Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do I secure the domain for my business?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 64 posts

Re: Ask HN: How do I secure the domain for my business?

#51

Post by closeparen »

HWR_14 wrote: post #39
vasco wrote: post #36

Earlier quoted context omitted.

Maybe you should be salty that management thinks "tearing people to pieces" is an appropriate response to an incident before the cause is even known.

> "tearing people to pieces" is an appropriate response to an incident before the cause is even known . Or after the cause is known. Unless maliciously done "tearing someone to pieces" is a strange way to deal with managements training failures, lack of procedures or similar.

Strongly disagree with this sentiment, the point of hiring a professional is that there’s not a manual or a rulebook for every situation they face. You need their creative problem solving skills and good judgement.

Re: Ask HN: How do I secure the domain for my business?

#52

Post by simne »

simne wrote: post #50

The main question if you want to defend from technical issues or from legal, so measures extremely different. For tech, just choose some big registar with good reputation, and use all measures, registar recommends, like 2FA, chrypto-keys, etc. For example my friend register his domain on GoDaddy. For legal issues, it depends on your jurisdiction. For example, in Ukraine we could bye 2nd level domain .ua, if have regi…

For technical issues, I know at least one real case: my friend registered domain and created hosting, as private person, and choose automatic recurrent payment from his credit card. All where ok for more than year.

Once, when should made another automatic payment, happens some technical error, so payment transaction where not successful, and provider immediately removed domain and site, so site disappear and domain becomes non-registered and open to anybody.

Fortunately, site/domain where not very important for him, so in a few days he discovered this, and registered same domain on other registar and recreated site from outdated backups.

As I know, many domain registars now offer special service, it named differently, but idea is the same - for very small additional cost (or even free), when domain registration end, it switched to locked for 30 days or something similar, when nobody else could buy domain and reregister it for themselves, so you will have time to fix issues if they happen. Other registars could in such cases call you to all your contacts, and don't turn off domain for a week or more, so similarly, you have time to make payment or to fix technical issues.

Re: Ask HN: How do I secure the domain for my business?

#53

Post by jfalcon »

davidkuennen wrote: post #15
tough wrote: post #14

Iwould recommend using a company in your jurisdiction, they might be less known, a bit pricier, but will have some kind o customer support in your mother tongue in case things should go wrong. Being a paying customers can do wonders

Yeah, that's propably what I'm gonna do. Currently looking into Hetzner for the domain hosting since I'm from Germany.

I would take a moment to pause and consider the TLD if you're concerned with authorities taking over your domain. Various TLD (.com,.io,.pizza) have different polices regarding termination as well as different legal basis whether or not seizure can be exacted in a given jurisdiction.

I presume all this is for a legitimate business and thus any operator will do.

However, if you get a domain within the top 4-5 TLD (the original TLD of .COM,.NET,.ORG,.EDU,.INT/.MIL/.GOV), all of these domains are ultimately belonging to US incorporated entities or governmental organizations and not any UN operated office thus is not party to the UN charter and the legal avenues afforted to it.

Operationally there is .onion that is non-organizational for the TOR network as well as .I2P for Freenet.

So it may do you well that you get both .de and .com as well as any other .tld you are willing to spend and protect for your brand name as that's what alot of scammers/spammers and marketers will try to redirect traffic into due to mistyped characters. Also for legal/public campaigns that may be counter to your business direction or your client's.

One last thing: There is the whole DNS server aspect of a machine sending out answers to your infrastructure. The domain usually has a locking mechanism that procedually protects the domain from being transferred to another provider at whim. I would spring for the anonymization to prevent social engineering attempts as well as extend your DNS records into DNSSEC to ensure to the world that every answer or call back to your DNS records are flat factual answers that are cryptographically sound. DNS is one of the few things that helps control the chaos doesn't overrun the network.

And be sure to pay your bill on a multiyear basis with reminders at the CTO/CFO level - there is usually a 30-60 day soft hold after the domain expires but it's a regular occurrence with every corporation as to whether or not they catch domains that are important to their image or brand vs. ones simply forgotten and become swiped up for ransom or other possibly unwholesome pursuit.

Cheers!

Re: Ask HN: How do I secure the domain for my business?

#54

Post by wlonkly »

michaelt wrote: post #32
samwillis wrote: post #18

Outside the best practices others are mentioning there are companies that specialise or provide high security domain registration, Mark Monitor are the big one. CloudFlare also offer this type of service. I have no idea how much it costs, would actually love to know if anyone has any experience with any of them? https://www.cloudflare.com/products/registrar/custom-domain-... https://markmonitor.com/

This. You can use 'whois' to find the registrars used by big sites. The registrar for google.com? microsoft.com? netflix.com? ubuntu.com? reddit.com? amazon.com? They all use Markmonitor. Of course, markmonitor aren't perfect: https://news.ycombinator.com/item?id=28351432 Other options include 'CSC corporate domains', the registrar for apple.com and twitter.com - and some companies, like facebook and cloudflare, are…

One problem startups will run into with MarkMonitor and CSC is that they have a substantial minimum initial purchase. If you've got a domain portfolio, then that works out OK because you're just buying additional years on the domains you've already decided to keep, but it makes it impractical to use them for registry-locking one or two domains.

I believe Cloudflare's initial purchase requirement is much lower.

Re: Ask HN: How do I secure the domain for my business?

#55

Post by wlonkly »

YetAnotherNick wrote: post #45
3np wrote: post #42

Apart from what's been said already: One basket per egg. Your registrar should be under different administration from your DNS servers (more than one), which should be different from your service (e-mail/web/etc) host(s). If you want to play it real safe you could get matching names under different TLDs, but only after you've separated the above. This way, either of your nameserver companies closing you off should po…

> our registrar should be under different administration from your DNS servers (more than one), which should be different from your service (e-mail/web/etc) host(s). Wouldn't it increase the risk not decrease it? Now there will be three single point of failure and compromise of any of the three party will result in downtime. In theory, the later two could be recovered or moved but your solution doesn't solve any prob…

Your registRAR's availability doesn't stop your domain from being present at the registRY, but _if_ your DNS provider becomes unavailable you'll be thankful that your registrar is able to change your NS records with the registry.

Re: Ask HN: How do I secure the domain for my business?

#56

Post by HWR_14 »

closeparen wrote: post #51
HWR_14 wrote: post #39

Earlier quoted context omitted.

> "tearing people to pieces" is an appropriate response to an incident before the cause is even known . Or after the cause is known. Unless maliciously done "tearing someone to pieces" is a strange way to deal with managements training failures, lack of procedures or similar.

Strongly disagree with this sentiment, the point of hiring a professional is that there’s not a manual or a rulebook for every situation they face. You need their creative problem solving skills and good judgement.

It's an incident response. That almost always means an error, normally in policy like code review or security. Sure, I expect programmers to be able to write code creatively without having their hands held. But incidents should be prevented with checklists, because that's the best practice to prevent them.

Re: Ask HN: How do I secure the domain for my business?

#57

Post by YetAnotherNick »

wlonkly wrote: post #55
YetAnotherNick wrote: post #45

Earlier quoted context omitted.

> our registrar should be under different administration from your DNS servers (more than one), which should be different from your service (e-mail/web/etc) host(s). Wouldn't it increase the risk not decrease it? Now there will be three single point of failure and compromise of any of the three party will result in downtime. In theory, the later two could be recovered or moved but your solution doesn't solve any prob…

Your registRAR's availability doesn't stop your domain from being present at the registRY, but _if_ your DNS provider becomes unavailable you'll be thankful that your registrar is able to change your NS records with the registry.

Even if you registrar's DNS you could change it in the same way. What would using different DNS acheive?

Re: Ask HN: How do I secure the domain for my business?

#58

Post by jesterson »

tough wrote: post #14

Iwould recommend using a company in your jurisdiction, they might be less known, a bit pricier, but will have some kind o customer support in your mother tongue in case things should go wrong. Being a paying customers can do wonders

Having a smaller player can also make quite unpredictable "wonders", often not the wonders you expect.

Re: Ask HN: How do I secure the domain for my business?

#59

Post by jesterson »

Don't make your infrastructure relaying on single domain then.

You probably don't need all infrastructure to be built on same domain as you build your marketing part (the domain exposed to customers). Have it built around another domain.

You can have all your endpoints to be served from several subdomains, so you can do that as well.

If one domain crumbles, you can switch to use of another one in mere minutes.

Re: Ask HN: How do I secure the domain for my business?

#60

Post by TekMol »

teddyh wrote: post #44
TekMol wrote: post #33

Most advice here seems to be about securing it from yourself. Making sure you do not let someone get your credential via whatever means. I would be more interested in how to secure it from the registrar fucking up? Is there a way to hold a domain so that even when your registrar is being tricked into giving it awway, you can still prevent that or get it back? Or do we have to wait for cryptographically secured owners…

Some registries have a feature called “Registry lock”. This means that a domain cannot be transferred to another registrar without a lot of work to unlock it first.

Is that possible for .com domains?
Post reply on HN