Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Do not let your domain expire with Google Apps

benreyes.posterous.com

Post reply on HN
Print view View original

51–60 of 70 posts

Re: Do not let your domain expire with Google Apps

#51

Post by giberson »

jacques_chester wrote: post #38
giberson wrote: post #32

While it may add an extra step on their end process wise, it seems like the obvious solution to this matter is to simply enact a policy such that if domain ownership changes hand the associated accounts are reset unless a signed transfer of ownership and proof of identity is provided by the original owner.

Everything I've ever read about Google's customer support infrastructure is that they don't "do" person-to-person transactions. Hardcopy? You must be joking.

I was simply supplying what a solution was--which has nothing to do with Google's likelihood to implement it.

Re: Do not let your domain expire with Google Apps

#52

Post by DenisM »

megamark16 wrote: post #21

It took me about 10 minutes to write a python script that grabs a list of recently expired domains and checks each domain to see if it's a valid Google Apps domain. This is a pretty serious issue, if indeed it's still possible to take ownership of accounts as the article suggests. Hopefully Google has added some mitigating steps to keep this sort of thing from happening.

How do you verify if a domain has a google apps account? I actually need this for a different, legitimate purpose.

Re: Do not let your domain expire with Google Apps

#53

Post by giberson »

jonknee wrote: post #40
giberson wrote: post #32

While it may add an extra step on their end process wise, it seems like the obvious solution to this matter is to simply enact a policy such that if domain ownership changes hand the associated accounts are reset unless a signed transfer of ownership and proof of identity is provided by the original owner.

That sounds like an awful idea. If you update your Whois information all of a sudden all your Google Apps data gets deleted? I'd be furious.

I hadn't considered the case of updating whois information. However, to resolve that issue I'd simply provide a mechanism where you could flag your account as pending an authorized whois update. Then, when the whois is updated, google would not take any action since the update was pre-approved by yourself.

Re: Do not let your domain expire with Google Apps

#54

Post by gregable »

giberson wrote: post #32

While it may add an extra step on their end process wise, it seems like the obvious solution to this matter is to simply enact a policy such that if domain ownership changes hand the associated accounts are reset unless a signed transfer of ownership and proof of identity is provided by the original owner.

I suspect the real problem here is that identifying when ownership has changed is pretty much impossible unless you are the registrar. Assuming you could even fetch them (they probably are rate limited) the whois record could change without indicating an ownership change or even the DNS could change without indicating an ownership change. Also, even if there was no change in these records, the owner might have changed. The new owner, if an attacker, could put the same data into the whois record and use the same DNS records. The domain may never even "expire" officially with some registrars letting a new owner grab a domain before the official expiration drop.

I assume the previous owner probably has some mechanism for deleting the accounts that are currently on Google Apps. If that's so, then it seems reasonable that it's their responsibility to do so.

Re: Do not let your domain expire with Google Apps

#56

Post by megamark16 »

DenisM wrote: post #52
megamark16 wrote: post #21

It took me about 10 minutes to write a python script that grabs a list of recently expired domains and checks each domain to see if it's a valid Google Apps domain. This is a pretty serious issue, if indeed it's still possible to take ownership of accounts as the article suggests. Hopefully Google has added some mitigating steps to keep this sort of thing from happening.

How do you verify if a domain has a google apps account? I actually need this for a different, legitimate purpose.

The off the cuff way I was doing it was to go to https://mail.google.com/a/DOMAIN_NAME/ and see if I get a login screen or an error saying that the domain wasn't using google apps.

Re: Do not let your domain expire with Google Apps

#57

Post by DenisM »

megamark16 wrote: post #56
DenisM wrote: post #52

Earlier quoted context omitted.

How do you verify if a domain has a google apps account? I actually need this for a different, legitimate purpose.

The off the cuff way I was doing it was to go to https://mail.google.com/a/DOMAIN_NAME/ and see if I get a login screen or an error saying that the domain wasn't using google apps.

I see. Some domains use SAML authentication, so it doesn't work as well for them. E.g. uw.edu

Re: Do not let your domain expire with Google Apps

#58

Post by lukeschlather »

jacques_chester wrote: post #38
giberson wrote: post #32

While it may add an extra step on their end process wise, it seems like the obvious solution to this matter is to simply enact a policy such that if domain ownership changes hand the associated accounts are reset unless a signed transfer of ownership and proof of identity is provided by the original owner.

Everything I've ever read about Google's customer support infrastructure is that they don't "do" person-to-person transactions. Hardcopy? You must be joking.

That seems to square with my experience. Google Apps is free for nonprofits up to 3000 users, though they start you out with something like 100. I hit the "request more users" button and I was up to 500 almost instantly (though it said "we'll get back to you" after I hit the button.

Re: Do not let your domain expire with Google Apps

#59

Post by jonknee »

giberson wrote: post #53
jonknee wrote: post #40

Earlier quoted context omitted.

That sounds like an awful idea. If you update your Whois information all of a sudden all your Google Apps data gets deleted? I'd be furious.

I hadn't considered the case of updating whois information. However, to resolve that issue I'd simply provide a mechanism where you could flag your account as pending an authorized whois update. Then, when the whois is updated, google would not take any action since the update was pre-approved by yourself.

That's still about the worst way to handle it. A change in one unrelated area can completely wipe out services in another. Just to protect against the edge case that you didn't delete your account, want to keep your data protected and let your domain expire and be registered by someone else. Don't hurt legit customers to protect a fool.

Re: Do not let your domain expire with Google Apps

#60

Post by jacques_chester »

mtogo wrote: post #49
jacques_chester wrote: post #42

Earlier quoted context omitted.

The main reason for IANAL, TINLA is that lawyers have attorney's immunity, and joe shmoe does not. If somebody relies on my opinion as if it is legal advice and from the circumstances it looks like legal advice, I can be in deep poop if the advice was wrong.

You can say shit on the internet.

I see your point. The law does not.

I use the same disclaimer on websites, in email, over the phone or down at the pub.

Post reply on HN