Re: NY ISP's domain hijacked

From: Stephen Knilans (steve@seasoned-software.com)
Date: Sun Jan 16 2005 - 13:36:30 EST


I realize it doesn't happen right away. Even 50 originations of email
wouldn't be enough, as a downline server could consider it spam and decide
not to pass it. The ONLY measurement of time that is ethically valid is
that between when the loser has knowledge of it and the time it happens.
At times, that number ****HAS**** been negative(The loser doesn't find out
until sometime AFTER the loss). requiring prior authentication all but
ensures rhe time will always be POSITIVE, where inaction would PREVENT the
transfer.

BTW lawnmowers couldn't be stolen accidently.(The odds that 2 lawnmowers
that looked similar would be in 2 similar environments in 2 similar
garages at 2 similar addresses is just too unlikely) I'm surprised you
didn't use the checked baggage at the airport analogy.(Bags tend to look
more alike, and are in the same area.) Although it WOULD make your
statement more clearly correct, it WOULD more clearly illustrate MY point
that it could happen by accident. ALSO, people tend to be EXPECTING their
checked bags, so even THERE you have MORE protection than you do with
domains. If you don't see your bag, you will start an investigation
within perhaps 30 minutes of the opportunity to steal it. With a domain,
it may be days later, and maybe weeks or more after the actual event.

BTW I once had a text book stolen in college. Knowing that it HAD to be
****STOLEN****, I went to the ONLY place in town likely to be offering
money for it. IMAGINE my shock to see the jerk that STOLE it from me
FENCING IT! I actually interrupted the transaction, to call attention to
the fact that my name was CLEARLY embossed(I wrote HARD, to make this
difficult) under the scribbling he used to conceal it. They checked his
schedule, and found it unlikely he would EVER have such a book. I on the
otherhand DID have such records. If that had been a DOMAIN, I would have
had MORE reason to be angry at its loss. I just HOPE I am as lucky if I
ever DO lose one.

BTW I realize that OpenSRS may have nothing to do with this, and that it
ISN'T a new issue. I have ALWAYS hated it, and just felt I should say my
piece.

Steve

Ross Wm. Rader said:
> Stephen Knilans wrote:
>> Last I knew, there was NO SUCH THING as a "transfer lock". There IS a
>> "MODIFICATION lock" that happens to prevent transfers.
>
> There are a few different mechanisms that can technically prevent
> transfers. I was simply using "the marketing term of the month" that
> seems to be reverberating around registrardom lately.
>
>> That is ENTIRELY
>> different. If you want to change ANYTHING, you have to REMOVE THE LOCK.
>> That is dangerous. Somebody COULD concievably pick THAT time to issue
>> the
>> transfer request, or you may forget to set it back. It is appalling
>> that
>> such an IMPORTANT thing can be stolen with NO culpability. Someone
>> could
>> actually ACCIDENTALLY transfer a domain, and NOBODY has to do anything
>> about it.
>
> The infrastructure doesn't work like that. Transfers do not occur
> instantaneously. There is a better chance that someone is going to steal
> your lawnmower while you are backing your car out of the garage than
> there is of someone transferring your name as it sits unlocked while you
> make a change to your nameserver records.
>
> --
>
>
>
>
>
> -rwr
>
>
>
> Contact info: http://www.blogware.com/profiles/ross
> Skydasher: A great way to start your day
> My weblog: http://www.byte.org



This archive was generated by hypermail 2.1.3 : Mon Jan 31 2005 - 23:00:01 EST