4 ms·

As a registrar I would like to point out that this is a good reason to not have privacy protection on your domain. It raises the chance of losing your domain g

by larrys 15y ago

As a registrar I would like to point out that this is a good reason to not have privacy protection on your domain. It raises the chance of losing your domain greatly. (Even though you can argue that having your email displayed exposes an attack vector). Public info makes it much easier to recover a domain. And proper security on the email is required as always obviously. I've helped several people recover domains by going to contacts I have at ICANN. Not having public info doesn't give me what I need to make a case. It's a non-starter many times. And it just confuses the issue for you as well when you are trying to correct things. Registrars (we don't offer privacy by the way) want privacy because it is a) something they can offer and charge for and b) allows them to lock the customer in and create a barrier to exit. c) Many of them do this by changing ownership to them for the domain and giving you a contract that you are the beneficial owner. Not good for you. You want and need to be owner according to whois. (Read this again.) If you want a private domain use a po box or a work address etc or your uncles's address. If you are a business you absolutely have no reason to have privacy (and many many businesses do because they have been sold some bullshit on this with respect to spam).

JoshTriplett 15y ago
A very good point. Personally, I use Gandi.net as my registrar, and I use their privacy protection; however, they very specifically keep my name listed as the owner, and just provide a forwarding email address and a dummy postal address and phone. Gandi mentions this ownership issue as the reason, and points out the implications of other registrars which list their own name instead.
- larrys 15y ago
  That's certainly better. And you have a somewhat unique name. But imagine your name was "John Brown". Having address data (any address data) is additional protection. And it creates an additional public paper trail. And even your name is coming up with approx. 42 potential matches (according to http://www.usa-people-search.com http://www.usa-people-search.com) Why not just use the address data you use for apters.com ?
mikeash 15y ago
Thanks for this post. I don't have privacy protection, but I have been very lax about keeping the contact info on my domains up to date. This post made me see the error of my ways, and I'm off to fix that right now.
- larrys 15y ago
  We don't do this of course but as a registrar we have literally the sole authority to cancel your domain if you have inaccurate whois data. Seriously. See section 3.7.7.2 http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3.7.7.2 http://www.icann.org/en/registrars/ra-agreement-21may09-en.h...
  - mikeash 15y ago
    Yeah, my registrar sends me yearly e-mails to tell me to make sure my info is up to date, which I then ignore. This post was what finally got me off my butt.
dissident 15y ago
Public info also makes it easier to steal a domain. Long ago, I (being childish) stole a domain from some random person who pissed me off in a video game. I spent three days calling the registrar's offices (along with a friend) over fifty times, writing the name of each service representative down so that we didn't dupe up on anyone and raise any red flags. (It was a huge registrar, though not GoDaddy.) We were able to use the public info available on their whois records to weasel our way into getting additional account information from the employees. We'd simply call and ask for a small piece of the account information in a nonchalant manner, they'd ask for info we've already obtained from previous calls, and usually they'd either give us the info or say "we don't have access to that information". The hardest part was getting the last four digits of the credit card on the account. Since we had all the rest of the user's information, we called maybe twenty times trying to get those numbers. Some employees would say they can't see them, but they could. All it took was one really stupid representative: "Yes, I'd like to confirm the credit card on my account before I file a form to retrieve my account back. I have two cards that end with the same last two digits, what are the first two digits of the last four digits" [she doesn't understand so we confuse the hell out of her for minutes on end] "uh... 2... 6." "And the last two?" "82" "Thank you, I have the right card. Good day." Had a good laugh, filed a form, emailed it in, stole their domain before they noticed, and never gave it back. I talked to the owner and eventually redirected his website back, and he forgave me. Keep your whois info private if you're on a crappy registrar. Likely, the OP uses the same password everywhere and some random kid stumbled on his godaddy account and took the domain from under his nose.
- dandelany 15y ago
  Wow. As much as I appreciate you coming forward and telling a good story about social engineering, this is really a total asshole move. I hope you look back on this experience with with no small amount of shame.

by larrys 15y ago

JoshTriplett 15y ago

A very good point. Personally, I use Gandi.net as my registrar, and I use their privacy protection; however, they very specifically keep my name listed as the owner, and just provide a forwarding email address and a dummy postal address and phone. Gandi mentions this ownership issue as the reason, and points out the implications of other registrars which list their own name instead.

larrys 15y ago
That's certainly better. And you have a somewhat unique name. But imagine your name was "John Brown". Having address data (any address data) is additional protection. And it creates an additional public paper trail. And even your name is coming up with approx. 42 potential matches (according to http://www.usa-people-search.com http://www.usa-people-search.com) Why not just use the address data you use for apters.com ?

mikeash 15y ago

Thanks for this post. I don't have privacy protection, but I have been very lax about keeping the contact info on my domains up to date. This post made me see the error of my ways, and I'm off to fix that right now.

larrys 15y ago
We don't do this of course but as a registrar we have literally the sole authority to cancel your domain if you have inaccurate whois data. Seriously. See section 3.7.7.2 http://www.icann.org/en/registrars/ra-agreement-21may09-en.htm#3.7.7.2 http://www.icann.org/en/registrars/ra-agreement-21may09-en.h...
- mikeash 15y ago
  Yeah, my registrar sends me yearly e-mails to tell me to make sure my info is up to date, which I then ignore. This post was what finally got me off my butt.

dissident 15y ago

Public info also makes it easier to steal a domain. Long ago, I (being childish) stole a domain from some random person who pissed me off in a video game. I spent three days calling the registrar's offices (along with a friend) over fifty times, writing the name of each service representative down so that we didn't dupe up on anyone and raise any red flags. (It was a huge registrar, though not GoDaddy.) We were able to use the public info available on their whois records to weasel our way into getting additional account information from the employees. We'd simply call and ask for a small piece of the account information in a nonchalant manner, they'd ask for info we've already obtained from previous calls, and usually they'd either give us the info or say "we don't have access to that information". The hardest part was getting the last four digits of the credit card on the account. Since we had all the rest of the user's information, we called maybe twenty times trying to get those numbers. Some employees would say they can't see them, but they could. All it took was one really stupid representative: "Yes, I'd like to confirm the credit card on my account before I file a form to retrieve my account back. I have two cards that end with the same last two digits, what are the first two digits of the last four digits" [she doesn't understand so we confuse the hell out of her for minutes on end] "uh... 2... 6." "And the last two?" "82" "Thank you, I have the right card. Good day." Had a good laugh, filed a form, emailed it in, stole their domain before they noticed, and never gave it back. I talked to the owner and eventually redirected his website back, and he forgave me. Keep your whois info private if you're on a crappy registrar. Likely, the OP uses the same password everywhere and some random kid stumbled on his godaddy account and took the domain from under his nose.

dandelany 15y ago
Wow. As much as I appreciate you coming forward and telling a good story about social engineering, this is really a total asshole move. I hope you look back on this experience with with no small amount of shame.