Slashdot Mirror
New Rules Make Domain Hijacking Easier
Tanktalus writes "Netcraft seems to have a little ditty about new rules from ICANN that take effect on Friday making it easier to hijack domain names. Essentially, if someone tries to take your domain, and you don't answer within 5 days, they now assume you are okay with the transfer. Previously, the default answer was no, and you had to explicitly state your acceptance of the domain transfer. Owners of small domains, beware: no more computerless vacations that last more than 4 days at a time!"
*waits for the slashdot editors to take a week's vacation*
Nothing has changed really. This has ALWAYS been the way the system ran, only some registrars choose to ignore it, and setup abusive transfer blocking mechanisms, and called them "Safety" measures for their customers instead of the lock-in attempts they really were. The problem with the old way was that some unscrupulous registrars (NetSol for instance)made it harder to get your domains away from them, forcing you to jump through hoops, and making them harder and harder to accomplish, and then deny them for wrong reasons. The new policy only sets out EXPLICIT rules about what are allowed reasons for a domain transfer to be rejected by the current registrar, and a process by which disputes over transfers will be handled. Other than that, nothing has changed really at all, and any news articles saying otherwise are less than properly informed, and listening to alarmist rhetoric instead of understanding how the system worked until now, and how it will work in the future. As a previous poster pointed out, the best thing to do is to lock your domains with your current registrar, just make sure that they provide an easy means to unlock them when you need to make changes, or when you really do want to go to a new registrar.
How about just hijacking icann.org?
Suppose we sent a transfer request every minute, on the minute.
If we submitted ENOUGH of them, surely they'll forget to reply to ONE of them. And we'll have the domain name, cleanly by their own policies. They'd have no means of recourse.
Subject: From the Honorable Janissary Robert M. Jacobson
Hello sirs,
Writing this letter comes at a times of great anguishes to my community. We have obtained funds in the amount of US$3,000,000 from the Nigerian government, after the passing of Prince Montebu Wilson, to whom we are the singlest heirs. However, due to political difficulties we are unable to secure the actual cash moneys ourselves. We require your assistance, for which we would thankfully provide a commission of $500,000 for your troubles. In order for this transaction to be completed, we hereby requests that your domain, www.coolinternetstuffthatisgreatandfun.com, be transferred to us immediately. Lack of action will be assumed as an affirmative response after five days.
Do YOU ever read more than a few words into those?
-- I prefer the term "karma escort."
Someone else mentioned Joker.com, and I agree that they are a great registrar. I've used them since 2001, and have about 5 or 6 domains registered with them.
The first thing I heard about these new rules was in some emails from Joker the other day telling me they were locking my domains for me. As far as tech support goes, I've honestly never needed any; I can control every aspect of my domains via a reasonably well designed web interface.
I have no special gift, I am only passionately curious. --Albert Einstein
The way I do it is that I create a unique email address in my domain for each registrar I deal with (hostmasternetsol@mydomain.com, hostmastergodaddy@mydomain.com, hostmastergandi@mydomain.com, etc.).
S ign.com
Then, on the server side, I set each of these email address to reject all emails not from those registrars themselves. For example, the Network Solutions one reject emails without any of the following in the "From:" line:
Network Solutions
netsol.com
networksolutions.com
Veri
The GoDaddy one rejects emails without:
godaddy.com
supportwebsite.com
gandi.net
And so on. Not a single spam email has made it through my domain contact email addresses since I set this up just under two years ago, and according to my stats, around 419 per week have been blocked (just over 41,000 total messages so far). And yet at the same time, I've gotten every email message when my domains have been coming up for renewal, or when I have made changes to them. So it seems to work well.
You just need to make sure that you include all applicable domain names in the filters, because Network Solutions (for example) sends emails from several domain names.
Of course spammers could get around this by spoofing the "From" line to pretend to be from a registrar. But, in practice, I haven't seen this happen yet. Hopefully SPF or some other such standard will become prevalent enough by the time that happens that it will be a non-issue.
Yeah!
Lets all overwrite our sendmail daemons with one line of text. That'll show em!
Note that this isn't about transferring a domain from one owner to another. It's about transferring a domain from one registrar to another while keeping the same owner. Transfers of ownership come under different rules.
Damn, probably 90% of the posts in here need to be modded to -1. These rules relate to the transfer of a domain by the domain owner of that domain from one registrar to another. It is not about claiming (or hijacking) someone else's domain as the headline improperly entices you to think.
This is a good thing people! It helps to ensure that domain owners can transfer their registrations when they so wish. In fact, the domain owner has to first request the transfer before it even gets this far.
Sheesh.
- The registrant or domain owner;
- The losing registrar;
- The gaining registrar.
- The central registry - central repository of records.
Got that?Okay, the way a transfer was supposed to work was as follows:
- The domain owner submits a transfer request to the gaining registrar
- The gaining registrar was to seek confirmation of the transfer from the domain owner, based on existing whois information, and independent of the request.
- Having received such confirmation, they notify the central registry that the transfer is valid.
- The central registry notifies the losing registrar of the imminent move, to give them a chance to block it should there be unresolved billing issues or other disputes. Only in such a case was the losing registrar meant to block the transfer.
- If the losing registrar does not object, the transfer is executed.
(Steps 2 and 4 actually run in parallel, but that's irrelevant.)The Problem
However, a number of losing registrars put in a policy some time ago that they would also seek confirmation from the domain owner, despite the gaining registrar having already done so in step 2. They would object to all transfers unless they received authorisation to their liking from the domain owner.
One registrar in particular required a copy of an Australian driving licence or passport, or a notarised letter for non-aussies. In this case it made the administrative cost of a transfer prohibitively high. The did not require this level of identification when a domain was being transferred to them. (Before you ask, yes the admin details were correct. They were just being berks.)
Invariably this policy was put in by registrars to try to prevent customers moving to other registrars, by adding additional hoops. The 'excuse' put forward was to reduce exposure to legal actions.
When one tries to cover ones ass too much, one's hands end up covered in shit.
Not all registrars did this - the nicer ones honored the word of the gaining registrar and only interfered if there were billing issues etc.
The Solution
The new ICANN rules is a compromise - it now explicitly allows the losing registrar to seek the double confirmation, but they can no longer block the move just because the customer didn't jump through enough hoops for them
It does not require the losing registrar to do so, so this is business as usual for the nice registrars.
The important point is that the gaining registrar still has to verify the transfer in the first place, as it should be. The customer confirms their identity once, and no more.
What's to stop a registrar faking authorisation? The loss of their ICANN accredidation, and hence their business.
Final point: although this is a non-story, it *is* important to make sure your admin details, especially your email address, are correct and up to date. Just as you would check your entry in the phone book, check your whois data too.
"A goldfish was his muse, eternally amused"
Just to restate this in even simpler terms:
The Fucking Article (and even more so the editorial comments here) is WRONG.
The linked Icann paper's first line is "Registered Name Holders must be able to transfer their domain name registrations between Registrars". NOTHING TO DO with transferring ownership of domains; but of the registrars. Could be nasty, and even a first step to having the domain hijacked, but the ownership of the domain is unaffected.
How would you notice?
Stories are posted only once.