or moral panic) of the crime. There’s no need to send the swat team for a non-violent non-organised criminal, monster though they may be. > I highly doubt At least on paper UK police aim to take a more evidence-based light-touch community-building approach to policing, so I'd be curious what reasons you have to doubt this claim? The assumption that US morality and culture applies globally is tiring and misses out on an opportunity for learning through comparison.
  - cgriswald 4y ago
    > I mean, that may well be true. But is so that's a problem with law enforcement and the justice system in general, not with the domain registrar. It is a problem with the justice system. It is also a problem with the registrar. The registrar operates in this environment and is seemingly breaking official ICANN rules.
- njovin 4y ago
  And after you possibly have assets seized, which you may not even get back even if charges are never filed (in the US).
dmd 4y ago
Is this a joke? You don't get due process and a trial in this kind of situation - you've already been shot dead by the SWAT team.
inetsee 4y ago
Yeah, but that might involve lawyers and that could get expensive fast.
cgriswald 4y ago
Unless the LEA or the judge are savvy enough, a warrant might be issued allowing police to raid your house and seize all your computer equipment. If that happens, you'll get arrested in front of at least some of your neighbors, who might also find out why you were arrested. (Even some of the local cops might think you're just getting away on a technicality.) Eventually being found innocent or not charged may not matter to some of them. You will be in jail, at least for a while. You now have an arrest record. When people ask, "Have you ever been arrested," the answer will be "Yes." You might lose your job. Your computer equipment will be seized and police will go through it. It'll be used against you in and out of court—even things that are legal—if they think it makes you look bad or will get you to talk. Getting that equipment back after charges are dropped or you are found innocent in court may or may not be slow and byzantine. You will need to pay a lawyer, both to defend yourself, and to help you get your equipment back. ...
- ansible 4y ago
  I wish I could upvote this comment more. Yes, this is all fixable... if you are not poor and not rather unlucky. But it will take time and money. Even if you don't lose your job, I'd estimate that it would cost you $20K on the low end for legal fees. Also, if you've done anything else even slightly illegal, and the LEA finds evidence of that when searching your stuff, even though you've been careful and haven't had cause to attract their attention previously... well... that's another whole bunch of trouble.
  - teakettle42 4y ago
    The justice system in the US is so infuriatingly bad, I don’t even know where to start when it comes to fixing it. The class issues are enormous; if you’re wealthy enough to be able to defend yourself, you’ll still only be treated with something only loosely approximating fairness at absolutely best. However, if you can’t afford tens of thousands for an attorney, experts, etc, you’re pretty much fucked. We need to seriously rethink how we treat the accused in this country, from automatic sanctions that are applied to any accused, to how much leeway the police and justice system have to destroy people’s lives before there’s even been any evidence presented of an actual crime.
ygjb 4y ago
Well sure, if you are sufficiently privileged to warrant getting a polite knock on the door rather than an amped up heavily armed borderline hit squad kicking your door in. It's also worth noting that the author specifically called out in the article that the concern here is SWATing which has become such a notorious problem in some circles that the concept has made it into mainstream TV shows covering the practice. Due process only counts when it's uniformly available, and there is ample evidence in the United States, and other countries that have similar policy, that the effectiveness of civil rights protections varies widely by economic status and ethnicity.
teakettle42 4y ago
> due process and a trial Good luck with that. Even on completely spurious charges, you’ll spend time in jail, spend tens of thousands on legal fees, and spend months of your life sweating bullets. Afterwards, you won’t even be able to sue the police thanks to qualified immunity.
- rurban 4y ago
  - teakettle42 4y ago
    > a very risky third-world country Ridiculousness of your general sentiment aside, your use of “third-world” is itself quite … confused: https://en.m.wikipedia.org/wiki/Third_World https://en.m.wikipedia.org/wiki/Third_World
usefulcat 4y ago
The point of swatting isn't to get someone convicted, it's to get the police to harass someone. Have you ever seen a no-knock raid? It happened to a house 5 houses down from where I live. They broke down the door and threw a couple of flash-bangs inside. Even from 5 houses away with all doors and windows closed, I could have sworn someone just fired off a cannon. Pretty sure they won't be fixing or paying for any damages either.
- corrral 4y ago
  > Pretty sure they won't be fixing or paying for any damages either. There was a somewhat-well-publicized incident a couple years(?) back when IIRC a shoplifting suspect (who was armed, I think) was chased by the cops, hid in a stranger's house, the police wrecked the house getting the guy out, and then didn't pay a dime to fix it, let alone anything to compensate for the significant inconvenience of having a messed-up house and having to have a lot of work done to repair it. Can't recall whether there were any successful lawsuits after, but the default was definitely, "nope, that's entirely your problem, we just break stuff, we don't fix it". And that's for someone who wasn't even any kind of target for the police, but an innocent bystander.

cgriswald 4y ago

II.A.1.2: > 1.2 "Designated Agent" means an individual or entity that the Prior Registrant or New Registrant explicitly authorizes to approve a Change of Registrant on its behalf. Unless there is some other mechanism for preventing the Registrar from also being Designated Agent, it might be that R has terms in its EULA where registrants agree that R is also Designated Agent.

opendomain 4y ago

So will ICANN fix this?

bombcar 4y ago

Was this a "privacy protected domain"? Because if you look at GoDaddy (probably R) domains that are "privacy protected" you see the registrant is actually "Domains By Proxy, LLC" and switching that domain to another GoDaddy account would be invisible on the whois system.

Bytewave81 4y ago
That's to the public whois system, sure. But LEAs could still obtain court orders to get the actual contact information for the domain owner; registrars are legally mandated to maintain that information, and customers are expected to keep that up to date.
- bombcar 4y ago
  Yeah, it's just that they probably aren't doing anything against the rules since the "technical" registrant never changed. It's still a silly setup - but then again, we have the same thing in banking - I could send you funds if I know your routing and ACH number (which is available on any of your checks, etc). So if I were a big crime lord I could randomly send money directly to people I didn't like so they'd go down with me.
albert_e 4y ago
This does not seem to be an option for some of the newer (cheaper) domains like .link and .click There are available for $5 per year but need to publicly show your details
dotBen 4y ago
But you can elect not to have your domain privacy protected. And if a bad actor is trying to grief another person they could list out their entire address, email, phone etc in the public WHOIS then transfer it over to them to create the "ultimate smoking gun".

upofadown 4y ago

How would someone get away with this? Wouldn't this be something like "filing a false police report"?

dblohm7 4y ago
It seems to me like, by that point, the damage has already been done.
cowtools 4y ago
pretty easy to get away with if you register the original domain using a shell company/pseudonym in a foreign nation
deleted 4y ago
[deleted]
joshstrange 4y ago
People who swat doesn't care about the person being charged and tried, it's all about making the police kick your door down, kill your dog/pet, and potentially kill you (at least scare the shit out of you).

duxup 4y ago

This feels plausible but if someone wanted to SWAT someone ... there's probably other / likely easier ways to do it. Having to registrar a domain, come up with some content, or just point the domain at some content ... then transfer it ... and then make a big deal out of it (getting attention is hard) and hoping nobody notices the easy to prove explanation that "someone transferred this to me" ... and avoiding getting caught seems like a big ordeal. The story here is "hey random guy also hosts horrible stuff at his domain that he registered in his own name ... well he did". Maybe some folks run with that, but I'm not so so sure. The mechanism here seems "easy" on the surface, but actually rather complicated, and odds of success seems low.

ghaff 4y ago
I tend to agree. There are certainly potential bad outcomes but a lot of it boils down to SWATing and there are almost certainly easier and less traceable ways to SWAT someone. And getting attention on Twitter or whatnot presumably means getting the attention of people who can quickly determine that something is amiss. ADDED: While this process should probably be fixed in this case, at the end of the day, there's probably no foolproof way to keep people from sending you illegal stuff in either the physical or digital world in general.
zitterbewegung 4y ago
SWATing someone generally involves two things. 1. Somehow you get the IP address of the target maybe by playing a game with them (which can be p2p) or some other way of getting the IP address and then geolocating (this can partially be avoided by using a VPN 2. If someone is live-streaming outside in the real world you recognize where the person is. I haven't heard of someone being SWATed by a nefarious actor inside a company and never really a domain probably because you either purchased some protection plan to avoid spam so that if someone looks you up on the domain they won't find any information and also most people don't self host things using their own domain. With that said that doesn't mean it is impossible to occur. For example Krebs on security has had SWATing attempts due to the content he posts. If you aren't live-streaming video games or doing IRL posts and or not reporting on bad actors you should consider other things to worry about.

deleted 4y ago

[deleted]

mrandish 4y ago

If you want to get ICANN to fix this vulnerability, you could fix it: A. The Proper Way: Find the right person at ICANN, send letters, follow-up, and hope they understand and prioritize the issue so it's addressed in some number of years. or B. The Fast Way: Register a funny yet embarrassing domain name, transfer it to a senior ICANN official, tweet to some journalists idle speculation wondering why this person has such a domain name. The vulnerability will be addressed ASAP. :-)

linkdd 4y ago
B. And then get in trouble (or sued) for diffamation once we discover that the domain was initially registered by you. EDIT: Being downvoted because I'm against public shaming, way to go HN! Go on, downvote me.
- loceng 4y ago
  If there isn't 1) intent for defamation, and 2) identifiable damages (monetary) then there's no viable lawsuit; and arguably any reputation "damage" is deserved if the organization they're in charge of allowed this to happen so easily.
  - roflyear 4y ago
    There doesn't have to be those things to make your life hell, at least not in the US. There just has to be enough of an argument where a judge will be OK with bringing it to court - and even if he isn't OK with it, you'll still have tons of lawyer fees to deal with.
  - linkdd 4y ago
    Either way, I think it's irresponsible to target a random employee and throw journalists at him. No, nobody deserves "reputation damage" for the misbehavior of their company (and here, the one at fault is another company).
    - loceng 4y ago

ianbutler 4y ago

Just did this at another well known registrar, two clicks and my friend transferred 8 domains to me without much in the way of checks. Crazy to think of but here we are.

neves 4y ago

No reason to worry. After this page topped HN all the SWAT teams will be overwhelmed and when they get to your house in 10 years you probably will already have moved.

bena 4y ago

This feels a lot like complaining anyone can send you mail. I can send anyone anything provided I know their name and address. Even illicit materials. Or illegal materials. I don't even have to provide my real name. Or address. I can make it look like anyone is a criminal. Muahahahaha. Did they reset the DNS information? Because that's all that's really needed to prevent the sort of weird malicious behavior he's describing.

namaria 4y ago
It really doesn't take much for a motivated person to destroy another person's life. People get away with that all the time. Why is it hard to believe there is yet another way to do it?
- bena 4y ago
  I don't believe this is a way to do it.

benjaminwootton 4y ago

You normally have to click to accept an inbound transferred domain.

blip54321 4y ago

After 9/11, a clever MIT undergrad grabbed some form of alqaeda.net. Any email sent to the address went to the corresponding @mit.edu email address. You could email professor_alice@alqaeda.net, and it'd arrive at professor_alice@mit.edu. Undergrads sent emails like that for the lols. Recipients got freaked out they'd end up on some government watch list.

thesausageking 4y ago
Reminds me of the "iced coffee obama nsa inside job syria" Venmo payment https://www.gawker.com/the-words-that-will-get-you-in-trouble-on-venmo-1738331672 https://www.gawker.com/the-words-that-will-get-you-in-troubl...
- matheusmoreira 4y ago
  That's terrifying. This is the number one reason why cryptocurrencies liie Monero were invented.
- hyperdimension 4y ago
  And don't ever, ever mention Iran.
  - deleted 4y ago
    [deleted]
- Sebguer 4y ago
  There's much more trivial ways (and less funny ones) like just dropping a name from: https://sanctionssearch.ofac.treas.gov/ https://sanctionssearch.ofac.treas.gov/
- andorov 4y ago
  I got flagged for paying a friend back for "cuban food"...

gigel82 4y ago

This reminds me of how Apple (and likely Google at some point) scans all your photos for "illegal content" and how the defaults are set up: * WhatsApp will accept incoming messages from accounts not in your contacts * WhatsApp will save all incoming photos to your library * iCloud will upload all photos in your library to the cloud Scary stuff.

zaik 4y ago
Does WhatsApp download media from strangers?
- Operyl 4y ago
  In group chats it appears to.
bsnal 4y ago
Apple chose not to scan photos, at least for now.
- jonny_eh 4y ago
  Wasn't that just scanning on the phone? Don't they already scan photos uploaded to iCloud?
  - corrral 4y ago
    Every cloud service scans media uploaded to them.
    - jonny_eh 4y ago
      Right, but people are asserting that Apple doesn't scan personal photos, which is false for most iPhone users.
choxi 4y ago
Apple didn’t end up rolling out the CSAM scanning, but a new EU law might require them to: https://9to5mac.com/2022/05/11/apples-csam-troubles-may-be-back-as-eu-plans-a-law-requiring-detection/ https://9to5mac.com/2022/05/11/apples-csam-troubles-may-be-b...

simonw 4y ago

I've been calling this kind of thing a "reputation attack". They come in all sorts of shapes. Here's a common one: a platform allows you to create teams and invite other users to be members of those teams. The teams that a user is a member of are shown on their profile. Someone could create a team called "Paid up members of the Nazi party" and add people as members! That's why it's crucial to have a "accept invitation" step if you build anything like this. Getting a lot of press these days is the similar thing where you can transfer an NFT to someone's wallet without their permission.

boplicity 4y ago

1. Did the DNS information transfer, or did it get reverted? In other words, could the domain still be pointing at the nefarious server? 2. Do law enforcement, as standard practice, have access to the history of domain ownership? Would they see that it was recently transferred, or not?

justin_oaks 4y ago

Being able to send people things without their approval is a problem on all sorts of things across the internet. Spam email is the most common, but the same problem exists for people sharing things in Google Drive. I had a password manager application that allowed you to share password entries to anyone else who has an account with that password manager company. The app/site actually did require you to approve the incoming entries, but didn't let you know what was in them, how many there were, etc.

skykooler 4y ago
I was wondering about this with regards to bitcoin and other crypto currencies (which also have no way to choose whether or not to receive something sent to you). Surely someone could do some crime with coins in a certain wallet, and then transfer them to you; your wallet now contains illegal money and you don't really have a way to prove that you weren't involved.
- TremendousJudge 4y ago
  Way ahead of you: it's already been done https://bitcoinist.com/hackers-are-now-trying-to-steal-crypto-via-malicious-nfts/ https://bitcoinist.com/hackers-are-now-trying-to-steal-crypt...

joshstrange 4y ago

> These days, one would hope LEA officers would at least look at who owns the domain name, but you just said that the registrar transferred it to you and changed the WHOIS data to use your full name and address. I started to write a comment about how horribly optimistic this is but then I thought about it some more. If it is indeed "Local" police you are probably screwed. They have zero understanding of the internet/tech and even people in positions with titles like "Cyber security" at your local station are probably just cops that got promoted into that role and have very little to zero understanding. Every interaction with my local cops w.r.t. technology has been painful and fruitless. Of course this assumes they would follow up on it in the first place. My LEA outright refused to lift a finger with a harassment case even when provided step by step instructions (and we knew who was behind it) on how to request information from the company the harasser was using (throwaway phone numbers). That said, maybe an instance like the author describes would get them off their butts. If it goes up to a federal level then maybe they would understand the nuance of domain transfers but not before kicking in you door.

quartz 4y ago

This is true of crypto wallets and NFTs as well. More than one project has attempted to send NFTs or assets to high profile wallets (ex: trillions of dog-coins sent to Vitalik's wallet that he ultimately donated to get rid of but not before drawing the intended media attention[1]) and the whole concept of airdrops is based around the idea of permissionless receiving. Unfortunately, re: swatting via an non-tech-savy LEA and domain registrars: you could likely just update the contact details on a domain you own to the intended target and that'd probably be enough. [1] https://www.coindesk.com/markets/2021/10/20/vitalik-buterin-sent-away-trillions-of-unwanted-dog-coins-but-more-keep-rolling-in/ https://www.coindesk.com/markets/2021/10/20/vitalik-buterin-...

jonny_eh 4y ago
Also true of text messages and email, which can include unsavory content.
- simonw 4y ago
  Text messages and email are different because they're private: if someone sends you an abusive text only you can see it. The problem with NFT wallets is that you can send someone something which will then be publicly visible and associated with them, without their consent.
  - munificent 4y ago
    > Text messages and email are different because they're private: if someone sends you an abusive text only you can see it. https://en.wikipedia.org/wiki/PRISM https://en.wikipedia.org/wiki/PRISM
    - soco 4y ago
      PRISM is not even needed, a warrant is often enough (and sometimes only pressure).
  - PaulDavisThe1st 4y ago

throwaway787544 4y ago

You don't get SWATed for owning a child porn domain. SWAT teams only break down your door if you might have a weapon and be violent with it. If the police just think you're involved in a crime, they have to get a warrant for your arrest and then knock on your door and wait "a reasonable amount of time". They're also less trigger happy if they don't suspect you of having a weapon.

munificent 4y ago
"The 2017 Wichita swatting occurred on December 28, 2017, in Wichita, Kansas, United States. The incident began as an online dispute between Casey Viner and Shane Gaskill, regarding the video game Call of Duty: WWII. During the dispute, Viner threatened to have Gaskill swatted, and Gaskill responded by giving him a false address for his residence, one that was occupied by an uninvolved person, Andrew Finch. Viner then asked Tyler Barriss to make the required fraudulent call to initiate the swatting. Wichita Police responded to the address, and as Finch was exiting his house, police officer Justin Rapp fatally shot him." https://en.wikipedia.org/wiki/2017_Wichita_swatting https://en.wikipedia.org/wiki/2017_Wichita_swatting
- throwaway787544 4y ago
  "Barriss, identifying himself as "Brian", claimed that he was at the residence at 1033 West McCormick Street, had fatally shot his father, and was holding family members at gunpoint. He asked if police were coming to the house, saying he had already poured gasoline all over the house and was threatening to set it on fire." ^ THAT is why the police shot. Not because someone had registered a domain name called "imakechildporn.com". They need a credible and imminent threat of violence. You can't just roll up on someone who might be hosting a "illegal website" and use that as a pretext to shoot first ask questions later.
  - Beltalowda 4y ago
    I'd argue that someone phoning in such an over-the-top movie scenario threat from an anonymous phone number is also not a "credible and imminent threat of violence". Definitely something that warrants investigation of course, but not something to start pulling out all the guns and start shooting people when they open the front door to see what all the ruckus is about.

abcd_f 4y ago

Tangentially related, but we stepped on a rake by forwarding spam and malware emails to abuse@outlook.com. These morons got our poor mail server blacklisted in some super-exotic way that required several days of escalations to sort out. Moreover, they did it more than once, several months apart, each time causing a week of non-deliverability problems, and it took us a damn long while to add 1 and 1 to see why it was happening. Stopped reporting the abuse to them after that and all is good now.

javajosh 4y ago

Tangentially related, now that SWAT'ing is a known-problem, is it possible to contact local law enforcement and forewarn them "Hey, I think I'm at high risk of being SWATed" such that if they receive a call they do some extra diligence to verify? (Like, for example, call you before dispatching.)

FemmeAndroid 4y ago
Yes. I'm sure it works better in some locations and worse in others, but I know at least a few people who have proactively called law enforcement agencies about being a high probability target of SWATing and related activities.

legohead 4y ago

Waiting on the day someone puts some extremely illegal content on a major blockchain...

l33t2328 4y ago
People already have. The hash lives on the blockchain, not the thing itself, so it’s a non issue.
- layer8 4y ago
  There is actual illegal content on the Bitcoin blockchain: https://www.schneier.com/blog/archives/2021/03/illegal-content-and-the-blockchain.html https://www.schneier.com/blog/archives/2021/03/illegal-conte...
- gpm 4y ago
  It shouldn't be hard to make the actual bits themselves live on the blockchain. It's trivial to make values so that their hashes have certain bits set to 0 or 1 as you chose (as long as you only use a few bits per hash)...

deleted 4y ago

[deleted]

natch 4y ago

> You could instead just tell R, but I can’t really imagine a scenario where even a great tech support person would both understand the problem and be able to get it to the right people on their legal team in an reliable fashion.” That depends…. with the right R I could see it. The tech person I interact with (rarely) at nearlyfreespeech.net deeply gets it — tech, business, legal. I doubt he’s a lawyer of course, but expect he knows when to get them involved. Probably the owner of the whole operation, if I had to guess. And yes I realize they are probably just front ending for the real registrar, but to me they are effectively the registrar; not here to argue about that.

gmiller123456 4y ago

Unless things have changed, this isn't an issue with any particular registrar, you can put anyone's contact info in for the WHOIS information. In fact, just not having your name in the WHOIS won't help with the SWAT problem. Someone could just as easily create any website and just say they are you. I haven't talked to a SWAT team member in quite a while, but I still doubt they're very adept at looking up HWOIS information. I think it'd suffice to say that if anyone creates a website that says "I am ..., this is my plan to commit some serious crime". You're probably getting a visit, rather than an assumption that it's a spoof just because the WHOIS info doesn't match.

gwern 4y ago

https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html https://www.schneier.com/blog/archives/2008/03/the_security_... 'Uncle Milton Industries has been selling ant farms to children since 1956. Some years ago, I remember opening one up with a friend. There were no actual ants included in the box. Instead, there was a card that you filled in with your address, and the company would mail you some ants. My friend expressed surprise that you could get ants sent to you in the mail. I replied: “What’s really interesting is that these people will send a tube of live ants to anyone you tell them to.”'

tomcatfish 4y ago
Since you're being modest, I'll follow with the relevant article of yours that I was going to take that quote from: https://www.gwern.net/Unseeing https://www.gwern.net/Unseeing (A collection of musings on the difference in mindset between "Moving the domain to a friend is okay" and "Wait, you can move the domain to anyone? How do you not see the issue with that?")
zeckalpha 4y ago
The postal service uses the return address in a similar way. If you don’t have a stamp, swap the return and destination addresses.
- MerelyMortal 4y ago
  If they don't recognize that the return address is in a different area than where it was dropped off, and that the destination address is in the area it was dropped off, then oh well USPS.
  - sparky_z 4y ago
    Have you never needed to mail something while you were traveling?
- gwern 4y ago
  Sounds unreliable. You ever try that?

greyface- 4y ago

This is true of real estate titles in many jurisdictions, too. You can quit claim a property to anyone without their consent, and then from that point on they are on the hook for property taxes, compliance with title covenants, etc.