Some Important Registrar Security Suggestions

[Ms Domainer]

*

In light of the recent domain hijackings, I thought I would start a thread that could build on two levels of security for protecting our domains from thieves:

1. The Registrar Level

2. The Domain Owner Level​

I think that we can all agree that we want all our domains to be as safe as possible, and, therefore, I believe that both owner and registrar ought to bear some reasonable responsibility to make that happen.

Feel free to add and even challenge my suggestions--I tend toward more draconian measures to protect my assets--you may feel differently, and that's okay.

So here are some suggestions that I made to my account rep (The Registrar Level):

1. To warn customers that using "freebie" email addresses from gmail, yahoo, and other free providers may cause a security breach. I would suggest to customers that they should use a personal domain-based email, easy enough and well-protected if one uses a different password for each Godaddy email.

Evidently, gmail is especially vulnerable to hacking.

Of course, if one falls for a phishing email or jumps on a malware website without virus protection, well there isn't much you can do about stupidity.

As I was updating my Whois records, I found the process all too easy; given where I am, I would have thought that my IP would have raised a huge red flag, but apparently not. Only at Dynadot did I have to do another step to verify my account info (but not my Whois info).

2. Registrars might want to consider requiring that the account email be different from the Whois email and create another step before one can make changes on Whois, account records, or initiate transfers, which would require one to do another sign-in, using the account email as the user name and yet another password. Of course, this would require due diligence on the customer's part not to use an account email that is splattered all over the web. That way, hacking would be all that much more difficult. With all the free emails (free with each domain) that some registrars offer, this shouldn’t be a problem. One just has to keep good records and create strong passwords.

3. When you send out the email that warns of changes made on one's whois and/or account or transfer initiations, REQUIRE the owner to acknowledge those changes via the OLD email contact before the change can actually take place.

If that's not possible (dead email address or password breach, for example), require the owner to call in (to a special 800 number or international number) with that pin number or secret word that we all set up and account email.

If there has been a password breach that has precipitated the change, then the owner should call in to a special number for such problems where the domain representative can help the owner.

I would be willing to put up with this level of security if I felt that my domains were being protected. Making the warning email merely passive just opens up an entire area of vulnerability for everyone.

For example, some customers may end up losing their domains during a time when they are away from an internet connection (which is why I never announce on the internet vacations where I know I won’t have internet access, but maybe others aren’t so paranoid).​

At the Domain Owner Level:

1. Never use free email addresses, such a gmail, yahoo, etc. for a Whois address. Use personal domain-based address, even if you have to pay for it. It's cheap insurance.

2. If possible, use different email addresses for your registrar account/billing info and your Whois information.

3. Forward another address to your Whois email address, but make sure that you "test" it first. You need to receive your emails from the registrar.

4. Be sure to put your registrar email addresses on your "allow" list.

5. Use a forward address in your whois--that way, you will still receive queries, but your actual Whois email address will be less public. Keep your real Whois email as private as possible by using (as the public address) a forwarding address. The PUBLIC Whois email would "mask" the real address from scammers.

6. Don't use your Whois and account addresses for anything but Whois business and account business; in other words, don't give it to friends, family, forums, gaming sites, free products, and strangers. Use a "fun" email for those activities.

7. Use strong virus, etc. protection. It doesn't pay to be cheap here. that way, if you end up on a malware site, your protection will disable the offending page.

8. Avoid logging in on strange computers (internet cafes and unsecured wireless accounts).

9. Use strong passwords.

10. Never click on an email link, no matter how professional or familiar it looks, for example, eBay, GoDaddy, your bank, etc. Go straight to the site itself for more information.

11. Answer whois queries using a different email. I actually set up a Query Box (courtesy of widgetbox, bless them) on my sales landing page (domainmaybeforsale [dot] com), using a different email from my whois. If the potential buyer is just nosy, it won't matter; if he/she is a scammer, it matters a lot. The idea is to keep your "real" Whois email as secret as possible, while still being accessible via Whois​

If you have anything else to add, please feel free. I think we all want the same thing and that is to stop these scammers from stealing our domains.

:bingo:

*

 

[Name Trader]

Thanks. After reading this I changed my Registrar eMail account to something different to my Whois eMail account. Admittedly, they're both gMail accounts, but I personally don't have a problem with that.

 

[RLW]

If that's not possible (dead email address or password breach, for example), require the owner to call in (to a special 800 number or international number) with that pin number or secret word that we all set up and account email.

I'm not a fan of this idea. It would be way too much hassle to have to call an overseas number from where I am.

I've never understood why WHOIS data is public? Why not just stop making WHOIS data publicly available? Or available through some sort of subscription service, where anyone requesting WHOIS info has to have their identity verified?

 

[Ms Domainer]

I'm not a fan of this idea. It would be way too much hassle to have to call an overseas number from where I am.

I've never understood why WHOIS data is public? Why not just stop making WHOIS data publicly available? Or available through some sort of subscription service, where anyone requesting WHOIS info has to have their identity verified?

*

I certainly can appreciate that calling in to confirm a change has its drawbacks, especially for those less valuable domains that you just want to flip.

However, for valuable domains (for example, loans.com) might it not be good insurance?

At some registries, one can pay for extra protection. I can't see doing this for EVERY domain, though.

I think making the entire Whois private is not a good idea--it would just about kill this industry and actually increase the number of thefts because no one would know who owned what. How could you sell a domain? How could you verify ownership of a domain that you want to buy? Still, there's no denying it: public Whois IS a vulnerable spot, a rich playing ground for spammers and scammers.

Some vulnerabilities that I see at the registrar level:

1. At Dotster, you can use any one of your domain names as a sign-in--in my opinion, this is a BAD idea. One's user ID should not be so public.

2. At Domainmonster, you use your account email address as your user ID to sign in. In this case, one's Whois email should be separate from the account email. It's a bad idea to use your account email for your Whois.

3. At GoDaddy, your secret word and your PIN number are accessible after you have signed in. If someone hacks your account, they will have access as well.​

At all registrars, there are two major points of vulnerability: the sign-in point and Whois email address. Unfortunately, there isn't much you can do to change that except take personal measures: strong password, email forwarding, separate email addresses for accounts and Whois, and using these emails strictly for domain business and not anything else.

As owners, we can't do much about registrar vulnerabilties (except vote with our feet), but, perhaps, we can take some personal measures to help our domains safe.

Thanks to those who have responded to this thread so far.

Any other suggestions?


*

 

[ff89]

nice post,veery helpful

 

[Ms Domainer]

*

Thanks, ff89.

I just thought of something else as well.

For domain-based email (such as me [at] mydomain [dot] com) I suggest that for both the Whois and account email that one should NOT set the email to be a catch-all. In other words, any mail sent to any address except at "me [at] mydomain [dot] com" should bounce. That way, you can avoid the spammers and scammers who are simply "guessing" your address. There is nothing in the ICANN rules that says your email has to be a catch-all.

Catch-all addresses are a bad idea anyway; one of my domains ended up on the blacklist because some doofus was using my domain address and its infinite variations to send out mass emails (he wasn't using my actual email account, but was spoofing it somehow).

I got off the blacklist, but I had to change my email settings and then beg to get off the list. Not fun.

*