8 ms·
As Deadly as a DDoS: ICANN Unleashes the Whois Accuracy Program
- billspreston 13y agoCan this be done via a "click here to confirm" email, or does this require phone conversations with the registrar? I don't like registering domains using my real name.
- deleted 13y ago[deleted]
- ivank 13y agoI got such an email from Namecheap yesterday, and confirmed it with one click. And unlike the intended trigger for verification ("changes to contact information"), I didn't make any changes to my domain. Either a WHOIS cloak expired, or some other action by Namecheap triggered the verification step.
- Hengjie 13y agoWhat exactly is the verification step? Do they mail you a verification token? Because it sounds like you simply clicked a link to verify your address.
- ivank 13y agoYes, I just clicked a link that went to http://raa.name-services.com/raaverification/verification.aspx?VerificationCode=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX http://raa.name-services.com/raaverification/verification.as...
- gabemart 13y agoThe email Namecheap sends out is very shady looking. I had to google around quite a bit before concluding it was genuine. The verification link leads to the domain raa.name-services.com and is not delivered over https. It looks exactly like I imagine a targeted phishing email to look.
- dangrossman 13y agoThat's the same domain they use in the e-mail you get asking you to review the accuracy of your WHOIS data. They send that e-mail for every domain you own, every year, as required by ICANN. For Namecheap customers, the domain should be familiar, after the first mail at least. The subject line of those mails is: Important Notice Regarding Your Domain Name(s) The new mails have a stronger subject line: IMMEDIATE VERIFICATION required for [domain]
- talideon 13y agoIt's not Namecheap sending those out: Namecheap is simply an eNom reseller and the email you received was likely directly from eNom, with some Namecheap branding attached. *.name-services.com is used for various eNom-related stuff.
- talideon 13y agoIt can also be triggered by using the same contact with another domain being registered. Registrars aren't required to verify any existing contacts, but the moment there's an update, they have to. That said, if they want to, they can. Also, Namecheap is an eNom reseller, so you actually got that email from them, not Namecheap.
- gcv 13y agoIsn't there some rule that a domain must be registered with a real name, or it doesn't really belong to you (and all anonymization services for domains are therefore suspect)?
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- talideon 13y agoOnly if the privacy service isn't ran by the registrar the domain is managed by. You should have a read over ICANN's 2013 RAA: http://www.icann.org/en/resources/registrars/raa/approved-with-specs-27jun13-en.htm http://www.icann.org/en/resources/registrars/raa/approved-wi...
- nitrogen 13y agoCui bono?
- talideon 13y agoLaw enforcement agencies. They're the ones that asked for this nonsense.
- akerl_ 13y agoThe title is pretty much linkbait. If you change registrar-level things about your domain, they're now required to confirm your contact info with you. This isn't a "DDoS", or "deadly", or any of that nonsense: it's a new strategy to ensure whois data stays updated. Whether or not it's an effective strategy for keeping whois data accurate is another debate (I don't think it is), but talking about it like some malicious act is pointless.
- hobs 13y agoI agree that the title is linkbait, but an ineffective amount of bureaucracy can definitely be turned or perceived as malicious. I read about this originally when they made the rule and it seemed arcane and ridiculous, I dont know how it ever was passed. I believe everyone who some experience with whois info knows the information is either false or hidden behind privacy emails and contact information. If they are not, they are subject to annoying or even abusive misuse. (I remember someone back in the day calling me repeatedly because they found my website after I beat them in some video game, the internet is filled with nutters.) If ICANN wants to know the details, I dont care, but if all the internet wants my phone number, they can take a long walk off of a short pier.
- thaumaturgy 13y agoThe end of the article raised a good point though: this is going to train people to click on links in emails that look like they came from their registrar. That's bad. The registrar is public information. The registrant's contact information is public (or at least publicly accessible). So, wait a year for people to get accustomed to clicking on links in emails from their registrar, pick a target domain, forge an email from the registrar, send it to owner contact with a link to a phishing page. Congratulations, enjoy your new domain.
- derefr 13y agoThe email address doesn't seem to be the thing registrars should be "validating" about contact information, anyway. Shouldn't my registrar be calling/texting a code to the included phone number, and sending a letter with another code to the included mailing address?
- Cless 13y agoSo much linkbait on HN today.
- throwaway-icann 13y agoThis bit me kind of bad yesterday. I was about to drive out of cell range and got a text that client's site had some strange page displaying. Unfortunately, they repoint the dns servers of the domain, and the client had the contact email mx records associated with same domain. The actual site gets 'dns hikacked' by icann until you fill out a captcha on your site's new page and it emails the whois email account on record with the link. Had to log into the registrar, luckily had the client's account info, changed the email, and got it verified. That was 3am yesterday. Says it takes 24 to 48 hours to updated, but it was only like 8. Still, if you had an ecommerce site or conduct time-sensitive business via email, be careful. Because, if you do not see the email, your site will be hijacked by ICANN.
- jrockway 13y agoHow do they email you if your contact email is on the domain they just suspended? Time to set a TTL of 100 years, or something, I guess.
- cschmidt 13y agoYou should never use a contact email that is on the domain for the DNS record in question. Only bad things can result. I use my most basic fastmail.fm email for that purpose.
- jrockway 13y agogoogle.com appears to use a google.com email address in its DNS record.
- jessaustin 13y agoGoogle probably have a real live person they can call if this gets messed up, or even has the potential to get messed up a few months from now.
- deleted 13y ago
- Canada 13y agoEveryone who's already screwed themselves with domains by proxy is in for a new world of hurt.
- matznerd 13y agoWhat is wrong with domains by proxy?
- talideon 13y agoIf you're talking about the GoDaddy service, they're not. If you're talking about WHOIS privacy services in general, then possibly. If you use a registrar's WHOIS privacy service, then the registrar still has the (supposedly) correct details and are simply masking them in WHOIS. There's no issue there. However, if you're not using the registrar's own WHOIS privacy service, then yeah, you're potentially opening yourself up to a world of pain, as (a) the domain is no longer actually registered to you in a manner verifiable to the registrar and (b) you might not be able to receive important notification emails that the registrar is required to send you (such as expiry notices).
- jrockway 13y agoThis is apparently so the physical mail spammers can send me more physical mail along the lines of "This is the Domain Registry of America! Pay us $1000 to keep your domain!" Uh, no. Where's the FTC when I need it...
- EGreg 13y agoIs that what they say?
- jrockway 13y agoYes, I have gotten physical mail with exactly that pitch.
- dangrossman 13y agoHopefully not since 2003 when the FTC had a court enjoin that specific company from making misleading statements about renewals in their postal mail. The mails they send out now look like this: "As a courtesy to domain name holders, we are sending you this notification of the domain name registration that is due to expire in the next few months. When you switch to Domain Registry of America, you can take advantage of our best savings. Your registration for _______ will expire on _____. You must renew your domain to retain exclusive rights to it on the web, and now is the time to transfer and renew your domain from your current registrar to the Domain Registry of America. ... This notice is not a bill. (bold) It is rather an easy means of payment should you decide to switch your domain name registration to Domain Registry of America." Followed by the pricing table and write-in order form. Still junk mail, but not falsely representing themselves as your current registrar. I get these mails all the time too, and unfortunately I actually have to pay one of them. Some 12 years ago or so, I helped a neighbor who runs a local charity by creating a website for her annual event, pro bono. Even though she paid for the domain, the billing contact info was changed to my address (perhaps by her, when someone asked for a technical contact), and transferred to DROA. I don't live in that area anymore or have contact with this neighbor, and I'd rather not track her down with a bill nor let the domain of her charity expire, so I've been dutifully paying the marked-up DROA renewal every year.
- EGreg 13y agoOkay why are we still using a centralized domain name system with authorities? Do we enjoy the crazy keyholders from various countries meeting in secret thing? We can have many decentralized ways of registering and transferring domains. Namecoin is one, but how hard is it to decentralize the DNS database?
- nness 13y ago> but how hard is it to decentralize the DNS database Its an interesting question; how do you decide who to trust?
- adventured 13y agoTo honestly answer your question: the we you refer to isn't in control / power. The system is centralized because the control over nations is centralized. It will remain that way so long as political power remains centralized. Particularly given the immense importance of the internet economy now to most major nations. The political powers that be are not about to let go of something so important. The domain name system is a huge point of control over national and global economics. If I were a standard issue politician, I'd make you pry it from my cold dead hands.
- EGreg 13y agoWhat is to prevent an open source DNS server to be deployed all around the world by various people? And browser makers would just add it to the list of servers once it gets big enough. Until then, people could download a program or instructions that would add it, similarly to Google's DNS or OpenDNS Except it would not use the regular DNS system on the back end, but supplement it with its own rules eg not taking a domain offline when registrars do.
- vidarh 13y agoNothing except inertia. There are many alternative root operators. It's just that none of them have managed to convince enough people to use them.
- 13y ago
- kijin 13y agoHow is this different from all the other online services that require you to click a link in an email in order to verify it, and refuse to give you full membership until you do so? Some of the registrars I use have implemented this policy lately. Turns out it's a non-issue as long as your contact info is valid and up to date (which it should already be). It doesn't conflict with whois privacy, either, contrary to all the FUD that gets spread around. Any whois privacy service that is worth the cost will forward the verification request to your real email address, and if it doesn't, you should switch to a better service. Using a crappy whois privacy service with no email forwarding is a surefire way to lose your domain anyway.
- afhof 13y ago"(which it should already be)." No, why should domains be required to attached to an individual person?
- kijin 13y agoDomains are required to be attached to an email address that can actually receive emails. An email address is not an individual person.
- StuntPope 13y agoIt's different because in all other services where you are required to verify your identity, your services do not start working until you do so. This applies to domains that are already working. If you update your whois record and don't do this, it stops working. Big difference.
- Glyptodon 13y agoI still don't understand why you even need to have an 'identity' to register a domain. They should be happy with a valid email address and leave it at that.
- pjc50 13y agoTakedowns and law enforcement.
- jotm 13y agoIs this supposed to stop people from registering using fake information? That's cute. Any criminal worth their salt will forge that info (including paper scans) in a jiffy. One more inconvenience for 95% of the users.
- kolev 13y agoICANN is a mafia! They did this to actually force some old domains to get back into the market. ICANN as an organization will profit little from this, but the people bribing them (domainers, auction sites, domain escrows, etc.) will vastly profit from it. Imagine what would happen if somebody sends you a letter and they get back a letter saying that you cannot receive the letter as you didn't verify your name with USPS? It's 2014 and things like redemption period and fees are daylight legalized scams. I cannot believe that we allow ICANN to do whatever they want with us for so long!
- deleted 13y ago[deleted]
- talideon 13y agoActually, this whole this was included under pressure from law enforcement agencies (LEAs). Registrars, registries, and ICANN themselves would much prefer we stuck with the old WDRP regime where all that happens is that the registrars periodically ask that registrants verify that the information provided is correct. This new LEA-mandated nonsense is nothing but a drain on registrars (which is a business with thin margins as it is). Also, redemption isn't a scam, it's a fine to discourage people from making ridiculously late payment! You're given a 45 day window after a domain expires to pay for the renewal before the domain ends up in redemption, and registrars are required to send at least three separate reminder emails at specific intervals to tell you the domain is expiring or has expired. If you can't pay your bills within 45 days, ICANN, the registries, and the registrars aren't the problem: you're own incompetence is the problem.
- kolev 13y agoNo, ICANN is legitimized fraud. You can be 90-day overdue with utilities and you pay a relatively small fee. Phone companies don't give your phone number to your competitor or auction it. This is ridiculous! If the annual fee is $10-15, one shouldn't charge $150 a redemption (i.e. extortion fee)!
- talideon 13y ago
- axaxs 13y agoWhat is your complaint, exactly? I'd be happy to know that someone cannot transfer my domain out nor change my contact information without verification. 15 days is more than ample time, assuming I initiated the action. And what the hell does DDos have to do with any of it?
- richardjordan 13y agoThe domain name industry is a dirty scummy dishonest business. There isn't a company one can deal with that at some point won't make you feel like you're forced to work with crooks just to get an online presence.
- StuntPope 13y agoDon't tell my mom I'm a domain registrar! She thinks I'm a webmaster for a cyberporn website.
- buro9 13y agoA troll once tried to take one of my websites off-line by reporting to ICANN that the whois info was fake: http://www.icann.org/en/resources/compliance/complaints/whois/inaccuracy-form http://www.icann.org/en/resources/compliance/complaints/whoi... That was... interesting. Good timing on the troll's part as I was migrating from 123-reg to Gandi at just that moment and had to persuade both of them that I was who I said I was and that the info was correct. If I recall correctly it involved proof that there was a company behind it (company registration documents), proof that the address for the company was correct, and proof that I worked for the company and had the right to represent it. It's pretty scary to think that your domain might be pulled, and the web properties and email with it, based on a third party report. At least with this proposal a 15-day window to verify details when you change info is an expected thing. Oh, and ICANN sent the notification via the registrar to the admin email on the domain... make sure you're monitoring all of those email addresses.