Slashdot Mirror
US and EU Clash Over Whois Data
itwbennett writes "ICANN wants to store more data (including credit card information) about domain name registrations in its Whois database, wants to hold on to that data for two years after registration ends, and wants to force registrant contact information to be re-verified annually — moves that are applauded by David Vladeck, director of the FTC's Bureau of Consumer Protection. The E.U.'s Article 29 Working Group is markedly less enthusiastic, saying ICANN's plans trample on citizens' right to privacy."
Well, I guess I'll have to get a temporary phone number, address AND anonymous "gift card" credit card now for my domain now
Pretty much what it comes down to.
Balancing right to anonymous domain hosting vs everyone else's right to live without torrents of spam
Time for the anti UN comments, as usual around here. But how can you defend the USA on this case?
(My .uk domain's public whois looks like this:
Registrant:
[My real name]
Registrant type:
UK Individual
Registrant's address:
The registrant is a non-trading individual who has opted to have their
address omitted from the WHOIS service.
And that's the way I like it!)
What's to stop companies from continuing the "private registration" feature that they already offer (often for a significant fee) to hide the domain owners name, address and other personal details? If the "owner" of the domain has to have their real contact info on file with the domain, then for customers that want to remain private GoDaddy and other registrars can "own" the domain with a contract giving exclusive use of the domain to whoever paid for the domain.
That makes no sense, because many people can and routinely do send e-mail from the same domain.
This move is fairly directly contrary to the basic rules of privacy in the EU, and after the negative press that European governments have had over things like airline passenger and banking information recently, I don't see this getting very far. There's no compelling "fear the terrorists" or "catch the tax evaders" kind of argument with popular appeal here. The US authorities have no need to know my credit card number, and certainly no need to keep it for years, assuming it's even still valid by that time.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
I personally don't mind having legitimate data associated to domains I own, but I don't like that my name, address, phone number, and email address is visible to everyone. I don't really think ICANN needs my credit card number, but it seems like just making only, say, the name, available publicly would be a better first step.
Why would you store credit card information in WHOIS? I already get mail from registrars wanting me to "renew" my domains (read Transfer them to them) for a "reduced rate" of $30 (I pay $12 a year). If the credit card information was in there as well, what would stop shady organizations from using that information for other scams? WHOIS certainly doesn't keep my physical address safe from scammers.
My sci-fi novel, Ghost Thief, is now available from Amazon.com.
I believe storing consumer credit/debit card data over 90 days is a direct violation of Visa International rules. I've been away for that stuff for a couple of years now, so I could be wrong.
Vietnam Veteran / Former Postal Worker -- Use Caution When Taunting!
The rotten and corrupt Domain Name System.
ICANN doesn't give a rat's ass about the validity of data in WHOIS, and hasn't for a long time. Someone (perhaps in law enforcement?) probably put a little pressure on them something recently and now they are putting on a show. It will blow over soon enough and we'll be back to business as usual, with ever-increasingly-more-meaningless WHOIS data.
From my own experience I would say at least 80% of the records I have looked up in the past several months for extant domain names have had obfuscated information, protected by registrars who don't give a damn that their customers are conducting illegal activities (fraud, selling drugs, selling pirated software, sending spam, etc) through the domains that they sold them. ICANN doesn't give a shit about "protected" obfuscated domain names, and doesn't care about ones with blatantly false data, either.
ICANN just wants to make money. They'll either find a way to make more money with this, or - more likely - they will give it up once the pressure is off.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
But isn't it technically possible for people to set up a free DNS or functionally equivalent service of their own, without any government or private regulations, and without necessarily charging [exorbitant] fees to use it? Everything else related to the web is open source...
I love ICANN.. They require real contact information be stored in a public database or else your domain can be taken and resold and oh by the way registrars get to charge extra just to keep your identity in the public database safe.
All they are doing to address the sespool of automated domain capture, phishing and extortion activities upon expiration is truely amazing and inspiring.
I'm having trouble finding the words to express my appreciation for their infinite TLD program which has opened up new and exciting opportunities for name protection extortion, phishing and additional layers of government involvement.
ICANN is the only Internet body who consistantly errors on the side of unmitigated greed and selling out to governments. It has no soul and does not deserve to exist.
This answers why EU wants less control of USA over the internet.
EU cares (more) about privacy that USA.
Hopefully we don't have to disclose (that much) information to register a domain and I hope it'll stay that way.
It'll be even better if (at your choice) you can hide all your personal information and only display a certificate proving that you're owning the domain.
=> You don't disclose your personal info (they're kept private by registrar) => no spam
=> But registrar can't fuck you ( = pretends he owns the domain) because he doesn't know the private key of certificate. And you'll have public whois info to track the certificate attached to the domain and if needed you'll be able to prove the certifcate is yours (and so is the domain)
> moves that are applauded by David Vladeck, director of the FTC's Bureau of Consumer Protection.
Consumer Protection's Director applauded ? Is he dumb ?
Credit cards are fundamentally insecure (the fact you can get money off one by merely knowing the number on the front and the expiry date and a couple of other trivially easy to find bits of information - all of which will be in the whois database). ICANN should think hard - do they really want to be held responsible when the inevitable breach occurs? Do they really want to have to implement PCI-DSS for the networks and systems holding whois data? The decision to hold credit card data in whois is likely to be something that is regretted fairly quickly.
Oolite: Elite-like game. For Mac, Linux and Windows
If you really don't want to give up all this data to the whois directory, just forgo having a domain... Simple as that.
If you really *must* have a domain and you are worried about privacy, prepaid credit cards, prepaid phones, a P.O. box and throw away E-mail account are pretty easy to obtain these days, but that is only necessary if you don't trust who you buy the domain from and they refuse to be the whois contacts for you.
If anybody really is still worried about their privacy, I'll be happy to proxy their registrations for costs plus a fee and if you want I can arrange to accept cash and/or money orders. Of course, I'll have to know who you are and I'll be the one who officially owns the domain....
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
All the domains are owned (on behalf of their customers) by GoDaddy anyway.
Have gnu, will travel.
Enough of "pew pew pew 'merica"...
isn't holding credit card number after transaction a violation of ifc? or something?
isn't that what cause sony to apologize to milions?
what is this uselss idea?
... for I can think... Therefor I AM! And that is who is I.
Do we really want it holding CC details when best practices are not to store them unless you are the bank involved in the transaction!!
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.