Slashdot Mirror
WHATIS Going To Happen To WHOIS? (vice.com)
dmoberhaus writes:
A European data privacy law goes into effect in May, but it's already having far reaching consequences, especially when it comes to publicly available WHOIS data. Motherboard spoke to a domain registrar, ICANN and some security researchers about how anticipation of the EU privacy laws implementation has already gutted WHOIS data, why this is dangerous and what the future of WHOIS looks like.
ICANN requires registars to make data on their customers publicly available -- but registrars would be more than happy to stop, according to Tim Chen, the CEO of a WHOIS data analytics firm. Besides hiding their customer lists, it would also address complaints about spammers harvesting email addresses. So registars like GoDaddy "are taking this opportunity to see how far they can push things."
But the article has some sympathy for ICANN. "On the one hand, the organization is under pressure from law enforcement officials and security researchers who depend on WHOIS data to investigate possible crimes or mitigate devastating malware attacks. On the other hand, the organization must also accomodate laws like the GDPR that are the only bulwark against the wholesale of individuals' data by internet giants like Google and Facebook." In 2014 ICANN suggested a "gated" registry that would only authorize access to people who identified themselves and their purpose for accessing the data. But progress has been slow, according to the article, which adds "It's uncertain when ICANN will have a finalized protocol for a next generation version of WHOIS, but an overhaul of this nearly 30-year-old protocol is long overdue.
"The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work."
ICANN requires registars to make data on their customers publicly available -- but registrars would be more than happy to stop, according to Tim Chen, the CEO of a WHOIS data analytics firm. Besides hiding their customer lists, it would also address complaints about spammers harvesting email addresses. So registars like GoDaddy "are taking this opportunity to see how far they can push things."
But the article has some sympathy for ICANN. "On the one hand, the organization is under pressure from law enforcement officials and security researchers who depend on WHOIS data to investigate possible crimes or mitigate devastating malware attacks. On the other hand, the organization must also accomodate laws like the GDPR that are the only bulwark against the wholesale of individuals' data by internet giants like Google and Facebook." In 2014 ICANN suggested a "gated" registry that would only authorize access to people who identified themselves and their purpose for accessing the data. But progress has been slow, according to the article, which adds "It's uncertain when ICANN will have a finalized protocol for a next generation version of WHOIS, but an overhaul of this nearly 30-year-old protocol is long overdue.
"The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work."
maybe 20 years ago whois was useful to find peopleâ(TM)s names and then fuck with them but now? irrelevant
With my penis. After that, who knows?
The WHOIS data is protected by privavy law. Lookup any .se adress and see that no personal data is shown. If police requested the data however the registars have to give it out.
This is total nonsense. GDRP is about disclosing how you handle data and giving people handles when they want to be removed from your system. In no way does it stop you from creating a phone book for domains holders.
Anyone who has a registered domain or ssl certificate is familiar with the perennial scam of getting a fraudulent letter or emailing informing them that their domain is about to expire please send money now.
What's wrong with having WHOIS point to a middleman who must forward to the owner?
There's no privacy issue that way.
ID: the nose did not occur naturally, how would we wear glasses otherwise? (apologies to Voltaire)
by scripts, running methodically and slowly on various machinery, scrape whois. then spread the result beyond control.
Most domains are owned by proxy anyway, so if you do a whois you're just going to get the name of the proxy.
The days of using whois to hold domain owners responsible for anything have been long over for a long time; anyone doing anything shady (or just wanting basic privacy) is using a proxy.
But I do know this much: trump will hang for treason.
People tend to focus on domains when it comes to WHOIS usage; however I've found myself using it more to see who administrates/SWIPP'd a given block of IPs rather than looking up often inaccurate or obfuscated info on domain ownership.
My registrar offered to make my personal information private something like 18 months ago, an offer which I immediately accepted. As a result I've had no more scam letters from assholes telling me I owe them money to renew my domain.
Typing a domain name into a computer without proper authority should never ever reveal the name, address and phone number of the owner for the very same reasons that in the UK you can't type the registration number of a car into a computer to obtain the name address and phone number of the owner.
My domain registrar (Hover.com, based in Canada) offers WHOIS obfuscation for free. I'd be an idiot not to take advantage of it.
Palaces, barricades, threats, meet promises
Law enforcement agencies will still be able to access this data via internationally agreed search warrant procedures. What the whingers (FBI/NSA/GCHQ etc) are pissed about is that they will no longer be able to carry out (unlawful) warrantless searches without scrutiny.
The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work.
I am going to create a piece of legislation that states "all citizens have a right to be able to time travel". I guess since it's the law we have to invent the time machine. Apparently the best approach to decision making is to shoot first and aim later.
We'll make great pets
My home address doesn't need to be public. I list the address of the local post office, and my real name. Mail sent there will reach me. And of course a unique email address with very strong spam filters on it. Been doing it this way more than 10 years - no problems yet.
"Shoot, a fella could have a pretty good weekend in Vegas with all that stuff."
The data will always find a way out. Just allow registrars to salt records, like what is done with political donations.
# make clean sig
WHATIS Going To Happen To WHOIS?
Namely: WHEREIS, WHYIS, WHENIS and HOWIS ?
It must have been something you assimilated. . . .
Just wondering if this is common. :) Its not like you have to show ID or anything. A 99 cent godaddy domain... WTF do I want to give real info anyways....
[($)]
Why bother with this if you are still going to get all of the junk mail forward from your post office to your home?
The whole point of privacy proxies for registrations is it completely blocks the ability for scammers to get any contact info and they cant send you all that scammy junk snail mail, junk email, and phone calls from domain renewal services, SEO optimization services, and fly by night web developers looking for a gig
namecheap.com offers the proxy service for a couple $ a year and is far worth it to not deal with the junk snail mail, junk email, and phone calls from these scammers. No one has a legitimate need to get access to this info, unless I provide it to you.
https://en.wikipedia.org/wiki/...
"Brin argues that it will be good for society if the powers of surveillance are shared with the citizenry, allowing "sousveillance" or "viewing from below," enabling the public to watch the watchers. According to Brin, this only continues the same trend promoted by Adam Smith, John Locke, the US Constitutionalists and the western enlightenment, who held that any elite (whether commercial, governmental, or aristocratic) should experience constraints upon its power. And there is no power-equalizer greater than knowledge."
From the article: "The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work."
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
People used to have to put in their real contact information because the purpose of whois was for someone to contact the people who ran the domain when they saw something wrong going on over there. Using false information in whois was grounds for revocation of a domain name. That stopped being the case when NetSol saw dollar signs and stopped running DNS with any sense of responsibility to the original intentions.
So you have a problem with leaking "personally identifyable information" ("PII").
So your solution is an identification-wall that requires more identification, thus more PII, and "justification" data.
Syeah, that's gonna work.
Why do we publish all that whois data anyway? It's a hold-over from the early days. The useful bits of info are the registration date, the organisation behind it so you can match various domains to the same owner, and (should it still have been reliable), an easy contact point for abuse like through email and an out-of-band contact point for tech issues like a phone number.
Administrative contacts? Not really useful. Billing contacts? No point in making those public. Names of people associated with various contact points? Only rarely if ever useful, except for "owner" and tracing what else he's got--some scammers are crafty but these days it's all behind a privacy wall anyway. Where it isn't shielded, physical address is mainly useful to get an impression just whereabouts on the globe they are. We could put a lat/lon on there instead.
So most of the data can simply be made not public. I do think that the email and telephone contact points should remain public, and rigorously checked for validity. But the rest? Certainly the individual info in there we can do without.
Oh and by the way, replacing WHOIS by a website is a no-go. In addition is fine, but websites go poorly with command line interfaces. And I still run whois several times a day on systems that don't sport graphics much less a(n oversized stupidly heavy) browser.
I'd like to see the web of trust replaced by the blockchain of trust.
You want to be anonymous? Sure, ok, we have a blockchain for that ...
Every time I tried to use it to look someone up, the address was always held by some corporation clearly designed to hide that information. I don't think the database has actually been useful for at least a couple of decades.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
When I buy a domain, I can always find a coupon for free or 99 cent WHOIS privacy.
WHOIS is the internet-equivalent of a property registry. If I want to know who owns that building over there, I can go to the township, look in the public records, and find out. This is important, whether it's because you want to buy the building, or perhaps you have a problem with something that is happening there. Sure, in some cases, ownership will be obscured through some intermediate legal entity, but that will still be the responsible legal entity.
WHOIS should be exactly the same thing. If you are interested in a domain - for whatever reason - you should have a way to contact the legal entity responsible for it. Concerns about spam are misplaced - this happens in the physical world as well. There are scammers in the world, news at 11:00.
tl;dr: The domain registries are the property registries of the Internet, and the registrations should be public.
Enjoy life! This is not a dress rehearsal.
WHOIS has been dysfunctional for years and continues to get worse as time goes by.
Don't blame the Eu for this. Blame registrar greed and wide spread abuse of the system.
I have about 20 domain names that are registered on my be half. The company registers the domain names for you and they create a name for you.
Some of my names are phil, Dave, Davidson, Martin and Philip. When they register your email domain they give you a name and an address and a country and then they give you your password which you are meant to change for obvious reasons.
When all this is complete you must use one of those domain names as a contact email address even though the registered domain name is not you.
My one is postmaster, and because it has to exist on all the registered domain names it is chock-a-block full of malware and scammers email in multiple languages from multiple countries.
They look through the register for a email addresses and thus people constantly send you malware and scammers links day in day out. P.S.
Other Internet companies constantly bombard you with special offers and why you should leave the company you have registered your domain name with and register with them. Why you should purchase their services rather than the one you have what ever that may be! THEY ARE WORSE THAN ALL THE VIRUSES AND MALWARE PUT TOGETHER...
You can switch off incoming email for that particular domain email address but you have to switch it on for domain updates, to declare that you are who you are saying you are.
Contact email registration is a nuisance.. I ended up paying a company identification protection to handle all the domain emails it has to go through them before it can get to me. And the only one that should get to me is the message about verifying that my name is Dave or Martin or Philip.