Slashdot Mirror
VeriSign DNS in Trouble
hesiod writes "Over at CNet News, there is an article reporting that VeriSign may lose their ability to sell domains. Evidently, ICANN is miffed because VS's WHOIS database has incorrect information. Not exactly news to most of us, but they have been given 15 days to fix the errors, or risk losing the ability to sell domains."
I wonder if this includes their right to sell SSL certificates too... it's probably an entirely different matter, but still... if they can't handle domains, why should they be able to handle SSL certificates?
Have they actually abused their power? Or is this just politics?
ideas should be free
1. Mess with WHOIS database
2. ?
3. Profit
ICANN angry at Verisign. Who's gonna get all pissy next? Satan?
Roving Web-Teleoperated Robot
Pay for my P.O. Box and I'll update my contact information. I'm not giving people my home address.
There are so many better ways to get a domain name than going torough VS. I might also mention that VS customer service is 110% worthless.
that ain't bad... give them a break...
If the IRS was this accurate then taxes would be a lot less since all those slipping through the system would be caught...
Tournament Management Online &
I wondered who that was... Anyone else get called by them?
A feeling of having made the same mistake before: Deja Foobar
Ok, everyone who has a domain registered through VeriSign, please rasie you hand ... for shame ... you are all sentenced to 100 MetaModerations a day for a month. Now get to it!
Will there be a more in depth search of the records? It seems to me that 17 records is not a lot for a major site. The address look perfectly legit - They happen to be some of the addresses I give for online forms :-)
I think the real question now is does Verisign drop the domains that don't have legit info to satisfy this complaint. It is a good resource for tracking down abusers and other complaints. I have used it a number of times to track down contact info of providers of people who have attempted to crack my system...
to VarySign?
I'm sorry, but my rebuttal is: "HAHAHAHAHAHAHAHAHAHAHAH!"
Only Seventeen?! I'd wager 15% of the domains on there are pointed to the phone number 123-456-7890 at the address of 123 Main Street. I'd call that the beginning of a pattern. Buncha jerks.
A winner is you!
They didn't abuse their power, at least that's not what has them in trouble with ICANN. They aren't doing their job, part of which is maintaining a connection between the domain name and the domain name's owner.
The abuse of their position and power is an entirely different matter, although it also is a way they are not doing their job properly. Because they haven't tracked the ownership of some domains properly, they are unable to transfer them to another domain registrar. Convenient for them because they get to keep charging the domain owner, but bad because they are getting called out by ICANN on it. Of course there is the matter of the pot (ICANN) calling the kettle black.
True, bogus WHOIS data makes it very hard to track down spamm^H^H^H^H^Htroublemakers on the 'Net, but is this really Verisign's fault?
If I register floobydust.com, and I fill in a contact email that becomes invalid three days after I go live, is that Verisign's fault? What should they do, spam everybody in their WHOIS and purge the bounces?
I can think of lots of reasons to yank Verislime's ability to sell domains, but I'm not sure this is one of them.
www.eFax.com are spammers
ok, this and adobe story are just too good to be true.
Creationists are a lot like zombies. Slow, but powerful and numerous. And they all want to eat our brains.
One of the records in question is that for dundjerski.com, in which there is false information for the Administrative Contact:
Dundjerski, Marina (MDE220)
Marina Dundjerski
000 Blank St.
No city, XX 00000
US
123-123-1234
However, on the same record, the "Registrant" field lists an address for the same name as above. If this is the worst that they can come up with, I hardly consider this a big deal.
-molo
Using your sig line to advertise for friends is lame.
Oh, wait. I know: They'll take it away from Verisign and give it to Microsoft. Okay. That makes sense. Then you'd need a Passport ID to buy a domain.
Verisign has given me about 15 days to renew my registration of domain.
Not gonna happen.
Hello gandi.net
Jesus was all right but his disciples were thick and ordinary. -John Lennon
I have been trying for 2 weeks now to get my information updated for my 1 (that's single folks) domain. I have gone the through the forms and the calls, but still no love. If it takes the threat of their removal from the Domain Name business, so be it, at least they will get on the ball and get things moving.
OAO,
VonKraken
# whois Dundjerski.com
Whois Server Version 1.3
[...]
Administrative Contact:
Dundjerski, Marina (MDE220) marina10@EARTHLINK.NET
Marina Dundjerski
000 Blank St.
No city, XX 00000
US
123-123-1234
# date ; whois Dundjerski.com | grep updated
Wed Sep 4 18:12:24 EDT 2002
Database last updated on 4-Sep-2002 18:12:24 EDT.
# date ; whois Dundjerski.com | grep updated
Wed Sep 4 18:12:25 EDT 2002
Database last updated on 4-Sep-2002 18:12:25 EDT.
# date ; whois Dundjerski.com | grep updated
Wed Sep 4 18:12:26 EDT 2002
Database last updated on 4-Sep-2002 18:12:27 EDT.
Does this mean a total of 17 records out of the 10M were bogus: not bad at all. Or does it mean 17 randomly picked records were all bogus: very, very bad.
http://www.icann.org/correspondence/touton-letter- to-beckwith-03sep02.htm
I was howling laughing reading this letter to Verisign
anime+manga together at last.. in real time.
Or did all you /.er's got too frenzied up about this article that you /.'d /. ??
The DNS operations are a completely different thing from the issuing of SSl certifications. So, there is no fear in that going away.
[ICANN Logo] Letter from Louis Touton to Bruce Beckwith Regarding Breach of VeriSign Registrar's Accreditation Agreement (Whois Data Accuracy) 3 September 2002 3 September 2002 Via FedEx, Fax, and E-mail Bruce Beckwith Network Solutions, Inc. Registrar 505 Huntmar Park Drive Herndon, VA 20170 Tel: 1-703-742-4817 Re: Notice of Breach of ICANN Registrar Accreditation Agreement Dear Bruce: This letter is a formal notice of seventeen instances of breaches of sections 3.3 and 3.7.8 of the Registrar Accreditation Agreement (RAA) that Network Solutions, Inc. Registrar (VeriSign Registrar) signed in May 2001. Under section 5.3.4 of the RAA, VeriSign Registrar has fifteen working days to cure the breaches described in this letter. If the breaches are not cured in that period, then ICANN may give notice of termination of the RAA, after which VeriSign Registrar may initiate arbitration to determine the appropriateness of termination. Under section 3.3 of the RAA, each ICANN-accredited registrar has agreed to provide free public Whois service giving information about the registrations it sponsors in the registry. Among other elements, the information must include: * The name and postal address of the Registered Name Holder; * The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the technical contact for the Registered Name; and * The name, postal address, e-mail address, voice telephone number, and (where available) fax number of the administrative contact for the Registered Name. Section 3.7.8 of the RAA sets forth the obligations of ICANN-Accredited Registrars regarding the accuracy of Whois data. It provides as follows: 3.7.8 Registrar shall abide by any specifications or policies established according to Section 4 requiring reasonable and commercially practicable (a) verification, at the time of registration, of contact information associated with a Registered Name sponsored by Registrar or (b) periodic re-verification of such information. Registrar shall, upon notification by any person of an inaccuracy in the contact information associated with a Registered Name sponsored by Registrar, take reasonable steps to investigate that claimed inaccuracy. In the event Registrar learns of inaccurate contact information associated with a Registered Name it sponsors, it shall take reasonable steps to correct that inaccuracy. This notice of breach concerns VeriSign Registrar's obligations under section 3.3, under which VeriSign agreed to provide specified Whois information for each sponsored domain name. It also concerns the second and third sentences of section 3.7.8 quoted above. In summary, in those sentences VeriSign Registrar agreed to take reasonable steps to investigate and correct its Whois data in response to any reported inaccuracy. Despite these promises, VeriSign Registrar appears frequently to publish incomplete Whois data, and to routinely ignore reports of inaccurate and incomplete contact data in its Whois database. The following are seventeen examples of VeriSign's failure to comply with its contractual obligations: 1. yorkstreethardware.com: On 21 February 2001, ICANN's Chief Registrar Liaison, Dan Halloran, sent you an e-mail pointing out that the contact details for yorkstreethardware.com were inaccurate. According to VeriSign's Whois data, the domain was registered to "Toto", residing at "the yellow brick road" in "Oz, KS 06750". (We also noted that you might want to consider whether the registrant's provision of that obviously false data constituted "willful provision of inaccurate or unreliable information," which is a breach of VeriSign's service agreement and a basis for cancellation of the registration.) On 21 May 2001, we sent you a follow-up note regarding the still-inaccurate data for this domain. Included was a link to a story in that day's NY Times in which the registrant admitted that she had registered the name with false data as a test "to see how easy it is." We asked you, some three months after the initial report, if you had indeed been able to confirm that the domain had been registered to "Toto", and if not if you could please "re-initiate the process of investigating and correcting the inaccuracy." It is now more than eighteen months after we notified you of the inaccuracy, and the domain is still registered to Toto at the yellow brick road, Oz, KS 06750. We have not even received any explanation of what specific steps VeriSign Registrar has taken to investigate and correct this situation. 2. kokorouta.net: On 15 June 2001, we forwarded a report to you indicating that VeriSign Registrar's Whois shows an apparently invalid e-mail address for the administrative contact for kokorouta.net: "no.valid.email@worldnic.com". It has been more than fifteen months since we sent the report, but the invalid e-mail address is still included in your Whois data today. And once again, we have no indication of the specific steps VeriSign Registrar took to resolve the inaccurate information. 3. dundjerski.com: On 24 January 2002, I wrote to VeriSign (Miriam Sapiro, Roger Cochetti, and Phil Sbarbaro) regarding the Whois data for dundjerski.com. A story in that morning's Los Angeles Times reported that the registrant of that domain had been told by a VeriSign representative that she could not have her personal information removed from the Whois database, but that she was given the following advice by VeriSign: "But they did tell me to just make up an address and put it in there. So that's what I did." My 24 January message to VeriSign noted that VeriSign's Whois database indicated that the mailing address for the administrative contact was "000 Blank St., No city, XX 00000" with a phone number of "123-123-1234". In that message I "strongly urge[d] VeriSign to take prompt and decisive actions to ensure that its Registrar business operates in a more responsible manner than reflected in the article, and to publicly reaffirm its commitment to accurate Whois data." You replied over a month later, on 5 March 2002, stating that VeriSign takes the subject of Whois accuracy "extremely seriously." You indicated that VeriSign was sending the registrant a letter requesting verification, and that "if no reply or update is received shortly, the domain will be deleted, in accordance with our existing procedures and contractual requirements." It has been almost six months since you wrote that, but the administrative contact address is still "000 Blank St., No city, XX 00000", and the phone number is still "123-123-1234". 4. internic-backbone.org: On 6 March 2002, we sent you a report concerning inaccurate contact data for internic-backbone.org. The data for that registration had what appeared to be an incomplete mailing address, and the telephone number for the contacts was listed only as "Restricted." We sent you reminders concerning this reported inaccuracy on 14 May 2002 and 18 June 2002. When the data still had not been corrected on 22 August 2002, we sent you (and your attorneys) a "final informal request" asking you to provide information about the status of your investigation. We finally did receive a status report on 27 August 2002, but it indicated (by copy of a letter to the registrant) that VeriSign Registrar had not even begun to take action to correct this data until 26 August 2002, nearly six months after you received the initial report. 5. sunnyside.com: On 24 April 2002, we sent you a report concerning the false telephone number for the administrative contact for sunnyside.com: "650-555-1212". We sent you a follow-up inquiry about the same problem on 14 May 2002. You wrote back on 16 May 2002 and told us to "feel assured that it is being addressed in as an expeditious manner as possible." It is now more than three months later, and the data still has not been corrected. 6. jaxx.net: On 7 May 2002, we sent you an e-mail requesting that you investigate and correct the whois data for jaxx.net. We pointed out that the administrative contact's telephone number was listed as "000-000-0000". It has been over three months since that notification, yet the false telephone number listing has not been corrected in VeriSign Registrar's Whois data, nor has VeriSign advised us what specific steps have been taken to investigate and correct the inaccuracies. 7. visosite.com: On 15 May 2002, we forwarded to you a report concerning inaccurate data for visosite.com. The report indicated that the mailing address for the registrant and contacts was inaccurate (the report included a link demonstrating that there is no "Walker Way" in Orangeburg, NY) and that the telephone number for the administrative contact was not functioning. Although over three months have passed since VeriSign Registrar received this report, it has not corrected the false data, nor has it advised us what steps have been taken to investigate and correct the situation. 8. fufus.com: On 18 May 2002, we directed to you a report concerning an invalid e-mail address in the Whois data for fufus.com: "no.valid.email@worldnic.com". On 27 May 2002, we sent you another note on this issue, including a copy of a message from a VeriSign Customer Service Representative who declined to investigate the inaccuracy - stating that "It is up to the current registrant to keep the domain information current." We asked you to carefully review this. It has been over three months, and the false data is still being published in VeriSign's Whois service. VeriSign has not stated what steps it has taken, nor given any explanation as to why its representative stated that it would not fulfill the promise it made in its registrar accreditation agreement to investigate and correct false data. 9. digeronimo.com: On 21 May 2002, we sent you a note concerning an invalid e-mail address in the Whois data for digeronimo.com: "no.valid.email@WORLDNIC.NET". Over three months have passed since that notification, yet VeriSign has not corrected the false data. Nor has VeriSign advised us what specific steps it has taken to investigate and correct the false data. 10. kasparatisco.com: On 23 May 2002, we forwarded to you a report concerning inaccurate contact details for kasparatisco.com. The report indicated that the information listed for the administrative contact was invalid - the law firm that answers at the telephone number listed for the administrative contact has never heard of the administrative contact, Sally Jocks. Although over three months have passed, this invalid data still had not been corrected as of the time of the sending of this letter. Nor have we been advised of the specific steps (if any) taken by VeriSign to investigate and correct this false data. 11. nsi-direct.com: On 13 June 2002, we sent you an e-mail asking VeriSign Registrar to correct inaccurate Whois data in the record for nsi-direct.com. The administrative contact e-mail address for that registration is still listed as "no.valid.email@WORLDNIC.NET". We sent a test message to that address last week - it bounced back with an indication that the address was not valid. Over two months after the initial report, the invalid data is still being reported in VeriSign's Whois service. 12. city-guide.com: On 18 June 2002, we forwarded to you an e-mail we had received that indicated that the telephone number for the contacts for city-guide.com ("813-562-5354") was disconnected. More than two months later, the telephone number has still not been updated VeriSign Registrar's Whois listings. Calling the listed number results in a message that "your call cannot be completed as dialed." 13. aboutsrichinmoy.com: On 10 July 2002, we sent you an e-mail reporting an inaccuracy in the Whois data for aboutsrichinmoy.com. As of today's date, over six weeks later, the registrant mailing address for that name is still listed as "1 xxx, NY, NY, 11432". We have not received any indication of the specific steps that VeriSign Registrar has taken to investigate and correct this clearly false data. 14. stepup.net: On 17 July 2002, we sent you a message indicating that VeriSign Registrar's Whois database was completely missing any data for stepup.net. As of today, the registry still reports that VeriSign Registrar sponsors this domain, but VeriSign Registrar's Whois server still reports no match. Your server still returns only the cryptic message "Domain not found locally, but Registry points back to local DB. Local Whois DB must be out of date." 15 and 16. animerica.com and japanh.com: On 19 July 2002, we sent you a report indicating that the contact details for animerica.com and japanh.com were inaccurate. The administrative contact telephone number for animerica.com was listed as all three's: "333-333-3333". The administrative contact telephone number for japanh.com was listed as all one's: "111-111-1111". The fax number was all two's: "222-222-2222". Each of these numbers (and also the phone number for the technical contact that they share) is inoperative. This data still had not been corrected as of the time this letter was being prepared - over one month later. 17. namezero.com: On 29 July 2002, we notified you that VeriSign Registrar's Whois data for namezero.com (a domain sponsored in the registry by VeriSign Registrar) was inaccurate. The phone number is listed as "111-111-1111".) We asked you to investigate and correct this inaccurate information pursuant to RAA 3.7.8. It has been over thirty days and the data still has not been corrected. As noted above, section 5.3.4 of the Registrar Accreditation Agreement agreed in May 2001 between VeriSign and ICANN provides that notice of termination of VeriSign Registrar's accreditation may be given if these breaches are not cured within fifteen working days. The pattern of neglect demonstrated by the above circumstances is troubling. In its May 2001 accreditation agreement (as well as in that agreement's predecessor), VeriSign agreed to publish complete Whois data, to undertake reasonable efforts to investigate every notification of Whois data inaccuracy it receives from any person, and to correct any inaccuracies found. The above recitation demonstrates that VeriSign Registrar has repeatedly taken what appears to be a cavalier attitude toward the promises it made. As outlined in ICANN's recent "Registrar Advisory Concerning Whois Data Accuracy" http://www.icann.org/announcements/advisory-10may0 2.htm, registrars have a vital role in maintaining the accuracy of Whois data. We believe that advisory gives valuable guidance to registrars how they can act responsibly toward the public as well as complying with their contractual obligations. VeriSign Registrar's conduct has fallen far short of both its responsibilities to the public and its agreements. We therefore provide this formal notice of breach of VeriSign Registrar's accreditation agreement with ICANN.
ICANN's goal in this matter is to promote accuracy of Whois data, which requires cooperative efforts by VeriSign Registrar in meeting its obligations. We hope that VeriSign Registrar will act promptly to cure the breaches outlined in this letter, and will become more responsive and cooperative in dealing with data inaccuracies as they are discovered. Please feel free to contact me if you have any questions.
Best regards,
Louis Touton
Vice-President and General Counsel
ICANN
cc: W.G. Champion Mitchell, Executive Vice President and General Manager, VeriSign Mass Markets Division (by e-mail)
Bobby Turnage, Esq., VeriSign, Inc. (by FedEx, fax, and e-mail)
Phil Sbarbaro, Esq., VeriSign, Inc. (by e-mail)
Stuart Lynn, President and CEO, ICANN (by e-mail)
Comments concerning the layout, construction and functionality of this site
should be sent to webmaster@icann.org.
Page Updated 16-April-2001
©2002 The Internet Corporation for Assigned Names and Numbers. All rights reserved.
The other side of the River Styx.
Did you see it? About 10 large ads on the front page for MSVS.Net. And thats not all, slashdot is offically fucked up for life. Thank you Johnkatz.
what law is it breaking to have incorrect data?
in fact, i have incorrect data because i and my wife were being stalked - and the WHOIS database is where he thought i lived. He went looking for us at the old address.
and what's the worst part of all - to have ANY level of security from a whois search that could give sickos and perverts your address is by getting a P.O. Box.. from the USPS!
Imagine, the key to internet privacy is the Postal Service. Now that's just great.
guns kill people like spoons make Rosie O'Donnell fat.
It is about .org deal .net and 5 year on .com names
- Getting rid of Verisign in the
- Getting rid of Verisign before they get the 3
year on
- Getting rid of a company that is going bankrupt
and is highly fraudulent (snapnames, bogus
invoices etc)
- ICANN itself getting out of the spotlight for
firing its At Large Directors
I have just finished a month long battle with VeriSign to get access to a domain. I would fax them an authorization letter, they would email me back saying I missed the coma on the 21st page after the statment of intent blah blah. I finally got everything to their liking but they didn't respond for a couple more weeks. So I headed over to domainmonger and did a transfer, and was up and running in a day and a half.
I can kind of understand why a larger company would like to know that someone has to jump through major hoops before someone can hijack their domain, but for me all there security was a major pain in the ass. Plus, the last time I checked, they were using some ibm ssl software that doesn't let you use mozilla to manage your account. I am going to plug domainmonger here, I have no affiliation with them, I am just a happy customer.
domainmonger.com
I have had such good luck with domainmonger, they are not a large operation, but I have never had trouble getting ahold of someone if I have had a problem.
....
posting makes you feel goooooodd.
So ICANN pulls the plug on Verisign and hands it to another company... what changes? Does this new group have some magical software that will "verify" every registry, every address, every phone number, and add security? I think not.
Sounds suspiciously like someone is willing to fork over a pile of cash to some key ICANN people in return for Verisign's business.
In other news, they (VA) are outsourcing sales offshore. CSS will be "reselling" soresforge "licenses". That is a hoot. Don't these people know the FREE code is here.
Silly Faggots, Dicks are for Chicks!
~ R.W.S. gagged
It seems ever since the nonsense with bulkregister none of the bulkregisters domains show up in netsols whois. You just get a page that says "error". Works in any other who is though.
That was a quote from a Verisign Exec. There's at least tens of thousands with bad data.
There's a whole block of Worldnic (owned by Verisign) records that down't have correct email addresses for the admin contact...
Currently you are contractually obligated to provide correct whois information by the terms of service that propagated from ICANN.
SPAMMERS usually use false domain information to hide. Maybe the spammers don't want us breaking into their houses to watch TV and use their computers? Why not, their houses are connected to public roads, so we can use them. Right???
Fight Spammers!
http://www.icann.org/correspondence/touton-letter- to-beckwith-03sep02.htm
Cites the 17 broken entries.
I'm sure ICANN can't be too happy with VS for its somewhat shady business practices recently. Is this just them using a techinicality to nibble at them (akin to tax law suits lodged against bootleggers)?
Even if the Whois information is 100% correct and you don't respond within the 15 days, it's gone. Poof.
It works something like this:
- Take out a dropped domain name registration using WLS or SnapNames.
- Complain about the Whois data for the domain you want.
- Wait 15 days
- When the domain name is dropped, the name is reregistered through WLS or SnapNames and becomes yours.
Slashdot.org will be mine. You have been warned.ICANN should not threaten to take Verisign's licence to sell domains, they should just do it. The scam they ran trying to get customers of other registrars to switch to them with bogus renewal notices should be all the impetus ICANN needs. I recieved those bogus notices for uncoveror.com, and dontbuycds.org, but godaddy.com had already warned me they were bogus.
The Uncoveror: It's the real news.
Wasn't this this the "spam" arm of NSI?
"To those who are overly cautious, everything is impossible. "
The problem isn't that Verisign has incorrect data. The problem is that they "agreed to take reasonable steps to investigate and correct its Whois data in response to any reported inaccuracy" and have not done so. It is that they KNOW they have incorrect data and haven't corrected it.
How could ICANN stop them from selling SSL certificates?
It'll be intresting to see if VeriSign can actualy fix this in the time alloted, given their amazingly shitty technical skills.
autopr0n is like, down and stuff.
that have been registered through Network Solutions/Verisign? Will these then need to be transferred to another registrar? Which Registrar? How will this new registrar be chosen? What type of disruption should we expect (other than something massive that makes our clients angry??)
Register.com for a couple, godaddy now that I managed to get my own DNS server running :P
autopr0n is like, down and stuff.
People would complain to Network Solutions about spammers having obviously bogus WHOIS information (such as phone numbers of --- --- ----), and their reply was that "WHOIS information is ot guaranteed to be accurate".
I think the response is that, if a given set of WHOIS contact information is bogus, and people complain about the bogus information, Verisign should pull the domain in question until they update the information to have legitimate contact info.
A spam-friendly domain without real WHOIS contact information should be pulled until the information is updated. People should be held more accountable for what they put up on the internet; non-bogus WHOIS contact info is a start.
- Sam (Pot. Kettle. Black. I've moved since signing up for my domains, and have not updated the WHOIS contact info)
The secret to enjoying Slashdot is to realize that it should not be taken too seriously.
On 29 July 2002, we notified you that VeriSign Registrar's Whois data for namezero.com (a domain sponsored in the registry by VeriSign Registrar) was inaccurate. The phone number is listed as "111-111-1111".)
So Verisign has false contact information for a site with whom they've worked closely for the last few years, and no one caught it and corrected it before now? Yeesh...
Want Slashdot headlines on your site? Try SlashHead
It looks to me like ignoring repeated attempts from ICANN to fix a problem is not the best business strategy.
What is amazing is not that they have incorrect data, but that after 15 months and repeated letters from ICANN about a single domain, that they still haven't done anything.
I guess if this is how they do business, its no wonder that they are rated so poorly in customer service.
Because of some major internal problems, VeriSign may lose their ability to sell domains. Evidently, ICANN is miffed because VeriSign's WHOIS database has incorrect information. That is not exactly news to most of us with a clue. I understand that they have been given 15 days to fix the errors, or risk losing the ability to sell domains. Let's see what happens.
My company had about eight domains registered through Verisign and were subjected to a few of Verisigns fraudulent business practices as well as their hideous, hideous service.
If they get punished for ANYTHING that will give me a little satisfaction. It's kind of a rarity for companies to be held responsible for being arrogant f-ups. Let's hope this gets carried through and they get the spanking they deserve.
First of all, I'd be willing to bet the numbers are rather high for fake addresses, across a good number of domain registrars besides VeriSign. There have to be some people out there creative enough to make up addresses that sound plausible... but just don't happen to belong to the person registering the data. (As opposed to 123 Main St, (123) 456-7890.)
I realize that keeping data on who domains belong to is somewhat important, but I don't see why this data has to be made available to the general public. Yes, it lets people trace the supposed owner of a domain... which can mean nothing, if the owner and the person maintaining the website aren't the same. It can also give people an avenue to harass you, especially if you happen to host any content that's in any way controversial.
Once, owning a domain was something businesses did. The average person had an email like jdoe@isp.net, and a web address that probably looked like http://www.isp.net/~jdoe. There are still plenty of those out there. There are also those of us who aren't content with the tiny amount of capability our ISP accounts come with, and so pay for third-party hosting... and a domain.
My domain holds a bunch of stuff. A forum for a hobby of mine. My public journal. Some links. Nothing out of the ordinary. I don't see why it's in any way important for other people to have easy access to my address and phone number. If the police need it, let them get it from my registrar.
I don't think there should be a blanket assumption that domains are going to belong to businesses who don't have anything to lose from their contact info being public.
Do you expect a company to keep track of the mailing addresses and names - the very IDENTITY of its clients?
I mean, are there even companies whose business is to guarantee that someone is who they say they are and that they provide accurate information?
The very idea is ludicrious!
Seriously though...why not have government controlled digital signatures? They could use the passport system (not Microsoft's...the kind you get before you go to another country) as a starting point. It seems like one of the rare chances for beneficial government interference. Sure, we'd lose a particular private sector, but it'd give lots of people the same warm, fuzzy feeling that the FDIC does.
They've already got one # to represent each person anyway.
Really looking for (negative) responses here; I can't see anything bad about this (and I'm usually against government intervention).
Mod me down and I will become more powerful than you can possibly imagine!
Flog 'em all!!!!!
ICANN meets to determine whether they can get away with charging $20 to domain name owners, and finally gets around to doing the job their supposed to do, more at 11...
The press release ICANN sent out can be found here. It looks like the article was written straight from this with a reaction from VeriSign, which just muddled the real issue.
The problem isn't that VeriSign has incorrect information in the WHOIS database, it is that it makes no effort to correct that information. They have been notified to correct several records and they haven't. And in one case, VeriSign told a registrant to put in an incorrect address.
No, they aren't breaking the law, but they are breaking their contract with ICANN and so ICANN is enforcing that contract. And this isn't a personal privacy issue; that is completely separate from VeriSign not updating WHOIS records when requested and telling customers to give false information. Please, no more pity posts for VeriSign!
I mean what use does it serve? Does a website in the virtual world need to be tied to a physical address? Sure it might be useful for someone to track down the owners of a domain name for whatever reason, but why make it necessary?
I wonder if they are established enough in the net community to fork DNS and start up their own DNS architecture.
Increase their cost from the $5.00 or so per domain, to $100.00 per two years -- make 'em feel the pain like we used to a few years back. :-)
If I register floobydust.com, and then I fill in a contact email that becomes invalid three days after I go live, is that Verisign's fault? What should they do, spam everybody in their WHOIS and purge the bounces?
I can think of lots of reasons to yank Verislime's ability to sell domains, but I'm not sure this is one of them.
What does ICANN expect VeriSign to do if it cannot get updated information?
.com that doesn't have a valid verifiable addresses? Listen to those screams from all the legitimate sites who didn't want personal information easily available to the world.
"Update the database" sounds easy enough, except that people that fill in that kind of bogus information don't want their accurate information listed and, if contact is possible, will likely give equally false information that sounds more real (i.e. 2957 Barracuda Lane). With all contact information deliberately falsified, it would be next to impossible to reach those people anyway.
Should VeriSign shut down every
I was taking one day at a time, but then several days got together and ambushed me. (from a Rhymes with Orange comic)
Uh-huh, and how many did ICANN check to get those 17? Is that 17 out of 10.3M or 17 out of 32? Verisign obviously thinks everyone is dumber than they are.
One line blog. I hear that they're called Twitters now.
17 records out of 10 million? This is ICANN "making hay" to look like they're sticking up for the little guy and a blatant public relations move after they went ahead and pushed through WLS despite an overwhelming vote against it by pretty much everyone ...except for the gTLDs (ie, .COM and .NET, which, amazingly enough, Verisign controls.).
ICANN is so in bed with Verisign it's not even funny. This is a nudge-nudge wink-wink arrangement between them so ICANN can look like they're doing their job and Verisign takes a black eye that nobody will remember in a year so that WLS happens.
Do not be fooled.
My
Limekiller
Wasn't there a case recently where an arbitrator based his decision in part on bad whois info for the domain (I believe it was a .biz so it didn't involve verisign). But this is an important reason why the whois must be accurate.
Anyway, there's a piece about how a large portion of Versign's problems are actually because of their Microsoft IIS servers.
Though not any excuse, it details how they're a little lost with the 10.7 million-entry database.
Interesting Read. Anyone else have any ideas how to deal with such a large amount of data?
What is ICANN's true motivation for this?
Read: which of their cronies are miffed that Verisign does not have this data updated properly?
We all know ICANN does not actually *care* about this.
what law is it breaking to have incorrect data?
Breach of Contract.
When a registrar signs up with ICANN, they sign a binding contract. Whether or not you agree with the contract, it is a binding contract. Below is an excerpt:
3.7.7.1 The Registered Name Holder shall provide to Registrar accurate and reliable contact details and promptly correct and update them during the term of the Registered Name registration, including: the full name, postal address, e-mail address, voice telephone number, and fax number if available of the Registered Name Holder; name of authorized person for contact purposes in the case of an Registered Name Holder that is an organization, association, or corporation; and the data elements listed in Subsections 3.3.1.2, 3.3.1.7 and 3.3.1.8.
source
Even the whois database is timing out now. I'd like to list all the whois data here in the traditional slashdot manner but I think that it may be a little too large :-)
Kevin
"It's not the cough that carries you off, it's the coffin they carry you off in" O. Nash
The problem that ICANN is opting to ignore is Verisign's blaten anti-trust policies. For example, if you have a domain registered with another registrar.. i.e. Tucows and you want to add a new DNS server to that domain and make that change at Tucows then it will take 24 to 72 hours to update at all registrars in the world, except for Verisign. They maintain the global database and it does get updated but if someone has a domain registered with Verisign it will take at least a week of harsh over the phone negotiations with them to get them to add it to thier local database. It's obviously an attempt to discredit other registrars and it's just not fair.
Nick Powers
Encryption: I may not agree with what you say, but I will defend your right to encrypt it...
So did ICANN sample 10.3M or 32 to get 17 bad ones?
One line blog. I hear that they're called Twitters now.
I'd guess far more than that. Pretty much every time I go to look up a domain, it's got bad info. Of course, the only reason I look up domains is when I'm annoyed at the spam they've left in my inbox or the attack attempts they've left in my logs.
So I dunno about the converse, but bad internet citizenship seems to be an excellent predictor of bad contact info.
"Patriotism is your conviction that this country is superior to all other countries because you were born in it." -- GBS
(I'd be more shocked if I were to learn that someone there knew the difference between good data and bad)
Eloi, Eloi, lema sabachtani?
www.fogbound.net
looks like they totally fucked up the site!
MARIJUANA, SHROOMS, X: ONLINE?! - E
Once, on some weird whim, I tracked down and contacted the person registered as owner of a spam domain. Turned out to be an elderly lady who didn't even own a computer! Obviously the real owner got her name and address out of a phone book. I reported this to the registrar, Verisign, and got back a form email about jerking domains not having any effect on spam. No comment on the fact that they had helped perpetrate a fraud!
At register.com, they let you setup billing address info for your account that they use to contact you, privately. It's SEPARATE from the information actually showing in the public WHOIS database.
View the WHOIS record for my domain, winzig.com.
Truly, this is not my contact information:
123 No Spam Ave.
No Spam, CA 90210 US
Phone: 800-555-1212
Email: spam-me-not@winzig.com
However, if I was a spammer, or breaking the law on my website, the feds could still contact me if they are able to subpoena register.com for my billing info. And register.com can still send me reminders for domain renewals, which is all I care about anyway.
It's not breaking a law. It's breaking a contract.
The agreement that ALLOWS Verisign to be a registrar requires that they provide accurate information in the whois database for all contacts.
They are required to verify said information upon registration, and to correct errors promptly when they are found.
In other words, you cannot 'anonymously' register a domain.
Privacy? If you want privacy, don't go to the trouble of having your own domain, that's pretty simple. That's like saying you want to get a business license and open a shop in your town, but you don't want anyone to know where you live or who you are.. well guess what, your business license and said filings are a matter of public record, and anyone can go see them.
This is not dissimilar.
I had the same problem getting VeriSign to change a domain host, they ignored faxes, etc. I finally got it moved, but was tired of the BS from VS. So I tried to move to a new registrar, GoDaddy to be exact, and got a "the current registrar has denied your transfer request." GoDaddy says there is nothing they can do about it and that I must take up the issue with VeriSign. I am of course seething mad. I am paid up. I am in compliance with their entire Service Agreement. The link in the Service Agreement that refers to changing registrars leads to a Procedure for changing restrants, not registrars. VeriSign ignored my first Help request. I just tried again and got the form email that says they will get back to me in 24hours. I'm hoping I don't have to send a certified letter to their legal department. Anyone have any advice out there?
Don't moderate flamebait as Troll. Know the difference or you will be Meta-moderated.
a real sign of greedy marketing: "VeriSign DNS in Trouble" ..
In the oll days (internic , networksolutions) one had to roll its own DNS servers, today by default a verisign domain can only be started using VeriSign's own DNS servers. After that a tiresome DNS server move has to be done to your own DNS servers.
It smells like most people forget that last step, and after a while verisign has overloaded DNS servers. Anyone who has info on what type DNS servers Verisign is using?
Robert
I just got a domain back NSI had been holding for 3 years. ITS MINE NOW! MINE!
this site is a testament to their quality of service.
They went through a process of changing Versign domain holders over to their new, improved system of authentication. On paper (or in my head) it was supposed to have been a question of assingning usernames and passwords and transparently changing the auth method.
What they actually DID do was rape the whole WHOIS database for lots of domains, changing zone contacts, technical contacts and in some cases administrative contacts to NO.VALID.EMAIL@blahblah, in many cases before or without EVER sending the stupid letters explaining what happened.
It was a TOTAL FUCKAROUND to get it fixed when it happened, especially when you got no information about specific domains (usernames, passwords).
I even had supervisors at Verisign tell me to make up my own letterhead and fax in changes for domains. They said all they looked for was info that looked vaguely professional. I eventually made a template in word that I faxed in when I pasted in new "logos" I ripped off from google.
They can suck it up. The WHOIS is there for a reason - you don't need to list a personal email address there but you should be obligated to have a contact address of some sort.
Jeremy
VeriSign made a data entry error and listed my nic handle, something like, SW123 as the technical contact for a porn site. The nic handle of the real technical contact for the site was something like SW1234. They just dropped the last digit. I found out about the problem when angry customers of the porn site started contacting me. A couple threatened to sue me. I contacted VeriSign and asked them to correct the error. They refused. I explained the problem, they couldn't care less. I contacted the actual web site owner, in Australia, I live in the US, he never responded.
I found that I was on many porn dealer mailing lists. I contacted VeriSign. I started getting promotional offers for disks of barn yard porn. Both VeriSign and the owner of the site refused to reply to my emails. When I called VeriSign they told me to stop bothering them. They refused to take any action.
Eventually the owner tried to change the DNS server for the site, as technical contact I blocked it. They tried again, I blocked it. They tried to change the technical contact. I let them!
I was listed as technical contact for that site for more than 4 years. VeriSign refused to do anything. I was never able to contact the actual owners of the site. I contacted VeriSign by email and by phone repeatedly. They refused to do anything.
My name and my home address are still listed in directories of porn site operators.
I would like to see the President of VeriSign draw and quartered. I hate those guys. Putting them out of business is the least that should be done to them. They are sick sick sick bastards.
Stonewolf
www.easydns.com
No bullshit, great service.
-----
PGP Key ID 0xCB8FF658
About as likely to happen as uunet kicking Ziff-Davis off for violation of their anti-spam policy when they kept sending me all the comdex crap a few years ago and I complained.
Big money/companies like this get a whole other set of rules to play by. Probably a PR step to make ICANN look like heroes.
This is ICANN doing something to help justify their existance when they normally do a whole lot of nothing. Politically, Verisign can make the appropriate changes to calm the waters, but I doubt ICANN would have the ability to enforce anything on Verisign. In a legal pissing match, Verisign has more money and probably more influence than ICANN.
In the meantime, I get "renew your licences or else" spam from the BSA and Microsoft using the information from my outdated and expired Verisign WHOIS record. Knowing this, I really wish I could unpublish my WHOIS data for my domain. Perhaps there's an appropriate need for privacy which the people behind these improperly-registered domains are fighting.
-ez
Place your banner here, just $1000.
I've been reporting some big-name spamvertized sites that hide behind phony domain registrations, and I encourage others to do so.
bukra fil mish mish
tomorrow in apricots??
Verisign has given me about 15 days to renew my registration of domain.
Not gonna happen.
Hello gandi.net
then you are too late... 30 days mininum
What IS the alternative?
/. my website..
Call me n00b, Mod me less than 0. take my little remaing Karma, just don't
"17. namezero.com: On 29 July 2002, we notified you that VeriSign Registrar's Whois data for namezero.com (a domain sponsored in the registry by VeriSign Registrar) was inaccurate. The phone number is listed as "111-111-1111".) We asked you to investigate and correct this inaccurate information pursuant to RAA 3.7.8. It has been over thirty days and the data still has not been corrected."
something's wrong when a company that actually registers domain names uses bs whois data.
the issue isn't incorrect whois data. if i register a domain and provide fake data who cares. but if i use it for email or something related to business, and the data's bogus, i've broken laws written a long time before we had dns.
It's not just that a lot of domain names seem to have incorrect data: the whole VeriSign monster is one of the worst registrars one can dream of: you need to fill in papers and wait months to change domain ownership (unless you pay, of course), but my ISP could "steal" me my domain in two days, just sending an email to VS. And what about updating nameserver data for the 3 or 4 last domains I haven't yet moved to another registrar? You can't use the old email authentication procedure because they have been migrated to the new account system. wow... but they forgot to send us passwords, so our domains are pretty stuck with their old DNS info. Unless, of course, faxing authorization requests, and waiting, and waiting.
While most other registrars let you see DNS changes in seconds...
And maybe you get half the VS' prices...
Wonder why I bookmarked the Internic Registrar Problem Reports page?
Then maybe they'll quit sending me letters saying that my 2 month old domains are going to expire (who i registered with someone) else!)
Bastards!
So, um, why do we need three distinct, publicly available methods of contact? I would have no real problem with providing my real address and phone number to a registrar if they were kept secret (Verisign's faults notwithstanding), but the rest of the world has no need for that information with the ubiquity of E-mail, and as someone else pointed out, providing your real address or phone number can lead to real-life security problems. It seems to me that keeping that information in the public database is a relic of the old days of DNS when it was actually needed, and isn't at all appropriate or desirable any more; if nothing else, it encourages the "vigilante" mindset that the Internet really needs to grow out of.
Since Verisign "stole" the domain business off NetworkSolutions, I had nothing but trouble. At my previous job, they registered one of primary DNS servers incorrectly. And because of that, we couldn't set up any of our sites to point to our it! After about 10 emails with automated responses, I gave up.
That was about 12 months ago, I'm still not sure if it has been resolved.
What RFC says that domains need valid WHOIS info? That's especially for the snail addresses and phone numbers, though I don't remember any requirement of any WHOIS info at all. Tonga (.to), for example, refuses to run a WHOIS server. ICANN isn't happy but Tonga has stood its ground. If you want the contact info for a .to domain, you have to file a subpoena for it. They consider user privacy more important than the wishes of spammers. Good on 'em, I say.
Why do you need any more "accountability" than that? If you want to take legal action against someone, you have to go to court. If you don't want to go to court, what you want the address for is extralegal action, such as spamming or stalking. There's no reason any registrar should assist in anything like that.
Solicitations for barnyard exploits, trying to "get off" porn spam lists. Uh huh, sure you weren't trying to be porn king, just some hapless user with nic id SW123 . . .
;)
I have tried for months (and months) to get the host record for nexuscomputing.com removed. I have completed all the forms, called them (been told it will be removed immediatly, that it had been given a top priority), etc. Needless to say, the host record still points to the wrong damn IP address.
I also recently transferred my wife's busybride.com domain away from them, using joker.com and Verisign is now telling me that it is up for renewal. But if you check the whois information it is obviously registered with joker.com!
(No, I didn't register it with Verisign, the previous owner did and after buying it I also discovered Verisign's other scam, holding domains hostage after a sale and refusing to transfer them for 60 days).
Feh! A pox on their house.
Remember Lexington Green!
As a sysadmin, I know how useful it is to simply look up WHOIS info to help resolve domain issues. However, I think there's lots to be said for privacy, too:
I operate a hobby domain. I have no contact info on the website. Once, someone took offense to something I said, and called me late on a Sunday night threatening legal action. I immediately nullified all my WHOIS info, except email addresses, to prevent that from happening again. From now on, if they want to complain, they can do so via email, and if things get really serious, they can find my physical address by subpoenaing the information from my ISP.
---scott
It's idiom, with a meaning kinda like "manana" (Slashdot won't let me put the tilde over that first n) in Spanish. I guess the closest English equivalent would be "someday..."
Eloi, Eloi, lema sabachtani?
www.fogbound.net
While its a good thing (better records mean a better Net), it seems to me like ICANN is trying to blow smoke up our poopers to make us think that they actually do anything worth having them around for.
That's 17 where they have repeatedly ignored complaints. Nobody is saying how many they've already corrected. Nobody is saying how many other bad records there may be, but I suspect that it's more likely to be thousands than dozens.
What you're missing is that those are records where they repeatedly ignored complaints that
the whois contact data were incorrect. The contract with ICANN doesn't require them to
verify all of the records, but it does require them to act once the errors are brought to light.