11 ms·
Hundreds of Thousands of Google Apps Domains’ Private WHOIS Leaked
- jewel 12y agoI wonder if it's time to stop requiring address and phone number information in the WHOIS information. Unless registrars are required to verify it with a confirmation letter and phone call, there isn't much guarantee that the information will be accurate anyway. The Internet isn't the nice place that it used to be, and I literally have never gotten anything but spam snail mail letters for my domains. Perhaps we could even drop the email, and suggest that every domain monitor the abuse@ domain in order to receive DMCA requests, etc. If the abuse account isn't monitored, DMCA requests can be sent to the owner of the IP address block, which seems to be a popular approach anyway. (For those who have never tried it, try doing a WHOIS on an IP address to get the WHOIS records for several layers of IP block ownership. This is a use case where contact information makes a lot more sense, as these blocks are going to be owned by businesses where there'd be no point to guarding privacy.)
- Tomdarkness 12y agoI like the approach taken by Nominet (.uk domain registry). If you are an individual and you're not trading via your website you can hide your personal details from whois. However, companies and trading individuals have to display it.
- pavel_lishin 12y agoI think most registrars offer a way to "hide" your whois data; I think the problem here is that this "hidden" data leaked anyway.
- Tomdarkness 12y agoSorry, made a typo. Nominet are not a registrar, they are the domain registry for .uk domains. Similar to how Verisign are the registry for .com domains.
- freehunter 12y agoBut if addresses were not required in whois, how would registrars sell their whois privacy plans?
- mox1 12y agoUnfortunately ICANN (acting on the wishes of Law Enforcement) enacted exactly the opposite policy in 2013, requiring verification of certain WHOIS information*. [1] https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en?routing_type=path#whois-accuracy https://www.icann.org/resources/pages/approved-with-specs-20...
- adventured 12y agoA lot of people still don't realize that not having accurate WHOIS information is a fast way to lose your domain in the case of a dispute (either with another party or the registrar).
- larrys 12y agoDepends on the registrar. As a registrar I can tell you that we would bend over backwards before allowing a domain to go this route. Also there is very little practically that prevents a registrar from putting in valid whois info (event their own info) and holding the domain on ice until the registrant shows up (if they want to for some reason that is). There is nominal carry cost vs. the aggravation of doing the wrong thing. And there are cases where no whois info at all appears and ICANN is ok with that. There is a domain that I am trying to get now for someone that is at godaddy. The registrant (fearing a UDRP) told godaddy to delete the domain. Godaddy didn't do that they removed the name from whois so "no match" appears. Not kosher but they do that and ICANN doesn't seem to mind. They will wait 30 days and then sell it to us for $24 backorder fee. To me that makes more sense time wise then taking it up with ICANN (and I have high level contacts at that organization that I can tap but for $24 why bother?) Back to the issue of invalid info. Typically the process would start with someone filing the complaint form with ICANN. Then we get notified by ICANN and get time to fix the problem. De facto, we can populate the whois with whatever we want and reply back to ICANN "problem fixed". ICANN will then reply back to the person who filed the complaint "problem fixed" (to simplify things). Can't vouch for what others may do, this is what we have seen happen.
- fapjacks 12y ago
- snowwrestler 12y agoI'm sympathetic to this point of view, but then I think: for decades the owner's name, address, and phone number for almost every house and business in America was listed in public phone books that were distributed, for free, to almost every single house and business in each respective area. Sometimes it can seem like all our privacy is disappearing, but I think it's worth remembering the how some personal data has been public for years, and things were generally ok.
- Animats 12y agoAny business with "private registration" is suspicious. As a business, you are NOT entitled to anonymity. See California Business and Professions Code section 17538[1] and the European Directive on Electronic Commerce.[2]. Even if you're operating as a sole proprietor, if you're not a scumbag, it shouldn't be a problem. If you're a company, the company's business address should be listed. There are legal ways to deal with this. There are D/B/A names and corporations. But hiding under a rock is not a valid option. I have my name and address on all my domain registrations. It's not much of a problem. I've had two threats of litigation. One is now out of business and the other backed down. I get occasional phone calls. I may be getting spam, but my spam filters are dumping it before I see it. [1] http://www.sitetruth.com/doc/californiabpcode17538.html http://www.sitetruth.com/doc/californiabpcode17538.html [2] http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32000L0031:EN:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...
- kevingadd 12y agoOne major motivation for hiding whois information is so that the internet scum brigades don't send a SWAT team to your address with a malicious 911 call. But this is mostly an issue for individuals, not businesses - so in the case of a sole proprietor, you do have a pretty good motivation to hide your mailing address and phone number even if you're doing business. Sadly this is the reality for individuals these days, until society catches up with technology - having your mailing address and phone number out and publicly accessible is actually quite dangerous.
- deleted 12y ago[deleted]
- Animats 12y agoThere are still telephone directories.
- joshu 12y agoThat is reasonable. Some people who would use that info (not lawsuits) are not, unfortunately.
- x3c 12y agoIf this happened on renewal, means the customers who explicitly asked for Privacy protection didn't receive that service. Shouldn't Google at least refund all the customers the privacy protection fee because Google failed to provide the service it charged customers for? EDIT: I understand that bugs are unavoidable but Google should be bearing the cost of its bugs. Google should volunteer the refund of $6 X 300,000 (approx. 1.8M dollars) not including negligence penalty of course.
- jhartmann 12y agoI had some domains that fell under this bug. Google has paid my registration on the domains for an additional year, more than the price of the privacy service.
- pavel_lishin 12y agoThus effectively locking you into their service for another year. "Sorry about the rat feces in your soup, here's a coupon for another free visit."
- mod 12y agoIsn't that the point of any company who goes out of their way to correct a mistake? Are you arguing you'd rather not have them attempt to fix the problem?
- fixermark 12y agoHe's arguing that customers don't have to be satisfied with letting the offending party decide what "making the victim whole" looks like. Which is true.
- tomjen3 12y agoWell the cost for the user of fixing it is to move to a new address. So google hasn't even paid 1/100 of 1 % of the true cost.
- 12y ago
- belorn 12y agoHaving whois information protected is quite less useful than the article pretend it is. Most the information is already available through much more extensive databases, and where I live, there is at least two competing online phone books that not only include name, address and phone number, and email, but also time of birth. For a service which is intended to serve those with hidden number or hidden address, 94% opt-in rate sound to dilute that purpose which makes the people in charge less careful in handling it. Might very likely even cause more leaks in the future.
- ikken 12y agoI still struggle to understand why we need to have a real address of domain's owner publicly assigned to WHOIS data. The registrar knows the owner so it is available to law enforcement if lawfully necessary. Owners can also use SSL certificate to show their address if they need to. But why force them to make it always public?
- adventured 12y agoThere is no good reason, it's a legacy system from a time when the Web was a tiny place with systems designed for academia. The real reason it still exists as is, is because the registrars make money off of an artificially manufactured benefit. They're selling air at an infinite mark-up. And they're the ones that will fight to keep the status quo. A registrar the size of GoDaddy must earn tens of millions annually in nearly pure profit off of WHOIS privacy fees.
- compbio 12y agoIt is useful to look at countries which require that you identify yourself if you want to sell stuff online. For commercial sites in Germany a "Web Imprint" (Impressum) is required by law. This "Web Imprint" has to be on a prominent, easy to reach position on the site. It lists the contact data for the owner(s) of the website. Making anonymously-run webshops against the law shields the consumer against fraud and always gives non-law enforcement a place of contact to file their complaints. Check for yourself the correlation between WHOIS protected/anonimized webshops and shady business.
- blfr 12y agoIf they already have to feature a prominent web imprint, what does anyone gain from an entry in an obscure (to most web users) whois database? An entry that the registrar will happily cover with their own info for a small fee.
- grayfox 12y agoGood thing there is an advert for Enom's ident protect right there in this press release.
- grayfox 12y agoGood thing there is an advert for Enom's ident protect right there in this press release.
- deleted 12y ago[deleted]
- scott_karana 12y agoSome regional registrars (like CIRA) only publish whois infomation for business and governmentally owned domains. Personal ones don't even list email contacts! :)
- pasbesoin 12y agoCome on, Google. Do you have no QA whatsoever? Seriously, Adam (at Google). You need to maintain some smart people who continue to monitor what your products are actually doing in production in the real world. People who can and do go beyond thinking and acting as insiders. User advocates. It's not glamourous work. But it's necessary. I can assert, through my use of a competitor's product, that I actively check that their WhoisGuard is actually in place and renewed for each of my relevant registrations. I find it difficult to imagine there's not a smart Googler, using your services for their own private endeavours, doing the same. Or are no Googler's privately using your registration services? Trust, but verify. P.S. I'll add that this is not the first time I've encountered, as an end user, a significant security concern with Google products. The previous one was fixed. And as an end-user, it was immediately obvious to me what the problem was. Though it took a bit of arguing. To be brief, in the real world, users share computers. That should not include cached access to private cloud documents. Try selling that to e.g. the government (who is a customer).
- driverdan 12y agoThe best way to protect your privacy is through multiple layers of protection. If one fails you aren't completely exposed. 1. Get a mailbox (eg UPS Store) and use that instead of your home address. This is worth the $5-15/m cost for package delivery alone. No worrying about someone stealing packages from your home while you're at work. Privacy is a bonus. 2. Use a phone service like Google Voice to protect your phone number. 3. Add WHOIS privacy on top of that if you really feel you need it. Email protection isn't really an issue. I use domains@[mydomain] and all the spam I get is filtered.
- toomuchtodo 12y agoIf you don't need package delivery, and don't care about mail showing up, use general delivery. It's free at your local post office. http://about.usps.com/news/national-releases/2012/pr12_125.htm http://about.usps.com/news/national-releases/2012/pr12_125.h... If you have been displaced and don’t have a permanent address, General Delivery service allows you to pick up your mail for up to 30 days at a designated Postal identified location in your current community. Make sure senders of your mail use the ZIP Code for the area’s designated Post Office. The ZIP+4 will indicate General Delivery. To find the Post Office that handles General Delivery in any area, call 1-800-ASK-USPS (1-800-275-8777) and request “Customer Service.” An example of a properly-formatted General Delivery address looks like this: JOHN DOE GENERAL DELIVERY ANYTOWN, NY 12345-9999 EDIT: I use it as a /dev/null physical address, as I have no need for paper mail.
- kentonv 12y agoIn an e-mail to eNom's google-clients-specific support address dated 6/18/13, I informed them that I wished to transfer a domain away from them, and I said: "PS. The reason I am transferring is because I signed up for whois protection yet my whois info has not been protected. From what I can find on the internet, this is a common problem with Google Apps, Google will not respond to support requests for free domains, and the only way I can fix it is by taking control myself. :(" Now two years later this problem is "discovered" by someone else and Google is treating it as a security disclosure? Hey Google, maybe you should have listened to the people all over your own fucking support forums that have been complaining about this for years?
- nikcub 12y agoThis was the same with Superfish. If you look at the Lenovo forums and other websites (Google search Superfish and set the time to before 2015) you'd find tons of complaints from users. In these instances it was only when somebody recognized these issues as being real security issues and repackaged them that they got the attention they deserved. It is a strange reverse problem in the security world - issues only get treated seriously when they are reported by security people through a formal vulnerability reporting and disclosure program (or informally via full-disclosure and other lists/forums). While Google and other companies take security reports through these formal channels very seriously, I doubt they have anybody dedicated to trawling through user feedback and forums and spotting anything that might be infosec related.