Slashdot Mirror
WHATIS Going To Happen To WHOIS? (vice.com)
dmoberhaus writes:
A European data privacy law goes into effect in May, but it's already having far reaching consequences, especially when it comes to publicly available WHOIS data. Motherboard spoke to a domain registrar, ICANN and some security researchers about how anticipation of the EU privacy laws implementation has already gutted WHOIS data, why this is dangerous and what the future of WHOIS looks like.
ICANN requires registars to make data on their customers publicly available -- but registrars would be more than happy to stop, according to Tim Chen, the CEO of a WHOIS data analytics firm. Besides hiding their customer lists, it would also address complaints about spammers harvesting email addresses. So registars like GoDaddy "are taking this opportunity to see how far they can push things."
But the article has some sympathy for ICANN. "On the one hand, the organization is under pressure from law enforcement officials and security researchers who depend on WHOIS data to investigate possible crimes or mitigate devastating malware attacks. On the other hand, the organization must also accomodate laws like the GDPR that are the only bulwark against the wholesale of individuals' data by internet giants like Google and Facebook." In 2014 ICANN suggested a "gated" registry that would only authorize access to people who identified themselves and their purpose for accessing the data. But progress has been slow, according to the article, which adds "It's uncertain when ICANN will have a finalized protocol for a next generation version of WHOIS, but an overhaul of this nearly 30-year-old protocol is long overdue.
"The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work."
ICANN requires registars to make data on their customers publicly available -- but registrars would be more than happy to stop, according to Tim Chen, the CEO of a WHOIS data analytics firm. Besides hiding their customer lists, it would also address complaints about spammers harvesting email addresses. So registars like GoDaddy "are taking this opportunity to see how far they can push things."
But the article has some sympathy for ICANN. "On the one hand, the organization is under pressure from law enforcement officials and security researchers who depend on WHOIS data to investigate possible crimes or mitigate devastating malware attacks. On the other hand, the organization must also accomodate laws like the GDPR that are the only bulwark against the wholesale of individuals' data by internet giants like Google and Facebook." In 2014 ICANN suggested a "gated" registry that would only authorize access to people who identified themselves and their purpose for accessing the data. But progress has been slow, according to the article, which adds "It's uncertain when ICANN will have a finalized protocol for a next generation version of WHOIS, but an overhaul of this nearly 30-year-old protocol is long overdue.
"The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work."
This is total nonsense. GDRP is about disclosing how you handle data and giving people handles when they want to be removed from your system. In no way does it stop you from creating a phone book for domains holders.
I use it sometimes. Mostly to keep track of expiration dates for my own and client's domains, but it's not all obfuscated. Even just the creation date can be useful when looking into something.
On the one hand you take life too seriously, and on the other, you do not take playful existence seriously enough. Seth
Anyone who has a registered domain or ssl certificate is familiar with the perennial scam of getting a fraudulent letter or emailing informing them that their domain is about to expire please send money now.
What's wrong with having WHOIS point to a middleman who must forward to the owner?
There's no privacy issue that way.
ID: the nose did not occur naturally, how would we wear glasses otherwise? (apologies to Voltaire)
by scripts, running methodically and slowly on various machinery, scrape whois. then spread the result beyond control.
Most domains are owned by proxy anyway, so if you do a whois you're just going to get the name of the proxy.
The days of using whois to hold domain owners responsible for anything have been long over for a long time; anyone doing anything shady (or just wanting basic privacy) is using a proxy.
But I do know this much: trump will hang for treason.
People tend to focus on domains when it comes to WHOIS usage; however I've found myself using it more to see who administrates/SWIPP'd a given block of IPs rather than looking up often inaccurate or obfuscated info on domain ownership.
My registrar offered to make my personal information private something like 18 months ago, an offer which I immediately accepted. As a result I've had no more scam letters from assholes telling me I owe them money to renew my domain.
Typing a domain name into a computer without proper authority should never ever reveal the name, address and phone number of the owner for the very same reasons that in the UK you can't type the registration number of a car into a computer to obtain the name address and phone number of the owner.
My domain registrar (Hover.com, based in Canada) offers WHOIS obfuscation for free. I'd be an idiot not to take advantage of it.
Palaces, barricades, threats, meet promises
The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work.
I am going to create a piece of legislation that states "all citizens have a right to be able to time travel". I guess since it's the law we have to invent the time machine. Apparently the best approach to decision making is to shoot first and aim later.
We'll make great pets
Not irrelevant but CIRA (Canada's registry) did the same sort of thing a long time ago and it works just fine. Just saves people from having to pay stupid fees for privacy protection.
Why doesn't ICANN tell them to take a fucking hike...and if they don't want WHOIS available in their country, then they can block it into their country with their own firewalls or whatever.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
My home address doesn't need to be public. I list the address of the local post office, and my real name. Mail sent there will reach me. And of course a unique email address with very strong spam filters on it. Been doing it this way more than 10 years - no problems yet.
"Shoot, a fella could have a pretty good weekend in Vegas with all that stuff."
I do. - we also count bad dns requests to our dns servers - hit a limit and well thats not my problem
I use whois it to determine the nature of traffic. I typically don't bother with contact information, I'm just looking for information I can use to identify whether the traffic is legitimate or not, so I know which PC to pull from the network,
The data will always find a way out. Just allow registrars to salt records, like what is done with political donations.
# make clean sig
WHATIS Going To Happen To WHOIS?
Namely: WHEREIS, WHYIS, WHENIS and HOWIS ?
It must have been something you assimilated. . . .
Just wondering if this is common. :) Its not like you have to show ID or anything. A 99 cent godaddy domain... WTF do I want to give real info anyways....
[($)]
https://en.wikipedia.org/wiki/...
"Brin argues that it will be good for society if the powers of surveillance are shared with the citizenry, allowing "sousveillance" or "viewing from below," enabling the public to watch the watchers. According to Brin, this only continues the same trend promoted by Adam Smith, John Locke, the US Constitutionalists and the western enlightenment, who held that any elite (whether commercial, governmental, or aristocratic) should experience constraints upon its power. And there is no power-equalizer greater than knowledge."
From the article: "The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work."
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
So you have a problem with leaking "personally identifyable information" ("PII").
So your solution is an identification-wall that requires more identification, thus more PII, and "justification" data.
Syeah, that's gonna work.
Why do we publish all that whois data anyway? It's a hold-over from the early days. The useful bits of info are the registration date, the organisation behind it so you can match various domains to the same owner, and (should it still have been reliable), an easy contact point for abuse like through email and an out-of-band contact point for tech issues like a phone number.
Administrative contacts? Not really useful. Billing contacts? No point in making those public. Names of people associated with various contact points? Only rarely if ever useful, except for "owner" and tracing what else he's got--some scammers are crafty but these days it's all behind a privacy wall anyway. Where it isn't shielded, physical address is mainly useful to get an impression just whereabouts on the globe they are. We could put a lat/lon on there instead.
So most of the data can simply be made not public. I do think that the email and telephone contact points should remain public, and rigorously checked for validity. But the rest? Certainly the individual info in there we can do without.
Oh and by the way, replacing WHOIS by a website is a no-go. In addition is fine, but websites go poorly with command line interfaces. And I still run whois several times a day on systems that don't sport graphics much less a(n oversized stupidly heavy) browser.
Every time I tried to use it to look someone up, the address was always held by some corporation clearly designed to hide that information. I don't think the database has actually been useful for at least a couple of decades.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
When I buy a domain, I can always find a coupon for free or 99 cent WHOIS privacy.
WHOIS is the internet-equivalent of a property registry. If I want to know who owns that building over there, I can go to the township, look in the public records, and find out. This is important, whether it's because you want to buy the building, or perhaps you have a problem with something that is happening there. Sure, in some cases, ownership will be obscured through some intermediate legal entity, but that will still be the responsible legal entity.
WHOIS should be exactly the same thing. If you are interested in a domain - for whatever reason - you should have a way to contact the legal entity responsible for it. Concerns about spam are misplaced - this happens in the physical world as well. There are scammers in the world, news at 11:00.
tl;dr: The domain registries are the property registries of the Internet, and the registrations should be public.
Enjoy life! This is not a dress rehearsal.
I call bullshit on you, or at least in general. Most of the proxy services claim that they keep you from getting spam. However, they forward the e-mails, so they still forward the spam and virus.
Fight Spammers!
What I'm hearing now sounds like a boon for criminals worldwide. Not a good thing.