Metasploit website hijacked via fax

Every day, registrars are inundated with calls from incompetent domain owners who haven't kept their domain information up to date, and have lost control of their domain in some way or another. The registrars provide a process to recover your domain name, but that process relies heavily on human judgement.

I think most programmers/technologists would be horrified at just how easily the process can be gamed. I've recovered no less than 5 domain names for friends/customers over the years, and I'm always shocked at how easy it is. If you can produce believable looking letterhead, and have done at least some cursory information gathering on the company in question, you can usually game the system.

The reason this giant hole exists is because of customer service incentives. A large number of domain owners aren't responsible technology people. They're mom & pops, or some middle-manager who kind-of-sort-of understands the internet. They're people wearing many hats, and have never used a program like 1Password or LastPass to keep track of their important information. To add insult to injury, these same people are bombarded with fake domain renewal letters that result in their domain being hijacked by some shady business.

The registrars end up handling the backside clean up for all of these incompetencies, and customers demand it. If a domain registrar began requiring the kind of verification that we'd expect, many people would simply lose their domain names and never do business with said registrar again. The registrars know this, so they make it (too) easy to recover a domain.

IMO, there are two solutions:

A regulatory body steps up and says: Domain owners are responsible for keeping your domain information and security credentials current. If you lose them, you will have to successfully navigate a lengthy and expensive verification process. The process will be standardized across the industry, and non-compliance will result in heft fines for the registrar.

Alternatively, the option is given to domain registrants to treat their registration with a higher level of scrutiny. A kind of "I take responsibility" flag for your domain that significantly raises the bar for recovering the domain should you lose control of it.

Neither of these will happen, because there is not enough incentive. The majority of domain owners will never be targeted in the manner illustrated here, so the service is unimportant to us. There aren't enough large companies to justify offering secure domain registration as a service. The rest of the world needs the easy recovery process because they're not competent/responsible enough to maintain control of their domain name.