WHATIS Going To Happen To WHOIS? (vice.com) 66
dmoberhaus writes:
A European data privacy law goes into effect in May, but it's already having far reaching consequences, especially when it comes to publicly available WHOIS data. Motherboard spoke to a domain registrar, ICANN and some security researchers about how anticipation of the EU privacy laws implementation has already gutted WHOIS data, why this is dangerous and what the future of WHOIS looks like.
ICANN requires registars to make data on their customers publicly available -- but registrars would be more than happy to stop, according to Tim Chen, the CEO of a WHOIS data analytics firm. Besides hiding their customer lists, it would also address complaints about spammers harvesting email addresses. So registars like GoDaddy "are taking this opportunity to see how far they can push things."
But the article has some sympathy for ICANN. "On the one hand, the organization is under pressure from law enforcement officials and security researchers who depend on WHOIS data to investigate possible crimes or mitigate devastating malware attacks. On the other hand, the organization must also accomodate laws like the GDPR that are the only bulwark against the wholesale of individuals' data by internet giants like Google and Facebook." In 2014 ICANN suggested a "gated" registry that would only authorize access to people who identified themselves and their purpose for accessing the data. But progress has been slow, according to the article, which adds "It's uncertain when ICANN will have a finalized protocol for a next generation version of WHOIS, but an overhaul of this nearly 30-year-old protocol is long overdue.
"The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work."
ICANN requires registars to make data on their customers publicly available -- but registrars would be more than happy to stop, according to Tim Chen, the CEO of a WHOIS data analytics firm. Besides hiding their customer lists, it would also address complaints about spammers harvesting email addresses. So registars like GoDaddy "are taking this opportunity to see how far they can push things."
But the article has some sympathy for ICANN. "On the one hand, the organization is under pressure from law enforcement officials and security researchers who depend on WHOIS data to investigate possible crimes or mitigate devastating malware attacks. On the other hand, the organization must also accomodate laws like the GDPR that are the only bulwark against the wholesale of individuals' data by internet giants like Google and Facebook." In 2014 ICANN suggested a "gated" registry that would only authorize access to people who identified themselves and their purpose for accessing the data. But progress has been slow, according to the article, which adds "It's uncertain when ICANN will have a finalized protocol for a next generation version of WHOIS, but an overhaul of this nearly 30-year-old protocol is long overdue.
"The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work."
Re: (Score:2)
I use it sometimes. Mostly to keep track of expiration dates for my own and client's domains, but it's not all obfuscated. Even just the creation date can be useful when looking into something.
Re: (Score:2)
Why doesn't ICANN tell them to take a fucking hike...and if they don't want WHOIS available in their country, then they can block it into their country with their own firewalls or whatever.
Re: (Score:2)
Not irrelevant but CIRA (Canada's registry) did the same sort of thing a long time ago and it works just fine. Just saves people from having to pay stupid fees for privacy protection.
Re: (Score:2)
I do. - we also count bad dns requests to our dns servers - hit a limit and well thats not my problem
Re: Does anyone actually use that (Score:2)
Re: (Score:2)
What I'm hearing now sounds like a boon for criminals worldwide. Not a good thing.
Nonsense (Score:2)
This is total nonsense. GDRP is about disclosing how you handle data and giving people handles when they want to be removed from your system. In no way does it stop you from creating a phone book for domains holders.
Re: (Score:1)
Ironic that you call it nonsense and then give a nonsense summary yourself. Data access and portability are two of the many areas you ignored. I could certainly see hosting companies making decisions to change how they present WHOIS based on GDPR, for example keeping logs of what is displayed and to whom given their responsibility to record processing of relevant data.
Re: (Score:2)
You misunderstand data access if you think I didn't cover it. As far as portability is concerned, that's the whole point of WHOIS, they have that covered.
Re: (Score:3)
Re: (Score:2)
Nothing here contradicts what I said. Which part would ban WHOIS?
Re: (Score:2)
Which part would ban WHOIS?
Where is the claim that GDPR would ban WHOIS? Are you making things up? The part of the summary that is related to GDPR is that the current WHOIS service is not compatible with GDPR:
On the other hand, the organization must also accomodate laws like the GDPR that are the only bulwark against the wholesale of individuals' data by internet giants like Google and Facebook." In 2014 ICANN suggested a "gated" registry that would only authorize access to people who identified themselves and their purpose for accessing the data. But progress has been slow, according to the article, which adds "It's uncertain when ICANN will have a finalized protocol for a next generation version of WHOIS, but an overhaul of this nearly 30-year-old protocol is long overdue.
Re: (Score:2)
I didn't say you claimed that. Are *you* making things up? I just asked two questions, where your page contradicts my statement, and which part of GDPR forbids WHOIS. You answered neither question (your quote certainly doesn't point it out).
Re: (Score:2)
Which part would ban WHOIS?
I didn't claim anything of this nature and I don't see where anyone or anything did. Why would i continue to talk with someone who is making shit up? There is no way to have a conversation with someone who is doing that. If you want to continue, tell me what this statement YOU made is in reference to, otherwise, have a nice day because I don't talk with irrational people that just make things up.
Scammers use data... (Score:5, Interesting)
Anyone who has a registered domain or ssl certificate is familiar with the perennial scam of getting a fraudulent letter or emailing informing them that their domain is about to expire please send money now.
Re: Scammers use data... (Score:2)
Molehill (Score:5, Insightful)
What's wrong with having WHOIS point to a middleman who must forward to the owner?
There's no privacy issue that way.
Re: (Score:2)
This - or some variant of this - is how Dreamhost has handled WHOIS for years. Currently if you look up my hobby site, the admin contact is {domain name}@proxy.dreamhost.com .
Re: (Score:3)
I was peripheral to the discussion, and a customer bid on the "new whois" proposal: this is how it was supposed to work. A domain name in .com was supposed to be just like a business, and it was expected that the business contact could be your marketing department or in-house counsel. In .net and .org it was the same.
In .ca, the registrant name is the registrar, and when contacted they will contact me.
Re: (Score:2)
undermined (Score:1)
Is there even any point? (Score:4, Insightful)
Most domains are owned by proxy anyway, so if you do a whois you're just going to get the name of the proxy.
The days of using whois to hold domain owners responsible for anything have been long over for a long time; anyone doing anything shady (or just wanting basic privacy) is using a proxy.
WHOknows (Score:1)
But I do know this much: trump will hang for treason.
WHOIS for netblocks is very useful (Score:2)
People tend to focus on domains when it comes to WHOIS usage; however I've found myself using it more to see who administrates/SWIPP'd a given block of IPs rather than looking up often inaccurate or obfuscated info on domain ownership.
Re: (Score:2)
I agree - any whois that says do not block me, or "I AM NOT SPAMMING YOU" is worthy of a mallet
Re: (Score:2)
Yep. I'm not really interested in the contact details. What I want to know is where an IP originates and what subnet it is part of. I would be happy for my contact details to be held somewhere and only passed on in accordance to local laws.
When I find that somebody has scanned my address, resulting in firewall drop messages, then I will assume that all addresses in the subnet containing that address could also be compromised. WHOIS tells me that info, and which country it is. Based on that, I'll drop the wh
I'm all for privacy laws (Score:1)
My registrar offered to make my personal information private something like 18 months ago, an offer which I immediately accepted. As a result I've had no more scam letters from assholes telling me I owe them money to renew my domain.
Typing a domain name into a computer without proper authority should never ever reveal the name, address and phone number of the owner for the very same reasons that in the UK you can't type the registration number of a car into a computer to obtain the name address and phone nu
Um... so what? Obfuscation already exists (Score:2)
My domain registrar (Hover.com, based in Canada) offers WHOIS obfuscation for free. I'd be an idiot not to take advantage of it.
"How to make it work" (Score:2)
The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work.
I am going to create a piece of legislation that states "all citizens have a right to be able to time travel". I guess since it's the law we have to invent the time machine. Apparently the best approach to decision making is to shoot first and aim later.
I just list the address of the local post office. (Score:1)
solution: record salting (Score:1)
The data will always find a way out. Just allow registrars to salt records, like what is done with political donations.
Other important questions ... (Score:2)
WHATIS Going To Happen To WHOIS?
Namely [wikipedia.org]: WHEREIS, WHYIS, WHENIS and HOWIS ?
Does anyone actually use their real names? (Score:1)
Reminds me of David Brin's Transparent Society (Score:3)
https://en.wikipedia.org/wiki/... [wikipedia.org]
"Brin argues that it will be good for society if the powers of surveillance are shared with the citizenry, allowing "sousveillance" or "viewing from below," enabling the public to watch the watchers. According to Brin, this only continues the same trend promoted by Adam Smith, John Locke, the US Constitutionalists and the western enlightenment, who held that any elite (whether commercial, governmental, or aristocratic) should experience constraints upon its power. And there is no power-equalizer greater than knowledge."
From the article: "The notion that individual data should require a requester to also provide their own data is both equitable and intuitive -- the only remaining question is how to make it work."
Re: (Score:1)
ICANN't are idiots (Score:1)
So you have a problem with leaking "personally identifyable information" ("PII").
So your solution is an identification-wall that requires more identification, thus more PII, and "justification" data.
Syeah, that's gonna work.
Why do we publish all that whois data anyway? It's a hold-over from the early days. The useful bits of info are the registration date, the organisation behind it so you can match various domains to the same owner, and (should it still have been reliable), an easy contact point for abuse
Whois is Still Useful? (Score:2)
Re: (Score:2)
I've found it still somewhat useful, in that a couple of those masking companies, like "Whois Guard" in particular on my system(1), are so bad that I can reject email for purely being from a domain that uses their services.
(1) My current stats have >2300 unique domains using their service that I've rejected email from.
Does anyone buy a domain name without privacy? (Score:1)
Should be public (Score:2)
WHOIS is the internet-equivalent of a property registry. If I want to know who owns that building over there, I can go to the township, look in the public records, and find out. This is important, whether it's because you want to buy the building, or perhaps you have a problem with something that is happening there. Sure, in some cases, ownership will be obscured through some intermediate legal entity, but that will still be the responsible legal entity.
WHOIS should be exactly the same thing. If you are int
Re: (Score:2)
I call bullshit on you, or at least in general. Most of the proxy services claim that they keep you from getting spam. However, they forward the e-mails, so they still forward the spam and virus.