What Is Going to Happen With Whois? | Hacker News Reader

What Is Going to Happen With Whois?

motherboard.vice.com

55 pointsdanso55 comments

How does this threaten the security or privacy of the Internet _at all_? Whois data isn't accurate even by horrible standards. They've tried to make it more stringent but I have domains of mine with the wrong address that I'm too lazy to update and it's been wrong for years now. No problem for my Whois records. And to get around whois records, if we as owners of domains want privacy, we have to deal with shady companies that effectively take control of our domain's ownership. Great for selling whois privacy products, but not at all good for internet security.

SSL certificates already aren't good enough to prove the legitimacy of an organization, not even EV ones. Why Whois data would be any use is beyond me.

I find whois data less useful every day. 90% of the time when I'm researching suspicious domains, it maps back to one of those shady companies, and the malware author hiding behind it doesn't care about handing over ownership of his disposable DGA domains to said shady company.

Even legit sites are starting to hide whois data behind privacy proxies. Hijacked sites only ever map back to a victim, not the perpetrator. As part of my investigative workflow it's largely a waste of time to whois anything.

It seems to only benefit domain squatters and spammers.

> if we as owners of domains want privacy, we have to deal with shady companies that effectively take control of our domain's ownership.

Some domain name providers, such as Gandi, offer privacy of address, phone, and email data while leaving your name as the owner of record.

I do use Gandi and trust them, but I'm not sure if this is 100% possible. Gandi still has limitations that largely depend on TLDs.

I use only NearlyFreeSpeech.net (a web host that also provides domain registration), and its planning to do domains by itself sometime in the future. I like its no nonsense and practical policies.

I think it is weird to have a physical address for a domain. At least that should be optional.

Definitely is a pro-company and anti-individual concept. If you are a company no problem using your address. As an individual it is not private, do you want people who hate your site knocking at your door and your kid answers?

Then namecheap as whois guard and all that. Extra rent you have to pay to keep your privacy!

You can always use a PO Box, as I've done in the past. Extra rent, but useful.

Lao Tzu says that in preparing a defense you welcome an enemy. If we create from our thought and intent, why would we take steps? This thinking instantly puts most people into fear mode, but when you live it and nothing happens fear totally loses any gravity, these discussions are tiresome. People ramdomly go crazy and target people on the internet probably less often than home invasions on houses with unlocked doors. But again quantitative analysis brings us back into the fearful analysis mode and out of abundant loving mode. Hard idea to explain, and my analytical brain comprehends the woowoo, but woowoo is critically important in that thought.

It's not only about some trolls targeting the content creators. It's also about government, government officials and large (ethically challenged) corporations and "organized crime" that one needs to be on guard against. Even if you host with a provider in another jurisdiction who will resist revealing your information, the WHOIS data is a sitting duck. I don't think this piece of advice from Lao Tzu applies to our post-Snowden world. Definitely not for people who are against the powers that be (and on whom healthy democracies depend on).

Or http://www.fakenamegenerator.com/

I disagree. That kind of anonymity is a false sense of security. Crazy people who are going to knock on your door are going to find you.

I’ve had my street address on my domains for two decades now. All it does is save would be crazy people 10 minutes of googling, as there are searchable public records of home ownership.

I think you're overestimating how much effort the average adversary will put in to find this information. Sure, some will hunt you down and try and find you via real life databases like home ownership records. But many will just hope they can take advantage of easily found information like WHOIS records, in the same way many burglars just hope a doors been left unlocked or a window left open.

Unless someone's gotten into a fight with 4chan or Kiwi Farms, the chances of someone actually hunting them down like an internet detective is pretty slim.

Showing up at somebody’s front door is a big line to cross.

Like dumping a toilet in a driveway because some database pointed you there?

https://splinternews.com/how-an-internet-mapping-glitch-turn...

Not only that, there's also swatting.

The problem with swatting is not that you can find people’s home address. It’s that with an anonymous phone call you can send hyped up untrained dangerous fake army men to someones house with no repercussions for you or the team.

Hiding your home address is just a workaround.

What's your home address?

You can find it in the Whois information for my domain

That's too much effort. I guess your workaround worked after all.

There is a difference between not connecting this account to my real life identity and keeping my address a secret. If you knew my name you can just look up my phone number and address in the public phone book.

Having a physical address for a domain gets even worse because there are country TLDs that mandate providing a real address as a condition for buying and holding a domain with those ccTLDs.

We deserve to know how public resources are owned and allocated. Whether it’s land, RF spectrum, or a corporation, ownership being public record is an important part of the social contract. Domains may be too opaque, but completely removing any semblance of transparency only makes it worse.

> ownership being public record is an important part of the social contract.

This is silly. Public ownership records are a practical utility, not a deep-rooted moral practice.

Incidentally, we’ve figured out how to have digital asset ownership without invoking “the social contract” or any of its many connotations; we have blockchains now. Namecoin solved this exact problem, although it never took off.

>not a deep-rooted moral practice.

How do you think the Freedom of Information Act got there? It may be going out of fashion, but many of us do believe that the workings of public institutions should be transparent because we value transparency itself. The public record would be much smaller if pragmatism were the only reason to make something public record.

ICANN (or whatever supplants it, like Namecoin) is the Register of Deeds of the internet.

Governments and larger corporations, which are generally a lot more powerful than individuals, ought to be forced to be transparent to individuals, and not the other way around. Anything on the former is welcome. Anything on the latter needs stronger justifications.

Ownership of a zero-sum resource like land, spectrum, or DNS is the most fundamental form of power.

Thank god. I get somewhere between 2 and 10 spam emails to my dedicated whois address every day. Requiring the publication of email addresses with every domain is absurd and serves no purpose.

It made sense in the beginning.

Yes, but it hasn't made sense in a long time

I don't get so much spam mail as I do phone calls - quite often from real call centers with real people asking about what sites they could create for me on the domains.

I have been very tempted to register an ultra offensive sounding domain name just to get someone at a call center to ask me about it by name :-D

Interesting. I have a DID that routes to nowhere on all my domain's whois, maybe I should route it somewhere and see what happens.

I know where you should route it to.. https://www.reddit.com/r/itslenny/

Meh, I prefer something I can operate/monitor. The guy who runs that is very secretive about all of his setup, to "prevent abuse" (unclear what sort of abuse he's afraid of), but highly opposed to others building their own.

Fair enough, I didn't necessarily mean that server. It's true that he's secretive about his setup, but I wouldn't say he's highly opposed to others, after all he's the mod of the subreddit and yet people can freely discuss how to setup their own.

I own a handful of domains and have my real contact info in all of them. Aside from annual postal (!) mail from registrars offering to renew them at about 10x the normal price, I don't really get any spam from these that I've seen.

I never answer the phone if the caller ID is unknown, so I may be missing some there also.

Yeah, I was going to chime in. I've had an accurate whois for my domains since the early 2000s and at most I get a couple pieces of junk mail around renewal time. No idea if I get any spam from it, the spam filter seems to do a good enough job of junking that.

The idea of hiding the contact information never quite made sense to me. If you're a business, then you already have to provide an address of record to the state for certified mail to go to.

If, as a private citizen, I am running a controversial website then there are already institutes in place that will receive, process, and provide anonymity for your physical mailing address.

Yeah. My anecdote about this is that I've used completely fake info to register at least 1 domain name with an EU TLD with EU registrars that supposedly required residency or some physical presence in the associated countries, with no repercussions. At least regarding whois info, this new law seems consistent with actual usage patterns without enabling more harm.

I get something like 100 spam emails, and half a dozen spam SMSes every single day, then 2-5 phone calls a week. That's just from a couple of domains where I hadn't noticed PrivacyGuard had lapsed.

The emails can be blocked easily, but the SMSes don't come from a number, they just have a random word in the "From" field and they use a random one each time, meaning blocking the "sender" is useless. They also come at all sorts of hours, so I can get 2-3 SMSes at 4am advertising Amazon crap, or other affiliate spam.

Spam seems to be getting worse and worse, despite all the efforts to combat it.

Whois belongs in an era where email servers were completely open, telnet and FTP were unencrypted, and people had .plan files for all the world to see. It should have died off 20 years ago.

When investigating sketchy sites I have found that domains are pretty disposable and that trying to contact the admin or registrar from the whois data is pointless. They can just pivot to another domain at worst and they probably faked the data they submitted to register it to begin with leaving them unaccountable.

Services like Cloudflare on the other hand are fully complicit in making abuse easy on the internet. If you want something abusive taken offline it is better to go after whoever is hosting it instead of some pointer to where it is hosted, which is difficult when they are behind Cloudflare. If you want a laugh search Google for the terms "booter" or "http stress tester" and try to gauge the legitimacy of the results.

RDAP is going to happen.

1) its UTF-8 clean 2) its JSON 3) its getting Oauth, so LEA requirements can be met while keeping personal data private 4) it uses web protocol underneath so 302 redirect works 5) its fully deployed in the RIR system for numbers, and has a global directory at the root in IANA.

RDAP is going to happen to WHOIS. Its long overdue.

(bias: I work on RDAP)

I've always appreciated that .ca domains are private by default.

Even without whois, you can dig the IP address and find out their ISP (sometimes). I've had some success getting compromised servers shut down by reporting them to the abuse email address in the dig record. If you email amazon with the details of malicious AWS instance, they will notify the customer and/or kill the instance pretty darn quickly.

Does anyone know of an open source program that finds malicious IP's in apache / nginx logs and reports them automatically? I've been thinking of making this tool but it must exist already.

In my head, I call it the internet hygiene project. It's a slow and very unsexy way of dealing with the botnet problem, but I think it could make a positive difference. Admittedly, it'll only catch the low hanging fruit, but there is so much of it, I think it is a good start.

Apologies for going off-topic.

Yes, I accidentally exposed my personal info for a new .us domain. Spam emails and phone calls immediately.

I had the same issue. Didn't realize .us required your info to be published. My registrar upsold me their whois guard service, but it sat unredeemedable on my account while spammers harvested my info.

Serious question:

Some months ago I was curious about buying a domain name. So I poked around on various reseller sites to find out the pricing. I couldn't buy it at the time.

Only a couple months later (I still couldn't buy the domain), I found the site had been registered. The domain was an obscure but novel sequence of letters; the likelihood that I and someone else came up with the sequence at the same time is objectively possible, but slim.

So, I can only conclude that list reselling DEFINITELY DOES happen, and yes, I am very mad. But there is of course nothing that can be done.

Now, when I want to find out what domains do and don't exist, I just use WHOIS, because I don't trust any of the "domain lookup" sites.

What do I do now? :(

I applied for "port 43" access to GoDaddy's normal whois records (still "domains by proxy" if private registration) this week. They require you to sign a very short contract stating what you're using it for and stipulating you can't bulk scrape it or use it for marketing.

Still waiting on approval, am somewhat interested to see whether they approve my request.

As far as spam goes, I don't generally use private registration, but use dedicated email addresses for my whois contacts, and I rotate them on a regular basis.

The scraping seems to happen soon after a domain is registered, but there's a much longer lag when changing the email address.

Most recently I have found whois a good way to validate the age of domains of certain competing companies. This is a very vague thing to look up but it sure is useful, I am sure that it also adds a dimension to trust metrics in search engine and antispam land. I don't want it to die.

Non-mobile link: https://motherboard.vice.com/en_us/article/vbpgga/whois-gdpr...

On the other side of this, I remember a time when you could just download a dump of the registration data and do whatever you wanted (good or bad). Now it's like pulling an arm and a leg to get access to even fractions of the data.

For .uk domains currently, you cannot mask whois details at all!

You can under the right circumstances. For example, on my name's .co.uk, it says: The registrant is a non-trading individual who has opted to have their address omitted from the WHOIS service.

For companies and organizations though, yeah, they have to be public, but I think that's fair enough.

Nor .io domains.

Maybe it's just the service you use? My .io has masked whois.

My .io (finn.io if you want to look it up) says:

  Owner Addr    : Obfuscated whois Gandi-63-65 boulevard Massena
  Owner Addr    : Obfuscated whois Gandi-Paris
  Owner Addr    : WA
  Owner Addr    : FR

and my full name. Seems obfuscated enough, especially since the name was not remotely validated.

I am using Namecheap and it masks .io domains using Whoisguard.

Reply on news.ycombinator.com