4 ms·

Phone verification may have been performed using a phone number listed on the fake fax, if at all.

cosmie 13y ago
That was precisely my point, and why I'm so confused. You do not verify change requests with the change request, you verify it with details from the system of record. A classic example of this would be submitting a change of address to USPS or modifying an email address on an account. You don't verify that change with the new information, but rather by sending notification or confirmation to the previous address/email. The fact that a registrar wouldn't enforce such a process is... upsetting.
- bradleyland 13y ago
  Preface: Ah, the smell of contempt in the morning! This post turned out to be pretty contemptible/cynical, but domain registration & management is a bit of a peeve of mine. I used to run an "IT consulting" company, and have thus developed the requisite jaded viewpoint from dealing with all of those customers who don't understand/value the responsibility of domain ownership. Every day, registrars are inundated with calls from incompetent domain owners who haven't kept their domain information up to date, and have lost control of their domain in some way or another. The registrars provide a process to recover your domain name, but that process relies heavily on human judgement. I think most programmers/technologists would be horrified at just how easily the process can be gamed. I've recovered no less than 5 domain names for friends/customers over the years, and I'm always shocked at how easy it is. If you can produce believable looking letterhead, and have done at least some cursory information gathering on the company in question, you can usually game the system. The reason this giant hole exists is because of customer service incentives. A large number of domain owners aren't responsible technology people. They're mom & pops, or some middle-manager who kind-of-sort-of understands the internet. They're people wearing many hats, and have never used a program like 1Password or LastPass to keep track of their important information. To add insult to injury, these same people are bombarded with fake domain renewal letters that result in their domain being hijacked by some shady business. The registrars end up handling the backside clean up for all of these incompetencies, and customers demand it. If a domain registrar began requiring the kind of verification that we'd expect, many people would simply lose their domain names and never do business with said registrar again. The registrars know this, so they make it (too) easy to recover a domain. IMO, there are two solutions: A regulatory body steps up and says: Domain owners are responsible for keeping your domain information and security credentials current. If you lose them, you will have to successfully navigate a lengthy and expensive verification process. The process will be standardized across the industry, and non-compliance will result in heft fines for the registrar. Alternatively, the option is given to domain registrants to treat their registration with a higher level of scrutiny. A kind of "I take responsibility" flag for your domain that significantly raises the bar for recovering the domain should you lose control of it. Neither of these will happen, because there is not enough incentive. The majority of domain owners will never be targeted in the manner illustrated here, so the service is unimportant to us. There aren't enough large companies to justify offering secure domain registration as a service. The rest of the world needs the easy recovery process because they're not competent/responsible enough to maintain control of their domain name.

That was precisely my point, and why I'm so confused. You do not verify change requests with the change request, you verify it with details from the system of record. A classic example of this would be submitting a change of address to USPS or modifying an email address on an account. You don't verify that change with the new information, but rather by sending notification or confirmation to the previous address/email. The fact that a registrar wouldn't enforce such a process is... upsetting.

bradleyland 13y ago
Preface: Ah, the smell of contempt in the morning! This post turned out to be pretty contemptible/cynical, but domain registration & management is a bit of a peeve of mine. I used to run an "IT consulting" company, and have thus developed the requisite jaded viewpoint from dealing with all of those customers who don't understand/value the responsibility of domain ownership. Every day, registrars are inundated with calls from incompetent domain owners who haven't kept their domain information up to date, and have lost control of their domain in some way or another. The registrars provide a process to recover your domain name, but that process relies heavily on human judgement. I think most programmers/technologists would be horrified at just how easily the process can be gamed. I've recovered no less than 5 domain names for friends/customers over the years, and I'm always shocked at how easy it is. If you can produce believable looking letterhead, and have done at least some cursory information gathering on the company in question, you can usually game the system. The reason this giant hole exists is because of customer service incentives. A large number of domain owners aren't responsible technology people. They're mom & pops, or some middle-manager who kind-of-sort-of understands the internet. They're people wearing many hats, and have never used a program like 1Password or LastPass to keep track of their important information. To add insult to injury, these same people are bombarded with fake domain renewal letters that result in their domain being hijacked by some shady business. The registrars end up handling the backside clean up for all of these incompetencies, and customers demand it. If a domain registrar began requiring the kind of verification that we'd expect, many people would simply lose their domain names and never do business with said registrar again. The registrars know this, so they make it (too) easy to recover a domain. IMO, there are two solutions: A regulatory body steps up and says: Domain owners are responsible for keeping your domain information and security credentials current. If you lose them, you will have to successfully navigate a lengthy and expensive verification process. The process will be standardized across the industry, and non-compliance will result in heft fines for the registrar. Alternatively, the option is given to domain registrants to treat their registration with a higher level of scrutiny. A kind of "I take responsibility" flag for your domain that significantly raises the bar for recovering the domain should you lose control of it. Neither of these will happen, because there is not enough incentive. The majority of domain owners will never be targeted in the manner illustrated here, so the service is unimportant to us. There aren't enough large companies to justify offering secure domain registration as a service. The rest of the world needs the easy recovery process because they're not competent/responsible enough to maintain control of their domain name.