Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Your Domain Have a Registry Lock?

krebsonsecurity.com

Post reply on HN
Print view View original

51–60 of 73 posts

Re: Does Your Domain Have a Registry Lock?

#51

Post by megous »

belorn wrote: post #42
megous wrote: post #24

Earlier quoted context omitted.

You have to deal with the registry directly. Otherwise it's kind of pointless if registrar itself can lock/unlock it. I have registry lock. I just asked my national domain registry to lock the domain. All that was needed was a strong proof of identity. (not just a photo of an ID, but doing a physical verification in person somewhere, like on the post office or sending a notarized letter) It was free. But this is a na…

No, some registrars are still the one that manage the communication with the registry. A big reason for the registry, registrar and registrant model is so that the registry do not interact directly with customers. It also depend on the type of registry. .se for example allow registrars to set registry lock automatically but not unlock. Unlocking is a manual process and there is contractual conditions that the registr…

Different countries, different rules.

Re: Does Your Domain Have a Registry Lock?

#52

Post by eyegor »

0xff00ffee wrote: post #16
omarhaneef wrote: post #8

Wow. Some random person was able to move a domain to their own account simply by whatsapp ing the registrar, telling them that they had bought the domain and were having trouble moving it. That's it. It makes me realize that Google's no humans policy -- is it a policy? -- is actually a strength here. My domains purchased through Google are safe from social engineering because, well, there are no humans to contact to…

AWS Route53 user chiming in here. I have IAM accounts and soft-token 2FA, and I like how minimal the R53 panel is. This makes me feel like I have a handle on things because there are so few paths to make changes. It also makes me worried I'm missing something. 7 years and no hacks (that I've detected). Knock on wood.

I'm guessing your domain wasn't a huge target then. There was a dns hijacking bug in r53 like 3-4 years ago that was fairly trivial to use. It allowed an arbitrary attacker to register new records to redirect your traffic and take a higher priority in the routing table. I probably shouldn't say much more about it because I don't think it was publicized after they fixed it.

Re: Does Your Domain Have a Registry Lock?

#53

Post by eyegor »

clarry wrote: post #40
parliament32 wrote: post #6

The usual "registrar lock" is the clientTransferProhibited status you see on domains... that's easily removed by social engineering the registrar. "Registry lock" is serverTransferProhibited, the kind where both your registrar and the main registry need to agree to transfer the domain to another registrar. For instance, you can buy a .ca domain from any registrar, but you need CIRA's compliance (the issuing body for…

> that's easily removed by social engineering the registrar. I decided to eliminate that one by becoming my own registrar. And that's one less man in the middle siphoning money off of me.

How does that work?

Re: Does Your Domain Have a Registry Lock?

#54

Post by kube-system »

ryanlol wrote: post #50
RileyJames wrote: post #34

Earlier quoted context omitted.

Just guessing, but the "extortion" fee's are likely due to renewing the domain after it has 'expired', during one of the last chance renewal phases. https://help.enom.com/hc/en-us/articles/115003360647-Renew-E... https://www.enom.com/kb/kb/kb_1487-last-chance-renew.htm There is a whole process via which domains expire, they do not simply become available to register upon their 'expiry' date. Full process is outlined…

>”extortion” Why the scare quotes?

The person you're replying to is quoting another comment above and I am guessing they might not agree with the legal connotation the word carriers.

Re: Does Your Domain Have a Registry Lock?

#55

Post by swiley »

wdb wrote: post #48

Ah yes, domains, my dad registered a domain for me and when he passed away; we missed a payment and the registrar swiftly decided to release the domain and now I lost it. Gone is my [firstname].com now the current owner of the domain tries to buy [firstname] from me on insta, twitter etc.

Names are hard, I was pretty bummed when I stopped being able to use swiley in #bitcoin-otc (I think because I lost a key or messed up with the nickname server)

Re: Does Your Domain Have a Registry Lock?

#56

Post by kube-system »

fierro wrote: post #33
james_pm wrote: post #28

PM at a large, retail domain registrar here. Registry Lock isn't something most retail registrars will offer, because generally, the vast majority of registrants don't really need it. It's not something you can just put into your domain management panel and roll out to everyone because of all the hoops required once enabled. That said, Brian Krebs does need it on his domain(s) for obvious reasons - his domain is a ma…

This does not seem like a sound philosophical security posture -- that only domains who are "massive targets for hacking" should use Registry Lock.

Security and usability is always a compromise. Otherwise we'd all use one-time pads for everything on the internet.

Re: Does Your Domain Have a Registry Lock?

#57

Post by t223 »

duxup wrote: post #23
omarhaneef wrote: post #8

Wow. Some random person was able to move a domain to their own account simply by whatsapp ing the registrar, telling them that they had bought the domain and were having trouble moving it. That's it. It makes me realize that Google's no humans policy -- is it a policy? -- is actually a strength here. My domains purchased through Google are safe from social engineering because, well, there are no humans to contact to…

The no humans thing also just closes off any path for exceptions that occur outside of what is coded. I bought a domain for a blogger blog ages ago. At the time google had no domain registry so they partnered with some company. Years later and google starts hammering me with "hey your credit card is expired we're not going to renew your domain" ... Fine right? "Hey go update your payment information on admin.google.c…

I had a similar circular issue with Google. I solved it by shoulder tapping my GCP sales rep who pulled some strings. Luckily my company spends quite a bit so I had a back door. Without that or a twitter following I think you’re fucked.

Re: Does Your Domain Have a Registry Lock?

#58

Post by newscracker »

clarry wrote: post #40
parliament32 wrote: post #6

The usual "registrar lock" is the clientTransferProhibited status you see on domains... that's easily removed by social engineering the registrar. "Registry lock" is serverTransferProhibited, the kind where both your registrar and the main registry need to agree to transfer the domain to another registrar. For instance, you can buy a .ca domain from any registrar, but you need CIRA's compliance (the issuing body for…

> that's easily removed by social engineering the registrar. I decided to eliminate that one by becoming my own registrar. And that's one less man in the middle siphoning money off of me.

Quite interesting. How did you do that and what did it take (cost, time, effort)? NearlyFreeSpeech.net started off on this a couple of years ago, and it seems like this is a very costly proposition (something like $80K for accreditation?) that also takes a lot of time.

Re: Does Your Domain Have a Registry Lock?

#59

Post by bhartzer »

I usually register my important domains for several years in the future, and have the register lock on. Some registrars call it transfer lock.

I also Backorder my own domains on namejet, GoDaddy, etc just in case they ever do expire there’s still a chance to get them back.

If only there was a company that offered domain name insurance, to make sure you never lose your domain, it’s never stolen, dns isn’t hijacked, and the site never goes down (ddos attacks, etc.).

Re: Does Your Domain Have a Registry Lock?

#60

Post by ta999999171 »

bhartzer wrote: post #59

I usually register my important domains for several years in the future, and have the register lock on. Some registrars call it transfer lock. I also Backorder my own domains on namejet, GoDaddy, etc just in case they ever do expire there’s still a chance to get them back. If only there was a company that offered domain name insurance, to make sure you never lose your domain, it’s never stolen, dns isn’t hijacked, an…

What would they do if it was?

How much money would make you forget about it?

Post reply on HN