Live data from Hacker News

Find every domain someone owns automatically

securitytrails.com

51–60 of 110 posts

Re: Find every domain someone owns automatically

#51
post #49

Earlier quoted context omitted.

thanks for the note and testing. Would love to dig into any specific use cases so we can see whats going on. chris at securitytrails.com

Try damsteen.nl for instance, my blog, it shows no whois at all.

got it - thanks!

Re: Find every domain someone owns automatically

#53
The results page should always show what your search term was. Currently it only shows this when the search finds something. If nothing is found, all it does is tell you that nothing was found.

That leaves you with no way to check to make sure you entered the right term, other than typing it again. If you are typing it right but auto-correct is kicking in when you hit enter, even trying again might fail because your site responds fast enough that you might not have time to notice the change before the results page comes up.

Also, it might be helpful when someone searches for a domain at a TLD that you do not support to say on the results page that the TLD is not supported.

Re: Find every domain someone owns automatically

#54

Earlier quoted context omitted.

You say fun, but in the era of swatting and doxxing, private registrations are often the first line of defense for those who don't have a USPS or ups mail address if they don't have a physical office/address. I would be very careful about how you responsibly disclose any such bugs.

Good point. Poor word choice on my end. Thanks for the note. The stuff we found is not quite that abrasive but very interesting. How would you recommend disclosing?

Let the providers fix it. Contact the people potentially affected if you can.

Re: Find every domain someone owns automatically

#58

How do you plan on handling the EU’s “right to be forgotten” (it’s pretty straightforward to make the argument you’re a search engine) and other components of the GDPR?

Haven't really explored this. Any feedback or ideas is appreciated!

You should read up on GDPR urgently. It applies to anyone anywhere in the world processing data of EU citizens and has some massive penalties for things like not asking for specific informed consent and not offering an opt out. Using the excuse that you're just aggregating public data does not cut it.

Re: Find every domain someone owns automatically

#59

How do you plan on handling the EU’s “right to be forgotten” (it’s pretty straightforward to make the argument you’re a search engine) and other components of the GDPR?

"The right to erasure" is not an absolute right for anyone to get all their data deleted. If the data owner (read: the registrars) still have a legal right to collect and maintain the data public and it has not been revoked one could argue that they (security trails) don't have to remove the data.

It's my understanding that the registrars are the ones with the burden here. They need to inform everyone of the data erasure and/or data updates on private information. Fun times when you have public information for anyone to gather on the internet. It could be that there are exemptions for these kind of services, I do not know, but would the exemption not also include the services that aggregate/collect historic information as well?

Disclaimer; I am not a lawyer. I am not well versed in GDPR. Anyone finding this interesting should go read up on GDPR.

Re: Find every domain someone owns automatically

#60
post #53

The results page should always show what your search term was. Currently it only shows this when the search finds something. If nothing is found, all it does is tell you that nothing was found. That leaves you with no way to check to make sure you entered the right term, other than typing it again. If you are typing it right but auto-correct is kicking in when you hit enter, even trying again might fail because your…

+1 on search term! And if you enter a domain that doesn't exist, it throws you back to the homepage with no way to fix it :(

Another feature request: When entering an IP, there's very little information available on it (only the hosting provider). Would be nice to get latlong, country etc (a la https://www.iplocation.net/).

Because seriously, that is an insanely cool database. I can even find all the sites that share my domain's Cloudflare IPs.

Post reply on HN