Slashdot Mirror
Privacy Advocates Bemoan the Problems With WHOIS
An anonymous reader writes "The Globe and Mail is reporting that net privacy advocates are spurring ICANN into scrapping WHOIS. The advocates complain that the system doesn't do enough to protect domain owner information from spammers and fraudsters, and compare the problems to those being experienced on a broader scale by email users. 'WHOIS, much like e-mail, is an age-old Internet relic that comes from a time when the Internet was almost considered a network of trustworthy users. E-mail has, quite clearly, some massive problems coping in the modern age, but it's still here. It stands to reason, then, that WHOIS won't be going anywhere any time soon. Just like e-mail, it's prone to abuse. But again, just like e-mail, it's too useful to axe.'"
For what? These days, everybody is registering private domains through people like DomainsByProxy. Whois is becoming more and more useless. Might as well chuck it.
My blog
In one episode last season, Ando showed up at Niki's house, having been able to find her because she listed her home address on the WHOIS record for her website.
(The unspoken moral: use a PO Box, or some guy from halfway around the world will drop in on you unexpectedly.)
The advocates complain that the system doesn't do enough to protect domain owner information from spammers and fraudsters
Every major domain registrar lets you do a "private domain registration" for a few bucks extra. They replace the WHOIS data with generic info plus a uniqueID, which lets you contact the domain owner through the registrar.
Pretty simple - not rocket science.
I am sure that the registrars will happily hand over the actual domain registration info to duly authorized law enforcement with a court order.
Further, any legitimate business puts a mailing address/phone number/fax number on their website. Having the same information available in whois isn't an issue.
It used to be when I had to contact someone, the whois information was accurate, complete and, when I dialed the number, I got a live human being that actually was able to address my issue. And, life was good.
Now, it seems even reputable domains are hiding behind private registrations or have outdated or deliberately incorrect information. Bleh. Problems that used to be able to be solved with a pleasant phone call now require hours of my time if the task is even possible.
So, my first choice would be that whois domain information take a giant step backward to the days when it was useful information. If that isn't an option (and going back in time rarely is possible), get rid of it altogether.
i sold an old Mac laptop with system 7.5 to a girl for $200 with a printer about 7 years ago. She had little money, and for what she needed - a way to type homework in her dormroom and print it - $200 seemed reasonable - it did what she told me she wanted it to do, and she tested it at my place and everything worked just fine (2 cheers for Word 5.1 on system 7!). I made it clear that this was *not* an internet workhorse, and that if she wanted that, she needed to go to the bookstore and buy a new computer. "No no, i just want to type papers and print them in my dorm room".
So, of course, the first thing she did was attempt to install a bunch of new internet software (browsers, school's First Class server client) on it which of course didn't work. Then she took it to the school helpdesk, and they (rightly) had no idea what to do, so instead of telling her to get jammed, they screwed it up completely. So, she calls and says she wants to return it because it doesn't work. I'm like - yeah, what the hell do i want with a fscked up powerbook and printer? I don't want to buy it - i just sold it to you like two weeks ago.
time passes... and i start getting threatening emails from some guy on a yahoo account with ($myname)fucker@yahoo.com. Then he starts saying that he's going to come after my wife and hes watching her car when she comes home at night. That was fscking it. Its the girl's mental patient boyfriend.
Long story short - he was actually stalking whoever in the hell was in my old apartment - it was pure coincidence that the new tennants also owned a Honda Civic too.
Where, do you think, he got the address? Of course, from my whois entry when i didn't have any money to buy a PO Box.
Yeah, if you think i'll ever give out my information to my actual home or office location - ever - you've gone daisy, my son. ICANN and everyone else can demand all they want that my info be correct - but i don't answer to them, so they can kiss my ass.
In fact, because of this, a guy who started, then stole, the website of a non-profit (they've set the donations address to their address, but the actual non-profit is in Africa, so its hard for them to fight the problem) is going to be getting a legal foot up its ass because i know where he is and where he lives and his work address - all because he's broadcasted it in whois and on his webpage.
ICANN can't make me do anything.
guns kill people like spoons make Rosie O'Donnell fat.
Anyone who has had to deal with the Domain Registry of America will understand this.
Soon after one of our clients register a domain with us, these lovely people will send a very convincing snail-mail to the customer based on their whois data with a payslip attached, saying words to the effect of "Your domain will expire unless you register with us!"
In the UK, the Office of Fair Trading seem to have turned a blind eye to this despite numerous complaints.
-daedalusblond
Speak for yourself. I use whois every day. It's invaluable.
I own a number of domains and I completely agree that the WHOIS system needs a major overhaul. For one or two domains I actually purchase extra whois privacy from GoDaddy, but for the most part this is just added cost for me to patch a broken system. Why can't I pick and choose what info to show?
.ca domain, I'm forced to use my real name not my company name and my .ca registrar does not offer domain privacy on .ca domains.
On top of it, if I own a
I get a ton of spam to the email address I use for my domains, so this address has it's anti-spam set WAY up. I even get occasional phone calls about my domains- usually scams, but recently it was a good thing because I sold one of my domains for $5K (though why the person couldn't just use the contact info on the actual website is beyond me).
But, basically I think you should be able to opt for privacy at no cost. Seems like a no-brainer to have a privacy flag as part of the database. Or maybe provide a url of a contact page where you can determine what to show or just provide a contact form box.
I am suing (http://www.barbieslapp.com/spam/e360/timeline.htm) Moniker for providing anonymous whois to David Linhardt (http://www.spamhaus.org/organization/statement.lasso?ref=3).
Moniker has been providing Linhardt/e360Insight, with hundreds of anonymous domain names. This makes it difficult, if not impossible, to determine which domains are his. With anonymous registration you cannot tell if the 1000 of spam you received today are from 1000 different companies that may have mistakenly added you to their list or from one hardcore spammer.
Legitimate businesses have no reason to hide their identity.
Fight Spammers!
What is it useful for? To contact a domain owner and inform him about abuse or fraud, or identify someone who is using a domain for criminal activity. So far the theory.
In practice, you can rest assured that not a single domain used for things like ID theft has ever been registered to a real name. Earlier, they registered with registrars who didn't check information (so you had funny entries like some guy whose information was already grabbed in an earlier phish registering a domain for a server in Malaysia), and when registrars felt the pressure, they simply use registrars now that allow you to put their name in instead. Complaining with those registrars results in a "we're looking into it" until the domain is no longer used by the ID thief, so the problem solves itself.
So either require people to put in truthful information and remove registrars that don't comply, or get rid of it altogether. In its current state it serves no useful purpose. The current system only aids criminals, on both ends.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
But there's no need for the "default public" policy that WHOIS historically operated on. Moreover, if someone like Microsoft wanted an anti-Linux site, it would be trivial for them to outsource its operation to some other company. The current WHOIS actually doesn't provides a robust mechanism for determining who runs and operates a domain name.
The problem is that WHOIS currently is a very weak system. The data it contains isn't accurate, isn't verified, and what few legitimate uses there are for the system could just as easily be accommodated in an "default private" system where requests for additional information about a domain require a little bit of processing (and notification to the domain owner about who is performing a formal lookup on them, and the stated reason for doing so).
I would say the best use of WHOIS is when you need to contact the owner of a business domain. Like many others I've seen boatloads of complaints from people here about their own private domains and how badly they hate WHOIS.
... I do believe WHOIS is still useful. When you can obtain the WHOIS information for the criminal domain, it gives you someone to contact about that activity. People who care enough to do this have managed to progressively change the policies of registrars who were frequently used by spammers for nefarious purposes.
To those private owners, I could care less if their home information is available through WHOIS, as long as they aren't selling illegal merchandise through said domain and pumping spam for it all over the world.
However, when international criminals register domains to sell pirated software / bogus pills / etc
And further investigation into WHOIS data can lead someone to even more critical information, as well. Being as the WHOIS record contains information on the DNS servers that are resolving the domain, a person who wants to really dig deep can find where those were sold as well. A little hint: the spammers often use only a short list of DNS servers for a large number of their domains.
So in summary, before people rally around ICANN with pitchforks and torches to demand the demise of WHOIS, I ask you please consider a solution for the applications where WHOIS is still useful before insisting that it goes away completely.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
In response to customer inquiries about why such-and-such a domain isn't resolving, I do hundreds of checks a month to verify that domains actually exist, since a sizable percentage have non-functioning DNS. I also query to see if domains we are about to drop from our authoritative DNS service are actually gone.
Not to say the whole whois scheme is a mess, but some sort of non-DNS, free service needs to exist to verify that a certain domain either exists or doesn't.
The other thing that irritates people the most, besides the privacy issues, is that there is such inconsistency in how the whois info is made available.
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
The ability to outsource slander is a problem and not just with Whois. Look at political ads - they carry a tagline that's supposed to say who produced it but they can make up a name like "Save the Children Foundation" as a front for whichever political party they want. Tracking down who says what for whom is hard enough in that arena but outside of politics (in tech, drug, clothing, car or whatever industries) is next to impossible.
We need to be able to see who's saying what more easily, not just when there's a problem.
I definitely agree about contact information though. My whois is private to stop the junk mail and junk email, not to hide my name. Seeing who wrote something or supported the writing of something should be easy for people who want to know. Sending them an advert for your registrar doesn't need to be. Of course if Whois cost money to view, which of those interests do you think would be the ones paying to read?
more of the same on Twitter.
I use whois everyday to check domains and IP's from command line. The simplest way to get an IP range is just "whois xxx.xxx.xxx.xxx" and then block/allow the whole range depending on your needs.
It's an invaluable network tool and just like DNS, you can't just scrap it. That there is abuse is always going to be a problem and that can be done with any list you put your data on. Ever wondered why you get so much credit card offers in your mailbox? Yes, it's because your name and address is somewhere on a list and most likely you have put yourself on it by using your address with either a banking institute or a vendor. You can't stop abuse by taking away services just like you can't say that you are going to solve those credit card offers in your mailbox by removing the postal services. If you do, the abuse is just going to shift from whois to your webhosters' site or DNS just like the credit card offers will be carried out by FedEx or UPS.
Custom electronics and digital signage for your business: www.evcircuits.com
The actual ICANN report, shows they're deadlocked, all right. See this timeline.
Most of the privacy advocates are referring to the European Directive on Privacy. That only applies to individuals not engaged in business. For businesses, the The European Electronic Commerce Directive (2000/31/EC) applies. And it's very clear. Any "natural or legal person providing an information society service" must disclose name, real-world address, and E-mail address. No exceptions.
California has a similar law. It's more narrowly drawn, only applying to sites that take credit cards, but it's a criminal law - six months in jail for not disclosing the "actual name and address" of the business.
WHOIS policy should take that into account. There's a legal obligation to disclose name and address information for businesses. It's not optional.
Our SiteTruth system is based on these laws. If a web site is selling or advertising something, and we can't find a business name and address for it, its rating is toast. We scan each site for human-readable postal addresses (some people would call this "semantic web" technology). We check commercial business databases. We check SSL certificates. We look at Open Directory. If we can't find a business name and address after doing all that, the site's rating is a red "do not enter" sign, and we kick them down to the bottom of search results. Once we have a business name and address, we have something to look up in business databases, corporation records, business license records, credit ratings, criminal records, etc. Plenty of data is available about businesses once you have a name and address. No more "on the Internet, no one knows if you're a dog". We know.
We haven't found WHOIS data very useful in doing this. WHOIS data quality is awful. Many entries are phony. Mailing addresses on the web site itself tend to be more accurate. Using a phony business address is felony fraud in most jurisdictions, so that's relatively rare, and mostly shows up on phishing sites. So we cross-check with anti-phishing databases to kick those sites out.
It's quite possible to use this approach to check WHOIS information in bulk. If ICANN actually cared about WHOIS data quality, they'd check the data against postal databases and business databases. They don't.
I know that interpersonal voice communications conducted over an old fashion telephone line between peers is the antithesis of all that is the tech world and Slashdot. Still, it can be rather effective at times.
True story...
I was the IT Director for a mergers and acquisitions company. We were a couple days away from closing on a mid-sized ($72 million) transaction. Money had already been wired into escrow. We are in the United States but the company's owner was vacationing in South Africa. The company we were buying was based in the Dominican Republic so there was local counsel there. The company from which we were buying the Dominican company was based in the Cook Islands. The law firm -- a fairly large international firm -- coordinating everything was out of the Netherlands. Documents were zipping back and forth by email pretty much around the clock given the time zones involved.
Then, for some reason, the email stopped. Test messages when through from all the parties but all the documents failed. We thought it might be file-size related but large test documents went through fine. The lawyers we were working with out of the Netherlands didn't know who did their network/email support -- it was handled out of another office. They couldn't come up with anyone who knew anything about the problem in hours of trying to track someone down. Without a complete set of documents (several hundred pages) executed by all parties, the transaction would be delayed.
(Delaying the closing even by hours is a massive and costly pain given the number of people and amount of money involved. Homework: calculate the amount of interest $72m throws off ever hour.)
Faxing large quantities of documents for review was out of the question. FedEx or another overnight carrier would delay the closing. Not to mention, it would slow the final revision processing.
Using whois, I called the technical contact for the domain. He immediately handed me off to their mail guru. After I explained the problem, he checked his change log and found a half dozen new regular expressions were added to their spam filter about the time we started having problem. Seven characters of the eight-character transaction code we were using in the filenames on all the documents happened to be the same as a banned regex that had been added. Once the regex had been removed, everything worked and we closed on time.
Total time from 'whois domain' to problem resolution: less than half an hour.
Had I not been able to get the mail guru on the phone or by email, we would have delayed the closing. We would have had to come up with an alternate document transport. We would have had to notify and train all parties in the alternate document transport. It would have been ugly.
So, in short, if I have a problem with your domain, I'd like a number I can dial to speak with a competent human being.
I have had a long dislike of whois.
For one it gives people a major way to steal domain names. People look up the domain name that they want in the public record, find the email address, and try to crack the email. If they can get the access to the email then more than likely the domain can be stolen. Then us poor techs get a call several months later from the true customer wondering what happened to their domain. Whois reveals too much information.
Secondly it isn't accurate. People see their name in whois and think that means they get to make decisions on the account/domain. Just because your name appears in whois does not mean you are listed on the account itself. But try explaining that to their ex-(terminated)-webmaster.
And lastly WhoIs is a major pain to explain. Try telling a paranoid customer that all domains appear in whois, and that you can't remove a domain itself from whois. My sup can't remove it from whois. The president of MegaDomainRegistrar can't remove it. Sorry, no, I don't have a phone number for ICANN. We can hide the info, but we can't make it disappear.
But then to be fair, I can't think of an alternative system to keep the domains and websites fair and accountable. Compaining to a registrar/webhoster about a domain/site is next to useless unless it is unquestionably illegal or definately a trademark issue. Most cases get shunted to the legal department which give the unhappy complaintant a copy of the AcceptableUsePolicy and asked to submit proof of infraction (yeah, good luck). Usually it takes a dedicated lawyer to get things done in these cases. So for now, whois stays.
The technical contact is a special case, because it probably shouldn't be based in the domain it's supporting, since a common reason for using it is that something's wrong with the DNS server or the web/email server supporting that domain; and therefore it's most likely to not work when you most need it - so it needs to be handled somewhere else (like a commercial email service, or perhaps even a forwarder at the DNS provider), and it probably should have good spam filtering. At a medium-large company, the phone number should go to a help desk, which isn't a privacy problem either, but for an individual it's annoying but useful to publish the number.
The billing contact is another special case, because the only entity that needs to access it is the DNS registrar that's handling name registration - it should probably be hosted somewhere other than the domain (again because it has a good chance of failing when it's needed), and spam filtering can be a very short whitelist. I don't see a legitimate need for it to be public.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
The trademark ownership issue has been a major driver since before ICANN - the IETF Ad-Hoc Committee that was trying to expand the number of global TLDs before ICANN took over were under a lot of pressure from the Trademark Gods to make sure that anybody who registered a name provided their True Name and True ICBM Address (er, process-server address) so that trademark lawsuits could be resolved without needing to drag the DNS registrars into the process. I think that's unnecessary - it's reasonable to have a Uniform Dispute Resolution Process that says that if you don't provide usable contact information then you're presumed to lose a trademark dispute for non-generic names, as opposed to preemptively violating your privacy.
In practice, the main reasons I use the whois owner name are to try to make sure I've got a correct email address for somebody if I'm not sure, or sometimes to see if it'll help me contact somebody whose website doesn't provide useful information (e.g. spam complaints to abuse@ get ignored), but I've found that if somebody's a sleaze, they're usually providing non-useful information in their whois records.
There was one spammer I could have probably sued successfully, but their whois address was a box number in Greenville DE, at the same address as The Company Corporation, which has been the canonical place to set up cheap Delaware corporations for the last 100+ years - so the most I'd get if I successfully sued them for everything they were worth would have been the contents of their file folder, and they'd have had to go pay another $100 to get another shell company. I guess I might have also acquired their intellectual property, like the trademark on ScammersRUs.com or whatever they were called.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I think hiding the ownership of a domain (or IP address information) opens up opportunities for more fraud and, balancing that against privacy, I'd rather know who I'm communicating with.
If someone needs privacy, there are ways to get it.
Have gnu, will travel.