![The Internet The Internet](http://a.fsdn.com/sd/topics/internet_64.png)
![Your Rights Online Your Rights Online](http://a.fsdn.com/sd/topics/yro_64.png)
New Rules Make Domain Hijacking Easier 399
Tanktalus writes "Netcraft seems to have a little ditty about new rules from ICANN that take effect on Friday making it easier to hijack domain names. Essentially, if someone tries to take your domain, and you don't answer within 5 days, they now assume you are okay with the transfer. Previously, the default answer was no, and you had to explicitly state your acceptance of the domain transfer. Owners of small domains, beware: no more computerless vacations that last more than 4 days at a time!"
Some registrars will protect you (Score:4, Informative)
Re:Some registrars will protect you (Score:4, Insightful)
Re:Some registrars will protect you (Score:3, Interesting)
Re:Some registrars will protect you (Score:3, Interesting)
Re:Some registrars will protect you (Score:5, Informative)
Reading though this thread, I already am impressed with Joker, as they auto-locked everyone's domains, it appears. Very nice of them. I've used Verisign/Network Solutions, GoDaddy, Dotster, and one other I forget.
Network Solutions is terrible. I admit, they do have customer support, and when I call, I rarely wait more than a minute to talk to someone. That's good. But they drag their feet on anything that will cost them money or lose them money (such as trying to transfer AWAY from them). Because of their long, long agreement (that took days for me to read through properly) and because they took soooo long to automate even the simplest of changes, I just transferred my last domain away from them 2 nights ago. What a mess -- the site was down, so I called and they couldn't do a thing, so I waited for it to come back up and then unlocked the domain myself, but even though it showed unlocked, they kept rejecting my attempts to move the domain! Eventually after more calls and waiting, it finally went through. Ugh.
Dotster was fine, but I moved away from them about 2 years ago. I don't remember the major reason, but it may have been that GoDaddy was just cheaper then.
GoDaddy is similar to Dotster, but with TONS of ads. I mean, so many that it will drive you insane. However, I found the trick: I've listed all my sites privately, so my email and address never appears in a listing. Also, I have no problem saying "no thanks" to all the ads that appear when I order something. And finally, I found all the knobs and switches that disable all the marketing emails, spammy offers, and other lameness that they try to email you. After doing all this, I'm fairly happy. I never get email unless it's something official, I have low rates, and everything seems to be automated. But this solution is not for people with a low tolerance for configuring and tweaking the ads off.
For the company that I cannot remember, all I can say is: stay away from small registrars, especially ones that come with a Web hosting package. I bought a hosting package, needed a domain name, and used their little built-in registrar. What a mess. No features, and the registrar was tightly coupled with the hosting, so moving away was miserable. Stick to the known names you'll see mentioned a lot here.
Re:Some registrars will protect you (Score:2, Insightful)
Re:Some registrars will protect you (Score:5, Interesting)
I suppose my one catch is, they seem to be somewhat Euro-centric (this, of course coming from my US-centric mind), so some of my new users are confused by if they need to pay VAT, or why some of the transfer processes are bound by German (I think) telecom laws designed to protect the consumer (e.g., for one action on a domain, you used to be required to sign a form and fax it to them). It works out well, though, since they protect the user from any sort of fudgery as mentioned above.. like five day steals.
Re:Some registrars will protect you (Score:2)
I don't think they have domain locking, tho.
Re:Some registrars will protect you (Score:2)
By the way, I'm only defending them as a registrar, not as a hosting service. Somebody below claims their hosting sux. I have no idea. But you don't have to use their hosting to use them as a
Re:Some registrars will protect you (Score:2, Funny)
Re:Some registrars will protect you (Score:3, Informative)
Today, November 10th 2004, Joker.com introduces the domain lock feature as announced.
All domains will be protected through "domain lock" per default. Unlocking (and also locking, of course) can be performed in the 'service zone' as needed.
The intention for this is to improve security and simplicity for our customers.
Your team from Joker.com
Thank you!!!
Re:Some registrars will protect you (Score:2)
Re:Some registrars will protect you (Score:3, Informative)
Re:Some registrars will protect you (Score:3, Informative)
I would like to hear how other people solve the issue with the contact info on the domain records. Using fake information comes to mind but still, maybe there is a way to handle this without everyone knowing where I leave...
Re:Some registrars will protect you (Score:5, Informative)
Then, on the server side, I set each of these email address to reject all emails not from those registrars themselves. For example, the Network Solutions one reject emails without any of the following in the "From:" line:
Network Solutions
netsol.com
networksolutions.com
Veri
The GoDaddy one rejects emails without:
godaddy.com
supportwebsite.com
gandi.net
And so on. Not a single spam email has made it through my domain contact email addresses since I set this up just under two years ago, and according to my stats, around 419 per week have been blocked (just over 41,000 total messages so far). And yet at the same time, I've gotten every email message when my domains have been coming up for renewal, or when I have made changes to them. So it seems to work well.
You just need to make sure that you include all applicable domain names in the filters, because Network Solutions (for example) sends emails from several domain names.
Of course spammers could get around this by spoofing the "From" line to pretend to be from a registrar. But, in practice, I haven't seen this happen yet. Hopefully SPF [pobox.com] or some other such standard will become prevalent enough by the time that happens that it will be a non-issue.
Re:Some registrars will protect you (Score:3, Insightful)
Re:Some registrars will protect you (Score:2)
This is only for domain related issues. All other email is ignored. If you are interested in purchasing this domain PISS OFF
If you use fake info you may leave your self open to the hijack when they claim you didn't respond.
Re:Some registrars will protect you (Score:3, Funny)
Re:Some registrars will protect you (Score:3, Insightful)
Registering a domain name at the same ISP who is hosting the website, etc., is a VERY bad idea. It makes it REALLY difficult to switch to a different hosting ISP. It may be convenient to do such things for little throwaway domains like "thesmithfamily.com" but for anything important you want to use a real registrar so that you are not locked in.
Re:Some registrars will protect you (Score:5, Informative)
The first thing I heard about these new rules was in some emails from Joker the other day telling me they were locking my domains for me. As far as tech support goes, I've honestly never needed any; I can control every aspect of my domains via a reasonably well designed web interface.
Re:Some registrars will protect you (Score:2, Informative)
Maybe their web hosting service sucks, but there Domain service is pretty good.
Hmmm... (Score:5, Funny)
The question is (Score:5, Funny)
(this is meant as a lighthearted jest).
Re:The question is (Score:5, Funny)
Stories are posted only once.
simple solution (Score:4, Insightful)
Re:simple solution (Score:4, Funny)
every Tues and Fri
echo "I refuse permission to transfer domainname.com ">
if a few million domain names did likewise...
Re:simple solution (Score:5, Funny)
Lets all overwrite our sendmail daemons with one line of text. That'll show em!
Re:simple solution (Score:3, Informative)
echo "This is a test mail" |
I did:
echo "This is a test mail" >
whereupon I confidently proclaimed that all was done and so left for a well-earned long weekend. The following Monday morning was not enjoyable. At least the incident taught me several very sharp lessons which I haven't forgotten...
Re:simple solution (Score:3, Informative)
Re:simple solution (Score:3)
If you don't have time to fix it if things go wrong, don't do it.
I make sure all my techs follow this rule.
Re:simple solution (Score:4, Insightful)
Simpler solution (Score:5, Funny)
2. Ask to buy their domain
3. Wait 'till they can't answer....
4. You're done!
Re:Simpler solution (Score:4, Insightful)
Done.
Lock it to block it! (Score:4, Informative)
This advice is a bit extreme... you can rest easy so long as you turn on domain locking at your registrar. That'll default all requests for transfer to a fail until it's removed... so all you need to do is keep your password to your domain registrar accout from falling into enemy hands.
Maybe this is a good time to educate the casual website operator about the domain locking feature, and what it's useful for. The new system's assumption is if your domain is unlocked, you're sending out a signal that you're intending for a transfer to happen soon. Maybe the rules should have locking as a default-on thing, but they don't so it's buyer beware for now.
Re:Lock it to block it! (Score:5, Interesting)
Re:Lock it to block it! (Score:5, Informative)
The Fucking Article (and even more so the editorial comments here) is WRONG.
The linked Icann paper's first line is "Registered Name Holders must be able to transfer their domain name registrations between Registrars". NOTHING TO DO with transferring ownership of domains; but of the registrars. Could be nasty, and even a first step to having the domain hijacked, but the ownership of the domain is unaffected.
Small domains? (Score:2)
Size isn't everything, you know...
Re:Small domains? (Score:2)
Anyone like to guess what the conversation will be like when www.microsoft.com gets taken over by someone else? I'm guessing "Sorry guy, you shouldn't have taken that time off" won't be the end of it.
Although it'd be kind of nice to see www.georgewbush.com be taken over by someone else
Re:Small domains? (Score:2)
Re:Small domains? (Score:5, Funny)
OK, you missed my penis joke.
I did too, until I returned with a small reading light and a magnifying glass.
Re:Small domains?-Tweezer territory. (Score:2)
Re:Small domains? (Score:3, Informative)
Comment removed (Score:4, Funny)
Haha. (Score:2, Funny)
Re:w00t w00t (Score:3, Funny)
Re:w00t w00t (Score:2, Informative)
Re:w00t w00t (Score:3, Funny)
You know this is slashdot and chance of that happening is ZERO.
[for mathematicians, it is zero, not a near zero but a real zero.]
Light at the end of the Tunnel (Score:4, Insightful)
Which should be in about 7 days.
Re:Reach out and hijack someone. (Score:5, Funny)
Suppose we sent a transfer request every minute, on the minute.
If we submitted ENOUGH of them, surely they'll forget to reply to ONE of them. And we'll have the domain name, cleanly by their own policies. They'd have no means of recourse.
Re:Reach out and hijack someone. (Score:2)
Google Cache in case of Slashdotting (Score:2, Funny)
You never know who could go down...someone could steal their name!
Cache [66.102.7.104]
I read about tracking graphics (Score:2, Insightful)
If someone is unable to read the email in a way that loads the tracking image, then the server can just assume that the email was never received. Once the image has been downloaded, the request countdown can begin at T-minus 5 days.
This wouldn't even affect pico mail users because the image wouldn't load in the first place, thus the countdown would never begin. If they receive the email, they
Re:I read about tracking graphics (Score:2)
It might work. If anyone anywhere ever let their mail clients load external images for any reason at all.
Sooooo, (Score:2)
Whuhu. New busisness model.
1. Send letter
2. Wait 4 days.
3. Suck the profits out before next guy sends letter....
Re:Sooooo, (Score:2)
Nothing has changed (Score:5, Informative)
Right. Mod parent up. (Score:5, Informative)
Note that this isn't about transferring a domain from one owner to another. It's about transferring a domain from one registrar to another while keeping the same owner. Transfers of ownership come under different rules.
Re:Right. Mod parent up. (Score:2)
While you may be correct about the rules, registrars don't really have a way to tell if the request for transfer is actually coming from the owner, of if it is a transfer to a new owner, except by emailing the current owner -- in other words, practically, these rules apply to ownership chan
Quick Quick!! Someone try to transfer SCO.com... (Score:2, Insightful)
I swear to god, as soon as some huge website run by billionaires gets its domain transferred out from under them, heads will roll and this assinine "rule" will get changed.
Or perhaps someone at icann.org is asleep at the switch themselves? (hint hint)
Of course, I just doublechecked that warrenernst.com has the correct contact info. ;-)
Re:Quick Quick!! Someone try to transfer SCO.com.. (Score:2)
Just tried it using PairNIC. It didn't show up as available. Slashdot.org however is available. =)
Re:Quick Quick!! Someone try to transfer SCO.com.. (Score:2)
Joker.com auto-locked my domain (Score:5, Informative)
I had no idea about the regulations until they emailed me first. First they helped me transfer my domain away from a bad registrar, now they help me through new regulations without me lifting a finger.
Buyer beware of other services, but that's why you sign up with a reliable service with good references!
Re:Joker.com auto-locked my domain (Score:4, Insightful)
Was that your idea, or theirs? :-)
Re:Joker.com auto-locked my domain (Score:3, Interesting)
It's like a spammer saying "we will only send you e-mail you opt in for, but we'll opt you in by default, as a service".
Not all registrars are equal (Score:2, Insightful)
More importantly than the crap ICANN spews is your choice of a registrar. At least once a month, I end up in a wrestling match over a client-domain that is being held hostage by a fly-by-night, cheapie registrar. The latest happened about two weeks ago where this dumbass registrar decided to deactivate domains a month before they were set to expire if they were
microsoft (Score:2)
Hey, I think people should know when their domains are expiring; maybe somebody could make a cute 'whois' plugin for firefox that tells you when the tab's->URL's->domain expires. I can imagine some marketers monitor expiration dates, and register them the moment they expire
SPAM? (Score:5, Interesting)
Hello sirs,
Writing this letter comes at a times of great anguishes to my community. We have obtained funds in the amount of US$3,000,000 from the Nigerian government, after the passing of Prince Montebu Wilson, to whom we are the singlest heirs. However, due to political difficulties we are unable to secure the actual cash moneys ourselves. We require your assistance, for which we would thankfully provide a commission of $500,000 for your troubles. In order for this transaction to be completed, we hereby requests that your domain, www.coolinternetstuffthatisgreatandfun.com, be transferred to us immediately. Lack of action will be assumed as an affirmative response after five days.
Do YOU ever read more than a few words into those?
Makes a change (Score:5, Insightful)
Network solutions has an outdated email address listed for the admin and technical contact, and in order for you to change it the require faxed copies of a passport, credit card, finger prints, a 500ml sample of your blood and any children or pets you might have as hostages.
2 years and several attempts later and, although they occassionally manage to transfer the domain OK, the email address is still fricken wrong. These new ICANN rules could make my life much easier next time we change ISPs.
Possible motivation (Score:3, Interesting)
I'm more worried about... (Score:2)
I used to have my real name, address and phone number in my whois info. I used to get tons of junk mail, and I even had people PHONE me to ask if I'm selling my domain, and then say they don't actually want ot buy it. One time a guy called when I wasn't home, and got my ex. She wouldn't tell him where I was (duh). When he called later and got me he told me that my secretary was very rude.
I do have a real Email address in the contact, and frankly
This is actually a good thing. (Score:5, Informative)
The sign-up form very cleverly asks you for the information to transfer your domain name TO them.
When trying to renew the domain name, I was told by their employees that it is against their policy to release domain names. They let people transfer them in, but they will not release them to other registrars.
After digging a little deeper, they are a partner of Register.com. It took hours (literally) to get someone with enough authority on the phone (at register.com) to release the lock that they had on the account so a transfer would work.
Thankfully, the domain name was finally transferred and the guy at Register.com agreed that what they were doing was unethical....though that didn't stop them from making it a complete PITA.
A ditty? (Score:2)
How odd. (Score:2, Funny)
Bravo.
Re: (Score:2, Redundant)
The sky really isn't falling (Score:2, Interesting)
Original poster didn't RTFA!! (Score:5, Informative)
This is a good thing people! It helps to ensure that domain owners can transfer their registrations when they so wish. In fact, the domain owner has to first request the transfer before it even gets this far.
Sheesh.
Re:Original poster didn't RTFA!! (Score:3, Informative)
GOOD thing, not BAD thing. (Score:5, Informative)
Okay, the way a transfer was supposed to work was as follows:
The Problem
However, a number of losing registrars put in a policy some time ago that they would also seek confirmation from the domain owner, despite the gaining registrar having already done so in step 2. They would object to all transfers unless they received authorisation to their liking from the domain owner.
One registrar in particular required a copy of an Australian driving licence or passport, or a notarised letter for non-aussies. In this case it made the administrative cost of a transfer prohibitively high. The did not require this level of identification when a domain was being transferred to them. (Before you ask, yes the admin details were correct. They were just being berks.)
Invariably this policy was put in by registrars to try to prevent customers moving to other registrars, by adding additional hoops. The 'excuse' put forward was to reduce exposure to legal actions.
When one tries to cover ones ass too much, one's hands end up covered in shit.
Not all registrars did this - the nicer ones honored the word of the gaining registrar and only interfered if there were billing issues etc.
The Solution
The new ICANN rules is a compromise - it now explicitly allows the losing registrar to seek the double confirmation, but they can no longer block the move just because the customer didn't jump through enough hoops for them
It does not require the losing registrar to do so, so this is business as usual for the nice registrars.
The important point is that the gaining registrar still has to verify the transfer in the first place, as it should be. The customer confirms their identity once, and no more.
What's to stop a registrar faking authorisation? The loss of their ICANN accredidation, and hence their business.
Final point: although this is a non-story, it *is* important to make sure your admin details, especially your email address, are correct and up to date. Just as you would check your entry in the phone book, check your whois data too.
Security Risks from Bogus Whois Problem Reports (Score:5, Informative)
(a post of mine reposted from ICANNWatch http://www.icannwatch.org/ [icannwatch.org] - slashdot.org rejected it, but I'm used to that LOL!)
-----
Bogus "Whois Problem Reports" are increasingly going from being an annoyance to being a real security risk. Some recent incidents I've experienced due to Whois Problem Reports *merely* being filed:
* Dotster, about two weeks ago, threatened to delete a domain if I didn't respond.
* BulkRegister, just yesterday, threatened to suspend a domain if I didn't respond within 5 calendar days.
What good are Whois Problem Reports when anyone can file one and there is virtually no screening performed to ensure such reports have any validitity to them; reports filed on some of my domains claimed everything was wrong, including the expiration date - what!? Talk about pure nonsense!
As of now, if one wants to cause a registrant problems, all they need to do is file bogus reports at the Internic link below (it's so easy, it's frightening!) - heck, if someone really wanted to be deviant, they could spread a virus that sends bogus Whois Problem Reports from hijacked computers...
http://wdprs.internic.net/ [internic.net]
In addition, some registrars, such as GoDaddy, charge a fee to the registrant for *merely* reviewing a Whois Problem Report for a particular domain, regardless of whether the report is valid - see links below for more details:
http://www.dnforum.com/showthread.php?t=67862 [dnforum.com]
http://www.webhostingtalk.com/showthread.php?s=&t
There is much talk about the transfer policy changes and security, yet bogus Whois Problem Reports is a security risk many times worse.
Some ICANN policy changes are needed pronto regarding Whois Problem Reports...
1. Requiring more than just a name and email for people making complaints - they should have to provide a postal address that's verifyable and/or some other information.
2. Screening of such reports - permit registrars, if they're not already, to toss out Whois Problem Reports that they feel are invalid without involving the registrant; stop wasting their time over this nonsense.
3. A standard on how registrars handle Whois Problem Reports
* including a reasonable time for the registrant to respond, such as 30 calendar days, before any action is taken
Something needs to be done before bogus Whois Problem Reports get any further out of hand
Ron Bennett
Re:Security Risks from Bogus Whois Problem Reports (Score:5, Interesting)
Registrar-Lock (domain "locking") offers ZERO protection in regards to one's domain possibly being suspended / deleted due to a "Whois Problem Report" merely being filed.
cool... (Score:2, Funny)
spam (Score:2)
since most of their whois information is fake, spammers won't receive (e-)mail.
all their domain are belong to me.
after one week i change the ip-number attached to the domain to 127.0.0.1 and they're owned
Slashdot sensationalism again (Score:4, Informative)
Stupid rule if you ask me. All this does is put more pressure on Registrars to respond to frivolous requests by other (unethical) registrars phishing for business.
Feedback to ICANN? (Score:2)
ICANN seems like a big machine, run by... who knows? Who decides on these rules? Didn't they learn anything from the sex.com case? (perhaps that is too long ago and they have forgotten already) If they expect a big spike in appeals (as mentioned in the article), shouldn't that be indication enough that this rule change be reconsidered?
It doesn't make it legitimate. (Score:2)
It does help you actually if you need to move domains along swiftly.
Also many of these still use an antiquainted technology called facsimile because for some reason, this is a highly secure method of doing business, oh, and a rubber stamp helps.
If someone hijacks a domain, then it will stil be fraudulent, remember no security thorugh facsimile, I mean, obscurity.
Where does it say this? (Score:3, Interesting)
I do find language that states the transfer will be approved if the Registrar of Record does not respond within 5 days. This, however, is a Good Thing, as it makes it harder for the losing registrar to prevent you from transfering your domain. Of course, they can still just deny your request and hope they get away with it.
The way I see it, this gives domain owners (a little) more control over their domains. I don't see what's wrong with that. I never understood why transfers need to be approved by the losing registrar anyway - why would they ever approve losing a customer?
Re:Where does it say this? (Score:3, Informative)
DENIC has been doing this for a while (Score:2)
It seems that Tucows (the domain registrar) messed up by not responding to DENIC's inquiry.
http://www.heise.de/newsticker/meldung/50661 [heise.de]
Dumbest thing I heard since the election ... (Score:3, Insightful)
First, the current registrar must approve a transfer of domain without obtaining the registrant's approval. This is contrary to common sense. If the purpose is to stop registrars from unreasonably holding domain names, then the appropriate response is to require the current registrar to approve a transfer request when the registrant has approved it. If the registrant approves, and the current registrar rejects, that's an appropriate cause for complaint.
After all, isn't it more important to protect existing domains from unscrupulous transfers, than to prevent rogue registrars from accepting legitimate transfers? I may have one legitimate reason to move my domain from one registrar to another but there are a large number of scammers who would gladly capture my domain for fraud or other purposes.
It's a bit ridiculous that every registrar should be forced to implement a locking function, and every domain holder should be forced to lock every domain, all at once, in order to protect themselves from fraud.
Secondly, the "unlock" action required prior to a legitimate transfer opens a window of time in which a domain can be stolen - in programming parlance, a race condition. It's a problem with the protocol.
Just the other day I transferred several domains from Joker to GoDaddy. Joker isn't very easy to deal with, and GoDaddy is cheaper, so I decided to move the Joker ones to GoDaddy.
When I jumped through the Joker hoops to tell them that I wanted to transfer my domain name, they opened a "transfer window". I was shocked when they said that, during the transfer window, _any_ registrar could grab my domain. Not just GoDaddy. Not just me. Any user of any other registrar could have issued a transfer request for my domain name, through their registrar to Joker, and Joker would have accepted it, if the request arrived before my legitimate request from GoDaddy. Indeed, any user of GoDaddy could have done the same thing, because there's nothing in the request itself to say that it was me who instigated that request.
What happened to the good old days when a request for a transfer resulted in an email from my registrar to me, asking for my approval. If I approve, the transfer will go through. If I'm not there or indisposed, overseas or not reading my email, then the transfer will not happen.
Re:Dumbest thing I heard since the election ... (Score:3, Insightful)
I suspect that the people at Joker were trying to intimidate (or FUD) you into staying with them instead of transferring to another registrar. The protocol specifies that the gaining registrar has to get confirmation of the identity of the domain owner making the request before init
I guess the solution is obvious.... (Score:3, Funny)
If there are enough of them, then there got to be at least one which isn't answered within the 5 day timeout.
And whoever wins, wins control of the Internet! Whoot!
Get emailing, theres no bigger competition than this!
been like that in Germany for years (Score:3, Interesting)
Only on slashdot... (Score:3, Funny)
Did you see... (Score:2)
"Sit down, son. We don't read most of the bills that pass through here. Have you any idea what that would entail?"
Substitute "bills" for "articles" and you have slashdot. At least we're up to the US Congress standard
Kjella
Re:TLDs? Countries? (Score:2)
It's mine, all mine!
Re:microsoft (Score:5, Funny)
I would recommend having your lawyers ready...
12 billion in lawyers is a good start...
Transfers can be made at ANY time BEFORE expire (Score:2)
Re:5 days? (Score:4, Interesting)
I don't think for a minute that they haven't considered this - it looks like a deliberate move against people who don't want to tell the world who they are. ICANN would love to force these people to list their details.
Re:5 days? (Score:3, Insightful)
time to have someone start jacking big domains like google, microsoft, ibm, etc...
I'm thinking that getting ICANN sued into a pile of dust by some big guns would solve this problem in a hurry.
This is the Litigation Age, Let's use it to our advantage.
Re:What crap. (Score:2)
Second, this applies *only* to confirmation sought by the losing registrar.
The gaining registrar still has to seek explicit confirmation from the domain owner in the first place.