Does Your Domain Have a Registry Lock?
krebsonsecurity.com
Does Your Domain Have a Registry Lock?
1–10 of 73 posts
Re: Does Your Domain Have a Registry Lock?
#2So according to the article, there is:
1) "registrar lock" - a service that requires the registrar to confirm any requested changes with the domain owner via whatever communications method is specified by the registrant.
2) "registry lock" - with a registry lock in place, your registrar cannot move your domain to another registrar on its own. Doing so requires manual contact verification by the appropriate domain registry.
So... I assume the "lock thingy" within most registrars' interfaces (I'm familiar with the one within Namesilo, the registrar I use), is the less restrictive "registrar lock" ?
Re: Does Your Domain Have a Registry Lock?
#3So according to the article, there is: 1) "registrar lock" - a service that requires the registrar to confirm any requested changes with the domain owner via whatever communications method is specified by the registrant. 2) "registry lock" - with a registry lock in place, your registrar cannot move your domain to another registrar on its own. Doing so requires manual contact verification by the appropriate domain reg…
Yes, generally the lock you see is the simple registrar lock.
Re: Does Your Domain Have a Registry Lock?
#4I was never aware of this, and it appears only a tiny handful of TLDs support it. I think BK is overstating the case:
> a more stringent, manual (and sometimes offline)
How is it more stringent? Who's to say the registry (eg verisign) will do any more stringent of an unlock process than the registrar?
Re: Does Your Domain Have a Registry Lock?
#5I'm not able to find a registry lock on google domains. There is a lock feature but i'm assuming that is a registrar lock
Re: Does Your Domain Have a Registry Lock?
#6The usual "registrar lock" is the clientTransferProhibited status you see on domains... that's easily removed by social engineering the registrar.
"Registry lock" is serverTransferProhibited, the kind where both your registrar and the main registry need to agree to transfer the domain to another registrar. For instance, you can buy a .ca domain from any registrar, but you need CIRA's compliance (the issuing body for all of .ca) to enact a registry lock. This explains it a bit better: https://cira.ca/ca-domains/optimize-your-ca/registry-lock
I'm having trouble tracking down how to do this for a .com though.
Re: Does Your Domain Have a Registry Lock?
#7Confused, how do you get a registry lock then? Do you have to email your registrar? Why is there so little info on this? Or is this the same thing as clientTransferProhibited that is often provided?
Re: Does Your Domain Have a Registry Lock?
#8Wow. Some random person was able to move a domain to their own account simply by whatsapp ing the registrar, telling them that they had bought the domain and were having trouble moving it.
That's it.
It makes me realize that Google's no humans policy -- is it a policy? -- is actually a strength here. My domains purchased through Google are safe from social engineering because, well, there are no humans to contact to ask them to manually move domains.
(p.s. That is not some kind of dare to hackers! I am not suggesting you prove me wrong.)
Re: Does Your Domain Have a Registry Lock?
#9Wow. Some random person was able to move a domain to their own account simply by whatsapp ing the registrar, telling them that they had bought the domain and were having trouble moving it. That's it. It makes me realize that Google's no humans policy -- is it a policy? -- is actually a strength here. My domains purchased through Google are safe from social engineering because, well, there are no humans to contact to…
Google Domains does have phone/chat/mail support but I still would like to believe that their security practices are solid enough that they wouldn't fall for this most basic of social engineering attacks.
Re: Does Your Domain Have a Registry Lock?
#10I'm not able to find a registry lock on google domains. There is a lock feature but i'm assuming that is a registrar lock
Probably because the manual management of these requests is relatively expensive.