Hacker News Reader

Comment by jchw | Hacker News Reader

How does this threaten the security or privacy of the Internet _at all_? Whois data isn't accurate even by horrible standards. They've tried to make it more stringent but I have domains of mine with the wrong address that I'm too lazy to update and it's been wrong for years now. No problem for my Whois records. And to get around whois records, if we as owners of domains want privacy, we have to deal with shady companies that effectively take control of our domain's ownership. Great for selling whois privacy products, but not at all good for internet security.

SSL certificates already aren't good enough to prove the legitimacy of an organization, not even EV ones. Why Whois data would be any use is beyond me.

View on HN

I think it is weird to have a physical address for a domain. At least that should be optional.

Definitely is a pro-company and anti-individual concept. If you are a company no problem using your address. As an individual it is not private, do you want people who hate your site knocking at your door and your kid answers?

Then namecheap as whois guard and all that. Extra rent you have to pay to keep your privacy!

I disagree. That kind of anonymity is a false sense of security. Crazy people who are going to knock on your door are going to find you.

I’ve had my street address on my domains for two decades now. All it does is save would be crazy people 10 minutes of googling, as there are searchable public records of home ownership.

I think you're overestimating how much effort the average adversary will put in to find this information. Sure, some will hunt you down and try and find you via real life databases like home ownership records. But many will just hope they can take advantage of easily found information like WHOIS records, in the same way many burglars just hope a doors been left unlocked or a window left open.

Unless someone's gotten into a fight with 4chan or Kiwi Farms, the chances of someone actually hunting them down like an internet detective is pretty slim.

Showing up at somebody’s front door is a big line to cross.

Like dumping a toilet in a driveway because some database pointed you there?

https://splinternews.com/how-an-internet-mapping-glitch-turn...

Not only that, there's also swatting.

The problem with swatting is not that you can find people’s home address. It’s that with an anonymous phone call you can send hyped up untrained dangerous fake army men to someones house with no repercussions for you or the team.

Hiding your home address is just a workaround.

What's your home address?

You can find it in the Whois information for my domain

That's too much effort. I guess your workaround worked after all.

There is a difference between not connecting this account to my real life identity and keeping my address a secret. If you knew my name you can just look up my phone number and address in the public phone book.

Having a physical address for a domain gets even worse because there are country TLDs that mandate providing a real address as a condition for buying and holding a domain with those ccTLDs.

You can always use a PO Box, as I've done in the past. Extra rent, but useful.

Lao Tzu says that in preparing a defense you welcome an enemy. If we create from our thought and intent, why would we take steps? This thinking instantly puts most people into fear mode, but when you live it and nothing happens fear totally loses any gravity, these discussions are tiresome. People ramdomly go crazy and target people on the internet probably less often than home invasions on houses with unlocked doors. But again quantitative analysis brings us back into the fearful analysis mode and out of abundant loving mode. Hard idea to explain, and my analytical brain comprehends the woowoo, but woowoo is critically important in that thought.

It's not only about some trolls targeting the content creators. It's also about government, government officials and large (ethically challenged) corporations and "organized crime" that one needs to be on guard against. Even if you host with a provider in another jurisdiction who will resist revealing your information, the WHOIS data is a sitting duck. I don't think this piece of advice from Lao Tzu applies to our post-Snowden world. Definitely not for people who are against the powers that be (and on whom healthy democracies depend on).

Or http://www.fakenamegenerator.com/

I find whois data less useful every day. 90% of the time when I'm researching suspicious domains, it maps back to one of those shady companies, and the malware author hiding behind it doesn't care about handing over ownership of his disposable DGA domains to said shady company.

Even legit sites are starting to hide whois data behind privacy proxies. Hijacked sites only ever map back to a victim, not the perpetrator. As part of my investigative workflow it's largely a waste of time to whois anything.

It seems to only benefit domain squatters and spammers.

> if we as owners of domains want privacy, we have to deal with shady companies that effectively take control of our domain's ownership.

Some domain name providers, such as Gandi, offer privacy of address, phone, and email data while leaving your name as the owner of record.

I do use Gandi and trust them, but I'm not sure if this is 100% possible. Gandi still has limitations that largely depend on TLDs.

I use only NearlyFreeSpeech.net (a web host that also provides domain registration), and its planning to do domains by itself sometime in the future. I like its no nonsense and practical policies.

We deserve to know how public resources are owned and allocated. Whether it’s land, RF spectrum, or a corporation, ownership being public record is an important part of the social contract. Domains may be too opaque, but completely removing any semblance of transparency only makes it worse.

> ownership being public record is an important part of the social contract.

This is silly. Public ownership records are a practical utility, not a deep-rooted moral practice.

Incidentally, we’ve figured out how to have digital asset ownership without invoking “the social contract” or any of its many connotations; we have blockchains now. Namecoin solved this exact problem, although it never took off.

>not a deep-rooted moral practice.

How do you think the Freedom of Information Act got there? It may be going out of fashion, but many of us do believe that the workings of public institutions should be transparent because we value transparency itself. The public record would be much smaller if pragmatism were the only reason to make something public record.

ICANN (or whatever supplants it, like Namecoin) is the Register of Deeds of the internet.

Governments and larger corporations, which are generally a lot more powerful than individuals, ought to be forced to be transparent to individuals, and not the other way around. Anything on the former is welcome. Anything on the latter needs stronger justifications.

Ownership of a zero-sum resource like land, spectrum, or DNS is the most fundamental form of power.

Reply on news.ycombinator.com