Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Your Domain Have a Registry Lock?

krebsonsecurity.com

Post reply on HN
Print view View original

41–50 of 73 posts

Re: Does Your Domain Have a Registry Lock?

#41

Post by josefresco »

clarry wrote: post #40
parliament32 wrote: post #6

The usual "registrar lock" is the clientTransferProhibited status you see on domains... that's easily removed by social engineering the registrar. "Registry lock" is serverTransferProhibited, the kind where both your registrar and the main registry need to agree to transfer the domain to another registrar. For instance, you can buy a .ca domain from any registrar, but you need CIRA's compliance (the issuing body for…

> that's easily removed by social engineering the registrar. I decided to eliminate that one by becoming my own registrar. And that's one less man in the middle siphoning money off of me.

That seems like an expensive and time consuming solution, unless you have many, many domains.

https://www.quora.com/How-much-does-it-cost-to-become-an-ICA...

Re: Does Your Domain Have a Registry Lock?

#42

Post by belorn »

megous wrote: post #24
mehrdadn wrote: post #7

Confused, how do you get a registry lock then? Do you have to email your registrar? Why is there so little info on this? Or is this the same thing as clientTransferProhibited that is often provided?

You have to deal with the registry directly. Otherwise it's kind of pointless if registrar itself can lock/unlock it. I have registry lock. I just asked my national domain registry to lock the domain. All that was needed was a strong proof of identity. (not just a photo of an ID, but doing a physical verification in person somewhere, like on the post office or sending a notarized letter) It was free. But this is a na…

No, some registrars are still the one that manage the communication with the registry. A big reason for the registry, registrar and registrant model is so that the registry do not interact directly with customers.

It also depend on the type of registry. .se for example allow registrars to set registry lock automatically but not unlock. Unlocking is a manual process and there is contractual conditions that the registrar must have verified the identity of the customer who is requesting the unlock, and the registrar must also sign to that fact. So far no registrar has failed yet to do so, thus the legal ramification of failing this has yet to be tested.

Re: Does Your Domain Have a Registry Lock?

#43

Post by james_pm »

fierro wrote: post #33
james_pm wrote: post #28

PM at a large, retail domain registrar here. Registry Lock isn't something most retail registrars will offer, because generally, the vast majority of registrants don't really need it. It's not something you can just put into your domain management panel and roll out to everyone because of all the hoops required once enabled. That said, Brian Krebs does need it on his domain(s) for obvious reasons - his domain is a ma…

This does not seem like a sound philosophical security posture -- that only domains who are "massive targets for hacking" should use Registry Lock.

It's one of the situations where registry lock is a useful tool with appropriate trade offs. It's far from the only one.

Re: Does Your Domain Have a Registry Lock?

#44

Post by tialaramex »

fierro wrote: post #33
james_pm wrote: post #28

PM at a large, retail domain registrar here. Registry Lock isn't something most retail registrars will offer, because generally, the vast majority of registrants don't really need it. It's not something you can just put into your domain management panel and roll out to everyone because of all the hoops required once enabled. That said, Brian Krebs does need it on his domain(s) for obvious reasons - his domain is a ma…

This does not seem like a sound philosophical security posture -- that only domains who are "massive targets for hacking" should use Registry Lock.

Why? It's about threat models.

Re: Does Your Domain Have a Registry Lock?

#45

Post by toast0 »

jiveturkey wrote: post #4

I was never aware of this, and it appears only a tiny handful of TLDs support it. I think BK is overstating the case: > a more stringent, manual (and sometimes offline) How is it more stringent? Who's to say the registry (eg verisign) will do any more stringent of an unlock process than the registrar?

I've managed domains witha registry lock. It may depend on the registry, but when my boss didn't answer the validation call, the domain didn't get unlocked and we had to wait for the next day's change window (and remind the boss to pick up the phone) to get our nameservers changed.

I'm sure it's still possible to social engineer (it's a human driven process), but there are a lot fewer people authorized to make the changes, and they're probably better trained.

Re: Does Your Domain Have a Registry Lock?

#46

Post by belorn »

omarhaneef wrote: post #8

Wow. Some random person was able to move a domain to their own account simply by whatsapp ing the registrar, telling them that they had bought the domain and were having trouble moving it. That's it. It makes me realize that Google's no humans policy -- is it a policy? -- is actually a strength here. My domains purchased through Google are safe from social engineering because, well, there are no humans to contact to…

If google servers decided tomorrow to shut down your domain, because the anti-fraud algorithm decided that the use of the domain has patterns which it decided is indicative of fraud, what would you do? All there is a computer saying that it de-registered the domain name and all the support options becomes a circle of the computer saying that it de-registered the domain name.

To me that is a risk. Through I have no evidence for this, I think that the false positives of those algorithms are higher than the risk of a hacker managing to social engineer a high end registrar. The reason I think so is that there is very little incentive for google to eliminate false positives but a huge one for eliminating false negatives.

Re: Does Your Domain Have a Registry Lock?

#47

Post by kofejnik »

this is one of the things that Russians got right; you had to show up in person (and show your passport), or provide a notarized sale contract, if you want to transfer a .ru domain. At least that's how it used to be, could be different now

Re: Does Your Domain Have a Registry Lock?

#48

Post by wdb »

Ah yes, domains, my dad registered a domain for me and when he passed away; we missed a payment and the registrar swiftly decided to release the domain and now I lost it. Gone is my [firstname].com now the current owner of the domain tries to buy [firstname] from me on insta, twitter etc.

Re: Does Your Domain Have a Registry Lock?

#50

Post by ryanlol »

RileyJames wrote: post #34
reflectiv wrote: post #31

Earlier quoted context omitted.

What happened, if I may ask? I use both enom and google...so, I am curious...

Just guessing, but the "extortion" fee's are likely due to renewing the domain after it has 'expired', during one of the last chance renewal phases. https://help.enom.com/hc/en-us/articles/115003360647-Renew-E... https://www.enom.com/kb/kb/kb_1487-last-chance-renew.htm There is a whole process via which domains expire, they do not simply become available to register upon their 'expiry' date. Full process is outlined…

>”extortion”

Why the scare quotes?

Post reply on HN