13 ms·
Unfortunately, we have renewed our ICANN accreditation
- jayess 11y agoWhat a completely worthless process.
- WaxProlix 11y agoThe post sure does a lot to paint it that way; makes you wonder what, if anything, is the counterargument?
- colinbartlett 11y agoI would really like to understand their side of it, or at least better understand the bureaucratic negotiation nightmare which birthed this policy. I have to guess than ICANN is filled with some very smart people. So their must be some reasoning here.
- jszymborski 11y agoThere may be a counterargument for the reason for such a process, but the implementation is just dangerous.
- eli 11y agoI think it's easy to make an argument for having accurate whois data. But even if you believe in that goal, this is not a great way to achieve it.
- coldpie 11y agoThe only thing having accurate whois data did for me was get me junk snailmail. I don't have accurate whois data anymore.
- trombone8 11y agoTo me, one issue seems to be that ICANN dares to demand of the registrar that they must verify the contact information that is REQUIRED to be present in a registration... that's not really a sane stance to have when you sell a subscription to what is basically an identity, so lets put that aside. One other complains is that this verification procedure is really weak: "just send a mail with a link to the address provided" Imagine if ICANN changed their rules so that a more substantial verification process of the MANDATORY fields was required? Like if they didn't make it optional to verify the telephone number, what would easyDNS do then? From their post, I presume they would go insane, declare Holy war on the ICANN, and then start assaulting ICANN officers with the sharp edges of their ibook 12" They also complain that its a huge phishing opportunity because they must send mails with a link for people to click, but according to the ICANN spec they link to the actual requirement is[1]: """ [...] sending an email requiring an affirmative response through a tool-based authentication method such as providing a unique code that must be returned in a manner designated by the Registrar """ So the mails looking very phish-y is entirely their their own choice, the spec does not mandate that the title is "Look at these funny pictures, friend" or anything. Finally, they complain this will lead to a lot of big sites going down because they are forced to suspend domains if people don't take certain action within a certain time (although they don't clearly argue that the time is too short or something like that). But big sites already go down because the dns owner has been negligent with their interactions with their registrar, like failing to pay their fees for instance. So this is not a new type of problem really, you actually already have good reason to read the mail from your registrar, who knew? (Not Sony online: http://www.pcworld.com/article/2454820/sony-gaming-websites-down-over-unpaid-bills.html http://www.pcworld.com/article/2454820/sony-gaming-websites-...) [1]: https://www.icann.org/resources/pages/approved-with-specs-2013-09-17-en#whois-accuracy https://www.icann.org/resources/pages/approved-with-specs-20...
- talideon 11y agoI don't blame ICANN for this: this demand came from the law-enforcement agencies. I know that internally, ICANN would've been happy sticking with the existing WDRP process.
- 11y ago
- jtchang 11y agoI haven't used easydns yet (mostly been using namecheap) but this convinces me to give them a try.
- xianshou 11y agoThe tl;dr: Respond to an email and confirm your ownership of the domain within 15 days, or your site dies. I would discourse further on the silliness of this policy, but they stated it best: "You can thank ICANN...because if it were up to us, and you tasked us with coming up with the most idiotic, damaging, phish-friendy, disaster prone policy that accomplishes less than nothing and is utterly pointless, I question whether we would have been able to pull it off at this level. We're simply out of our league here."
- StuntPope 11y agoThe clarify - you will need to do this at key events: * New domain registration * Domain transfer * Upon receipt of an NDN (bounce) in some other mailing We'll be putting together a mini-FAQ based on questions and feedback of this.
- talideon 11y agoAlso, if you update any contacts associated with the domain.
- tc7 11y agoI think when I get one of these from my domain registered through Dreamhost, it says something to the affect of "Log in and check, if it's OK do nothing", which is much nicer than having to log in and take action (like I have to do with Godaddy). I'm basically not required to do anything. Is that an option? Seems to sidestep these rules, but these rules seem silly.
- StuntPope 11y agoYou're probably referring to what are known as "Whois Data Reminder Program" emails (WDRP), which is a few years old. Also mandatory to send those out, but can be safely ignored (which is what makes this program so much worse). Even the guy who invented WDRP later admitted it as a useless program which should die. http://www.circleid.com/posts/20120719_a_confession_about_icann_whois_data_reminder_policy/ http://www.circleid.com/posts/20120719_a_confession_about_ic... This is much much worse.
- adamcharnock 11y agoAre there any avenues open for avoiding being part of the WAP? i.e. are there any registrars the WAP will not apply to?
- kej 11y agoIt will gradually catch all registrars as they renew their ICANN accreditation.
- trombone8 11y agoIt would seem these rules apply to any registrar that gets domain names from Icann...
- talideon 11y agoRegistrars don't get domain names from ICANN. Registrars get domains from registries. ICANN is simply the regulatory body for registrars and registries. Registrars have to be accredited with ICANN before they can contract as registrars with registries.
- crististm 11y agoHow long before an DNS fork?
- talideon 11y agoIf you can think of a way to make an alternative DNS root take off, I'm all ears. If you can some up with a non-hierarchical alternative to DNS that (a) is as fast as DNS, (b) isn't prone to spoofing or squatting, (c) isn't riddled with security and trust issues, and (d) actually works, I'm also all ears. Personally, I don't think it'll happen any time soon. The only successful DNS fork is North Korea's.
- crististm 11y agoI agree. It won't happen any time soon. The way I see it, it will be sort of a revolution (or a slow change?), and the current system will become irrelevant. The only viable alternative that I see is a peer-based system based on peer trust, a departure from a centralized system. The same thing should happen also to the certificates and root-certifications where "trust" is traded now in exchange for money.
- nailer 11y agoAgreed 'click here to confirm your details on domainadmin.com' looks suspicious. Maybe EasyDNS can send their customers a 'heads up' email to let them know to expect the whois accuracy email?
- Mickydtron 11y agoPhishing training companies will actually use this tactic (they call it 'double barrel'), which makes me think that real phishers are already doing this, too. What I think would be better is an email that said to go log into your account to complete the confirmation, instead of following any link in the email itself. It's less convenient, but it's not something that phishers would tell you to do.
- nailer 11y agoSure but domainadmin.com may not have an API to make that possible (they should have one though, and if they don't it's a reasonable criticism).
- ghshephard 11y agoI have a small number of domains (about 15 at last check) - and most of them have a mailing address from 16 years ago. If all they verify is email, why does this process have any value? It's not like you can't (A) Spin up a random mail server in 30 minutes, or (B) save yourself the trouble and just use mailinator. This, finally, is the most pure form of security theater I have ever seen. There is no possible argument that this would deter any bad actor from doing bad things with their DNS domain - totally useless policy.
- derefr 11y agoThe point is to ensure they can contact you. Same reason websites have email confirm links, basically.
- Coding_Cat 11y agoYes, but the point the OP is making is that it is a worthless guarantee. You can just use a throw-away email. And given the target audience, this is should not even be considered a significant barrier.
- corin_ 11y agoI presume it's attempting (badly) to deal with website owners who aren't contactable by mistake, not those who actively wish to be uncontactable.
- lisper 11y agoDisabling their domains seems like a pretty heavy-handed way of dealing with owners who can't be contacted due to an honest mistake. I mean, geez, a false positive from a spam filter can cause you to lose your domain!
- puredemo 11y agoDomains are suspended, not deleted from the registry.
- PythonicAlpha 11y agoI also got such eMails lately and was wondering, because I could find no connection between the web-address linked to and the company I was ordering from in the first place, nor any registering authority! I also asked the company and they said that it was legit, but came from some kind of service provider. Finally, the web site, I was directed to also looked very suspicious and less than professional (something, a hacker could have made up in a weekend -- and again no names, logos or information that could make up a connection to my business contacts). I really would appreciate, when they could make the process more transparent and less phishing-prone -- so anybody could make up a nice sounding domain and fire eMails to people with domains ... Somebody could think, that domain registration authorities have at least basic knowledge of internet threats ...
- benmmurphy 11y agoWhen I registered a domain with Amazon Gandi sent me the verification email and it went to my spam folder. Luckily, Amazon sent me a follow up email saying my domain would be suspended unless I followed the instructions in the Gandi email.
- pimlottc 11y ago> Amazon Gandi For a moment there, you had me thinking that Amazon had purchased Gandi! But no, I see they are just partnering with them. Phew.
- biot 11y agoNow you just have to worry about Gandi shutting down your domain if you host anything that anyone finds morally objectionable, among other ridiculous terms they require you to agree to.
- josefresco 11y agoI get tons of these WHOIS emails as I build websites for small businesses. The last ICANN email I see regarding WHOIS data accuracy said the following (GoDaddy) "If you find that your domain contact data is current and accurate, there's no need to take action. If, however, your domain contact information is inaccurate, you must correct it." This was sent on May 5th - when does this new policy take effect or does it only effect when you renew/transfer/register? Edit: I RTFA again and see that the date is June 23rd(?)
- 300bps 11y agoThe email you received was a "friendly reminder" to make sure your registrant contact information is accurate. It is officially called a Whois Data Reminder Policy email. If it was accurate, GoDaddy is correct - there is nothing further for you to do. If, on the other hand, the email they sent you would've bounced back as undelivered then you would've ended up into the next phase. "Click this within 15 days or else."
- josefresco 11y agoOh wow, OK thanks for the tidbit - I will be in the lookout for my clients - many of whom barely know where they registered t heir domain, let alone the accuracy of their WHOIS contact data.
- Spoom 11y agoIn fact, GoDaddy in particular (used to?) charge you $25 as a penalty if they determine that your whois information is incorrect. That's the reason I took my domains elsewhere.
- crististm 11y agoLet's not forget about SOPA/PIPA/OTHER_PA which godaddy famously support.
- blfr 11y agoIt's June 23rd because that's when EasyDNS renews its accreditation. It would be different for other registrars. OVH also just sends an email that you can ignore if the information is accurate.
- javajosh 11y agoOn the bright side, this will really breath new life into the domain sniping/blackmail economy!
- trombone8 11y agoHow? By finding bugs in the interface that allows hostile users to set new values for the email address at the registrar and using this for triggering the 15 days period?
- notahacker 11y agoWhy bother with looking for interface bugs? Domain owners have been told they risk losing their website if they don't respond to requests for confirmation of the details of their domain name. So how about I send some emails asking them to urgently pop by my website, which looks very much like the registrar's website, and log in to update their details? Or if I didn't want to do anything actually illegal, I'd probably have an enhanced chance of success in pulling off the Domain Registry of America scam and convince people they must update their details [by transferring to my registrar] in the next 15 days. Seems almost certain to become the most frequent uses of the contact details ICANN has kindly ensured will be up to date and accurate.
- legohead 11y agoThey try and appear to be very open about the whole thing, but no mention as to why they need to be accredited in the first place? Can they just choose not to get the accreditation and still give out .com domains?
- realityking 11y agoICANN accreditation is a prerequisite to be a registrar for certain TLDs, including .com and all new TLDs.
- nadams 11y agoNothing stopping you (or them) from from reselling domain registration from another registrar - but being accredited gets you more features and very cheap registrations.
- antonp 11y agodisclaimer: I work on a wal-related project for a TLD Let's not throw the baby out with the bathwater. Projects like the WAL actually do help prevent the spread of malicious sites. Some TLD registries go into great length to ensure that the identity of their registrants is valid (address, phone, email). Valid whois data is a necessity when processing some of these cases (from a legal point of view). I see this in practice every day. The potential burden for the majority of domain owners (those who don't plan to do anything illegal with their little piece of internet real estate) is undeniably an issue, but projects like WAL have very real merit for the internet as a whole.
- klausjensen 11y agoBut if all it takes is an email confirmation, how on earth does this prevent bad actors from faking their data? Or use a straw-man? This looks exactly like security theater to me. Disclaimer: I may or may not have a domain registered in the name of my cat.
- astrodust 11y agoIt's true. There's honestly no way for these companies to know that "Walter P. Fluffington" isn't a real person.
- LLWM 11y agoSure there is. Outsource that verification to someone who already needs to do it, like the local government. South Korea has a pretty poor implementation of this already, but things will only get better over time.
- astrodust 11y agoDo you honestly think it's feasible to maintain a database of contacts for every country and quasi-political entity in the world? Secondly, I'm not even sure how you'd reasonably do this in a country like the United States where there's a functioning government if only because there's 50 states plus other territories to deal with. How would you go about verifying that "Walter P. Fluffington" exists and lives at some arbitrary address in Puerto Rico? It seems extremely time-consuming unless you are going to exclude people who have driver's licenses or some kind of government ID issued to them, or are foreign citizens living and working there under a visa of some sort. This also doesn't even come close to addressing what happens when you register a domain with someone else's name. The whole thing is completely pointless. If South Korea can't do it, nobody can.
- evmar 11y agoClearly you need to provide a working email address to receive the confirmation. Does anyone know the consequences of providing wrong information anywhere else?
- talideon 11y agoPotentially, you can have your registration revoked, but usually the address information isn't checked. If you don't want your information appearing in WHOIS, go with your registrar's WHOIS service, if they provide one. Don't use a third-party 'service', as you'll effectively be in breach of their TOCs (because you've provided inaccurate information to the registrar).
- bhartzer 11y agoI have no problem with the Whois Accuracy Program. Make sure you have up to date whois contact info, or use a whois privacy service if you don't want your contact info public. Should web surfers have to right to see who owns a domain (via whois) even if the domain owner doesn't publish that info on the site? Should they have the right to (try to) contact the domain owner via the whois and have a reasonable expectation that that email is going to get to the domain owner (even if they choose to ignore it)?
- Allower 11y agoThe problem is the WAP doesn't even achieve this goal, it is easily circumvented..
- duskwuff 11y agoPrecisely. The only thing it verifies the "accuracy" of is an email address, which is in no way tied to identity.
- notahacker 11y agoIf ICANN believed "web surfers have a right to see who owns the domain" it would ban DNS privacy services rather than enacting this bullshit. I actually think the rights of web surfers are far more infringed upon by being unable to access a website because the contact at the organisation that built and paid for it was on holiday or ignored an email (or possibly didn't even see it because the spam filter thought it looked like a phishing attempt) I cannot believe you are defending this. And for the record, as a domain owner I actually don't think you necessarily have a right to email me or the non-technical administrative contacts to try to sell us similar domains or persuade me to switch to your dodgy registrar. Even if I don't provide an email address there's always the option of taking it up with the registrar if there's a genuine legal issue with the domain or what it points to.
- Trombone12 11y agoI don't think there are any generic rights of a web surfer: most of the web is private property, and the rights set by some EULA. I also don't see any obvious reason for why this particular technical problem would count as violating the users rights by denying access and others would not. So for instance you can claim that broken dns records violates the users rights by denying access, but then you also must agree that a broken device driver is violating the users rights of access. Have fun with that.
- Animats 11y agoThere's a crackdown on scumbags running businesses without disclosing their identity. Great! That's illegal in many jurisdictions, including the entire EU and California. Finally, ICANN is doing its job. If you put your real name, address, phone number, and email in your domain registration, and keep it updated, there's no problem. I've had real contact info on all my domains for two decades. I get maybe one phone call a year, two or three email spams, and a letter or two. Quit whining.
- Lawtonfogle 11y agoBecause there is never ever a reason to run an anonymous business or website. Nope, we should ban things that people can abuse because freedom is secondary to security.
- Beached 11y agoWhat person in their right mind would want their real name, and contact information on a public facing database open to be queried by the entire world? The fact that I have to pay extra money to have a company "Hide" my data is ridiculous to start, I'm just shifting my trust from the entire world to a company who will sell my data or use it for their own purposes.
- thaumaturgy 11y agoHaving your personal information publicly associated with your domain registration is dangerous even if you're not running a controversial domain. There's a scumbag company out there called the "Domain Registry of America" that sends out fraudulent renewal notices to domain holders who have public information in their domain registration. If you happen to be a not-savvy domain holder, you get a letter that looks like it's for a domain renewal, you fill it out and return it with a check, and that gives DRA the authority to transfer your domain registration. And getting it back away from them is an unpleasant process at best.
- cracell 11y agoThis isn't going to stop scumbags. How would it?
- ekanes 11y agoThis is a big opportunity for registrars to make their customers feel safer: "We will go to extra lengths to make sure you don't lose your domain this way. We will pick up the phone and call you."
- astrodust 11y agoYeah, like I need my registrar calling me all the time. What if you have several hundred domains? Are you really going to call and harass me about each one?
- ekanes 11y agoSure, but you always have a few Truly Important domains, that you DO NOT want to lose. This is about those. An easy solution would be to charge you a few bucks more for domains you designate as Important.
- LLWM 11y agoNo more than they would send you several hundred separate bills. If all the domains are linked to the same account, verify the account and you're done.
- notahacker 11y ago"And in order for our thin margin business to be able to provide this new service we've opted you into, we've increased your registration fee by 50%. Don't thank us, thank the friendly folks at domain-admin@icann.org" (in all seriousness, I expect the high end registrars probably will do this. Shame they're apparently not permitted to exercise discretion and not kill your website that nobody has objected to)
- talideon 11y agoIf you don't mind being charged a fortune for your domains, given that would wipe out the thin margin domain registrars work on.
- dangrossman 11y agoCoincidentally, the service some registrars use to do the verification (wdrp.name-services.com) is down right now. How much fun must it be to watch your business taken off the 'net because you can't click a "this information is accurate" button.
- talideon 11y agoWDRP is different from the Whois Accuracy Program. All that's required there is that registrars email registrants and admin contacts a reminder showing the current WHOIS information for their domains. No confirmation is needed. The Whois Accuracy Program is different, and requires contacts actually confirm stuff.
- deleted 11y ago[deleted]
- mariuolo 11y agoIronically name-services.com uses whois protection itself.
- talideon 11y agoNo irony: the registrar has to validate the details they have on record. If you have WHOIS privacy set with the registrar, they still have your unmasked details, in which case they contact you on that address, not the one presented in WHOIS. This is part of the reason why you should use your registrar's WHOIS privacy service rather than some third-party one: by providing the registrar with incorrect details, you're in breach of terms of service ICANN requires registrars enforce.
- deleted 11y ago[deleted]
- antsar 11y agoYour expectation would be correct if GP said "downright", instead of "down right".
- eridius 11y agoI wonder if it would be worth having a way to expressly request that easyDNS (and any other domain provider following this policy) send a test email for your accounts? This would be an email that looks like the one they'd send for this program (as close as possible to ensure spam filters treat it the same) but is labelled somehow as a test. This way you can make sure that a) the email address on file works, and b) the email will make it past your spam filters.
- trombone8 11y agoWhy need it be a test? If verification just needs a click on a link it doesn't seem very onerous to require that click. If the mail doesn't arrive, you know you have a problem with a deadline NOW, instead of a randomly appearing problem in the future. The former certainly seems better.
- eridius 11y agoThe problem is you don't want to start the 15 day countdown if you have a problem receiving the email. Yes obviously you'd still have a problem because the countdown could be triggered at any time in the future, but it's still better to not trigger it immediately if you can avoid it. That said, if the test email bounces, that might be required to start the countdown anyway?
- logfromblammo 11y agoThe test e-mail is an e-mail from the registrar to the contact address, so if it bounces, the register is then required to send a real e-mail to that address, which will presumably also bounce. Then the countdown starts. I have very little expectation that the boneheads who came up with this scheme considered this possibility, and therefore exempted test e-mails from the bounce-trigger requirement. The imaginary black-hat that hangs out on my left shoulder has already suggested that spoofing a bounce message for a correctly delivered registered e-mail could be used for mischief. Phishing the domain customers is entirely too obvious for him, though the imaginary white-hat that hangs out on my right shoulder seems quite concerned about it. They both agree that black-hat wins this round.
- thaumaturgy 11y agoI've already started seeing spam and phishing attempts for official-looking-but-fake whois verification emails. It was obvious that this was going to happen when ICANN first announced this new requirement, and I'm only surprised that spammers haven't been even more on the ball about it. We haven't yet begun to see how ugly this stupid new program is going to get.
- moron4hire 11y agoWhat really sucks is that the email some hosting providers are sending out looks really super spammy. If I hadn't paid very close attention and Googled the issue, I would have trashed it. At least in DreamHost's case, they look like phishing emails and the links go to a non-DreamHost domain. But if you dig into the DreamHost support forums enough, you'll find confirmation from a developer there that it is legit. And that's all you'll find. So who knows. It's a pain in the ass.
- higherpurpose 11y agoCan we kill the DNS system already and move to something more decentralized?
- forgottenpass 11y agoIt is decentralized, you can spin up an alternate root right now. The problem has been, and always will be namespace coordination. You can argue that ICANN could have done better. And part of me still cares, but of course ICANN fucked up the existing root. In the current business and legal climate, it's basically a foregone conclusion.
- yellowapple 11y agoThat's not decentralization; that's just moving the single-point-of-failure. A better system would be something based on a cryptographic blockchain/ledger, like Namecoin. Thus, no reliance on a central authority to decide which domains are or aren't valid; you instead just look at the ledger (which is maintained decentrally by network participants).
- jsmthrowaway 11y agoWe can't even deploy IPv6. What's your plan for getting your system deployed in every Internet connected device, including ancient routers without cryptography chops and refrigerators, then transferring the multiple billions spent on the current namespace into your system without conflict?
- lucb1e 11y ago> We can't even deploy IPv6 Actually, all my traffic is v6 by default using Telenet (Belgium) and XS4ALL (the Netherlands). And yes, those are mainstream ISPs. Lots of services, most noticeably Google and thus Youtube, use it by default as well. We're nowhere near 100% yet, but as the need increases we are getting there.
- 11y ago
- talideon 11y agoThe whois accuracy program is such an enormous pain in the arse. It's worthless junk law-enforcement agencies demanded be included in the 2013 RAA that will have no useful impact on anything. It's just a massive resource drain on registrars.
- jacquesm 11y ago> It's just a massive resource drain on registrars. And on their customers.
- talideon 11y agoYup, but for customers, it's just a periodic annoyance. For registrar, it's a constant support overhead. I expect domain pricing to increase as more registrars have to move over to the 2013 RAA. Nobody's happy with this crap.
- Glyptodon 11y agoI still have a really hard time with the idea that a domain needs to have "valid" or "meaningful" whois data at all... ...and now there's this? Sounds like a fishing windfall.
- krisdol 11y agoI wouldn't have a problem with it if the data weren't so easily to crawl and parse by spam-bots and robo-callers. Ever since switching away from an whois-anonymization service for one of my domains, the amount of spam letters, emails, and robocalls from telemarketers I get has increased more than ten-fold. For some reason people assume that these whois-anonymization tools are just used by squatters and spam websites, but I use it to someone overloading my physical/digital/voice mailbox.
- chetangole 11y agoGoDaddy already follows this!
- higherpurpose 11y agoInteresting: http://www.theregister.co.uk/2015/05/21/icann_ceo_quits/ http://www.theregister.co.uk/2015/05/21/icann_ceo_quits/
- talideon 11y agoFadi quitting has nothing to do with this. The 2013 RAA was done and dusted before he even started.
- cyphunk 11y agoCan we just agree that either now or in the near future the idea of thought or expression without attribution is a thing of the past. Something that our grandparents internet had but not for us. This slow crawl of both policy and protocol toward greater bureaucracy will have a much more permanent effect than say the NSA/GCHQ spying.
- deleted 11y ago[deleted]
- return0 11y agonot really. Although generic internet users keep making the internet a "safer space" , there will be a critical point when a fork will occur for those who still think the internet can be interesting.
- nrivadeneira 11y agoReddit can be seen almost as an anonymous fork to some degree. Obviously it doesn't share the same network concepts, but the spirit of anonymous information sharing is there.
- lmm 11y agoReddit has already started closing its most controversial subreddits. Expect it to continue to "clean up" as it grows. It's a business after all.
- natrius 11y agohttp://ipfs.io/ http://ipfs.io/ The web is being decentralized. Pseudonymous expression will not die. It will flourish.
- junto 11y agoSomebody needs to create a service which does the following: - gives you an email address for the whois as a proxy - automatically follows the link given in the email and clicks the stupid button - waits for the confirmation email - if after 48 hours you haven't received confirmation then the system escalates it to a human proxy to click the stupid button (Turk maybe) Reminds me of Lost
- talideon 11y agoThat's fine until they go rogue and use that to seize your domain as you've effectively established them as a contact. Then you're screwed.
- fweespeech 11y agoThat is true for all the whois protection services. You have no recourse if the registrar takes the domain.
- talideon 11y agoIf your domain is with a scummy registrar, then you're screwed regardless. It has nothing to do with WHOIS privacy.
- talideon 11y agoBTW, you shouldn't use a third-party WHOIS privacy service. That puts you in breach of ICANN-mandated T&Cs as you've effectively provided bogus contact information to the registrar.
- bhartzer 11y agoRegistrars deal with this in a few different ways, I believe some will allow you to confirm only one email address if there are multiple domains in your account.
- hyperliner 11y agoLet me upgrade that service: - Generates real-looking names - Generates a "social live" across the internet, with pictures, Linkedin profiles, and "friends" - Generates "obviously valid" email addresses - Provides an email forwarding service to your real address as above - Provides a "Post office box" pseudo-service so that you can add that as your "real address" - Generates extensions for a (800) we all can use to as to protect our real phone numbers - Signs up to your registrar's information and updates it You just got yourself a "valid" info set in the eyes of ICAAN (without having to pay anon services).
- xenophonf 11y agoPhishing attempts using "Click this link to verify your Whois data" in 3... 2... 1...
- bikeshack 11y agoRather than be harassed by ICANN emails it would be preferable for EasyDNS to handle any admin issues on a case by case basis. That should, after all, be included in the cost of buying a domain. I always made sure my registrars were handling this on my behalf, and for domains where I was required to submit personally identifiable information; I let the domain expire and die. It's not worth the hassle. I don't work for free.
- talideon 11y agoThey can't. They're contractually required to contact you about this stuff.
- return0 11y agoI dont even understand how ICANN can make that decision which has very dubious benefits. The equivalent would be to require all newspapers to disclose the real name, telephone email and address of everyone who writes an article or puts an advertisement in their pages. I might even get it if ICANN required a private registry with these data; But the useless whois database only serves as a goldmine for spammers that want me to renew my domains for $1000. this is illogical and i m at a loss
- deleted 11y ago[deleted]
- talideon 11y agoOh, and one other thing: while other registrars tried to resist stuff like this being added to the 2013 RAA, EasyDNS were one of the registrars that sat on the sideline and did nothing. Let's just say I don't have too much time for their moaning and griping now. They should've engaged with the registrar constituency back when the negotiations were happening.
- StuntPope 11y agoWe're in the RRSG now, we joined last year (better late than never) - that said - speaking as somebody who has been on the CIRA board and involved in early ICANN Whois TF, there isn't a lot that can be done about it. Registrars are pretty much a captive audience with zero power wrt ICANN and governance in general.
- talideon 11y agoAs individuals, yeah, but I know plenty of what goes on behind the scenes, and what goes on in the mailing lists is only a fraction of the story. A savvy registrar can have plenty of soft power if they know what they're doing. BTW, you should get involved in the IETF provreg and eppext WGs: we need a stronger registrar voice there, and the more registrars involved, the better.
- StuntPope 11y agoTime constrained lately but happy to look at it, shoot me an email ( pretty easy to find it )
- deleted 11y ago[deleted]
- evantahler 11y agoInvalid link?
- stormbrew 11y agoYou know what would make whois data more accurate? Requiring that registrars provide basic anonymization without any extra fee and build a meaningful process for situations where breaking that anonymization is actually the right thing to do (ie. not an opportunity for collection of bulk mailing address and phone number lists for spammers and phishers). It would cost the registrars something to do so, obviously, but so does this. And a basic level of privacy should never have been allowed to become a premium service to begin with.
- hackerboos 11y agoNominet (UK domain regulator) allows you to hide most contact info, even email address.
- leap_ahead 11y agoAgreed. The mere idea of having to globally expose your personal details is idiotic. Or at least it belongs to a more civilized society we're not seeing a glimpse of yet.
- azernik 11y agoNot a more civilized society. Just a time when the number of people with access to the internet (and thus the whois database) numbered in the hundreds and not the billions.
- hueving 11y agoBillions accessing it now hasn't changed the fact that the basic requirement is to fill out the whois data.
- leap_ahead 11y agoIt's not about the numbers. It's about people. Right now not a single individual can be trusted not to misuse somebody's personal details, through malice or negligence, and not create a severe risk for the owner. Being one in a narrow selection of computer professionals doesn't help much. One can be a genius and a person of low ethical standards at the same time. No solution until the civilization progresses much further than what we have now. Until then, lock down the Whois database. Even better, discontinue it altogether. Let individual registrars hold the personal details of their customers. At least it will remove the risk of compromising everyone's privacy with one action by not putting all eggs in one basket.
- leap_ahead 11y agoSo if one wanted to knock over a competitor's business, it would only take to arrange for the owner to be unavailable for a couple of weeks, send this email, wait for the deadline, grab the domain. Profit. What happens if you become sick or get in an accident and must go to a hospital? Game over?
- hurin 11y agoCan't we just get Namecoin or another blockchain based service supported in major browsers, so ICANN is no longer a sole monopolist?
- DanHulton 11y agoI literally got hit with this the other day and set it to my registrar as an obvious example of cheap bullshit fishery. Imagine my surprise when they wrote back, telling me it was legit. What an awful, awful program.
- harry8 11y agoPlease don't overlook that ICANN is regulatory capture. The idea you need to pay more than 2c/year for an entry in a goddamnn database and you have to pay a designated intermediary to make that request is, well, lucrative for the intermediaries because there's this massive barrier to entry to setting up in competition with the intermediaries. Does it look the same as "a seat on the exchange" in the financial world - trade on an exchange, you and your counterparty both get skimmed by a "broker" as well as by the exchange. Anything to make something as simple as putting a tiny entry into a database more of a pain and hassle justifies the ridiculous fees. The worse they do it the better it works for them. Incentive, yeah, let's make sure this screws up and looks like phishing, then they'll really need us and we can claim to be the good guys with utterly ignorant law enforcement who don't understand what they're asking for being the bad guys. If this cost the intermediaries money rather than being something that will turn out to be lucrative for the industry as a whole, you'd have a very different result. Now watch the downvotes and screams from the intermediaries and their apologists. Hi, enjoy your money!
- rtpg 11y agoThere's reasons for charging $10 per domain other than the cost of the DB line One thing I can think of off the top of my head is that it makes domain squatting a bit more expensive. $10 instead of 2c is 500 times less domains for the same amount of money. At the same time, $10/year is a reasonable entry price for "I'm seriously considering using this domain" Domain names are a scarce resource, it makes sense to charge a good amount of money for them
- harry8 11y agoOn that basis, I and I alone should have the monopoly and should give as much to icann as I deem appropriate. It's as good as the current system for your argument. If you want to make the argument of the necessity of a tax who gets it? Those who were on it early enough to capture the regulator. Interestingly on a philosophical level both republicans and democrats claim to hate regulatory capture. Republicans would want to open ICANN and it's intermediaries up for competition, democrats would prefer to nationalise the lot, yes I know, that's just the ideology not the behaviour of elected official much of late.
- BinaryIdiot 11y agoI had to do this back when I used GoDaddy just a few months back. I was able to verify all of my domains but one. For whatever reason I'd click on the link in the email, go to the page, verify it then get another email a few days later since I didn't verify it. Fortunately it was a domain I was going to let lapse so I didn't bother trying to deal with their support but I swear I verified it 3 different times and never once did it say it successfully went through. Very frustrating experience.
- allochthon 11y agoI have a domain registered under my real name and personal email address. Coming away from the article, my understanding is that my domain is liable to sniping if I step away from the Internet for more than two weeks (e.g., I go on a trek into the jungle somewhere) and don't take steps to have a friend or colleague keep tabs on the issue. This seems like a straightforward and obviously undesirable scenario; I wonder what came up in the ICANN consultation when it was discussed.
- Rifu 11y agoI believe the two week timer only starts if you initiate a domain transfer, modify your domain's WHOIS info, or have a renewal notice bounce. 2/3 of this are forces that are within your control, so you can at least plan around that.
- RobAley 11y agoFurther, I beleive that if it does happen, your domain is just suspended, i.e. set to not resolve, and isn't available for anyone else to register/snipe.
- deleted 11y ago[deleted]
- troyjfarrell 11y agoIs there a reason registrars aren't cryptographically signing these messages? That would give everyone a relatively simple way to verify that they aren't forged. I get that not everyone who will receive these messages are technical enough to figure out PGP or S/MIME, but it would be trivial for Gmail, Outlook.com, Yahoo Mail, etc. to put a pretty seal on these signed messages.