Nominet Transfer Concerns

[mojoco]

Dear Diedre,

I think most will agree that the new online transfer process is a huge step forward and a welcome change. The problem I see is that Nominet have now gone from one extreme to another. Those of you that have used the system will know, that it is now too easy. There appears to be no saftey net.

What happens if someone hacks your email account and transfers your names away.

For .com's with the registrar I use (I think most registrars are the same) the current registrant gets a notification email to let you know that a transfer request has taken place. If they don't hear from you the transfer is completed in five days. Five days is not a long time, but at least you have some chance to stop a fraudulent transfer.

The Nominet system gives no warning and the transfer is almost instant.

I am in no doubt that some smart hackers will be eyeing the system and getting ready to transfer our domains away.

Are there any additional safegaurds we can take to prevent this happening?

Sincerely,

Worried Domainer.

 

[ELIFE-MZ]

Although I have the same concerns, it would be easy to get the domains back as ultimately its Nominet that controls .UK unlike .com which can be moved to some obscure registrar overseas.

Although it would be inconvenient I don't see it as a big issue.

Thks

MZ

 

[bb99]

I've not done any online transfers yet, but I think that the fact that it's "almost" instant means that someone at Nominet is manually reviewing each one and checking for iffy patterns/etc.

Maybe not though, I'm just guessing

 

[ELIFE-MZ]

By almost instant we mean 2-3 seconds and they can be done at any time. I just can't imagine a registrant agent sitting there at Nominet HQ around 2am hitting 'approve' button :mrgreen:

 

[bb99]

By almost instant we mean 2-3 seconds and they can be done at any time. I just can't imagine a registrant agent sitting there at Nominet HQ around 2am hitting 'approve' button :mrgreen:

Noted. I'll get my coat

 

[bluerock]

Just a quick thought but why can't a registrar choose not to use online transfers by default.

We do have the option to not accept incoming tag changes in our account settings so surely a similar option could be added?

 

[bb99]

Just a quick thought but why can't a registrar choose not to use online transfers by default.

We do have the option to not accept incoming tag changes in our account settings so surely a similar option could be added?

This could be described as a (semi-) lock state, which is what the PAB discussed at today's meeting I think. Maybe one of our PAB chums could help us out with some info...

 

[ELIFE-MZ]

Just a quick thought but why can't a registrar choose not to use online transfers by default.

All depends on when paper transfers are likely to be phased out. No mention of it anywhere but I am sure they won't be around for too long.

 

[mojoco]

Some of the safeguards currently in use for .com transfers


Registrar Lock: A name cannot be transferred until the name is unlocked.

Email Notification: The registrant is notified that an attempt to transfer the name has taken place.

Transfer delay: Once a transfer request has been made, 5 days pass before the transfer is complete.

Executive lock: In addition, Fabulous have an "Executive Lock" feature. This gives you the option for your top tier names, to create precise instructions to be adhered to before a name can be transferred.

Lets hope Nominet are planning on implementing some safeguards with the online process some time soon.

Take it easy mofo, too much exertion for one day!

 

[grantw]

All depends on when paper transfers are likely to be phased out. No mention of it anywhere but I am sure they won't be around for too long.

I assumed paper transfers had already been dumped, this is from the announcement email on nom-announce:

.......The new registrant transfer process in online services replaces the current paper based system.

Grant

 

[rob]

Exec paper - http://www.nominet.org.uk/digitalAssets/29866_PABJul08_Lock_States.pdf and annexes:
http://www.nominet.org.uk/digitalAssets/29867_PABJul08_Lock_States_annex1.pdf
http://www.nominet.org.uk/digitalAssets/29868_PabJul08_Lock_States_annex2.pdf

Worth a read to see where things are heading.

 

[grantw]

Do I sound like I am over-reacting?

No, you don't. Online transfers are a great step forward but I can't believe they've been introduced with so few security measures in place.

I received a password reset email yesterday to my main accounts email address, someone requested it and it wasn't me!

I'm off to scan my domains - or make that a quarter of them as I'm on a static IP and limited by Nom's insane whois lookup limit

Grant

 

[retired_member12]

Whilst we're on about Registrars, is it possible to determine the exact date when someone/company became a Registrar, i'm interested to know about two of them?

 

[retired_member12]

That interesting about past monitoring, maybe there should be a 'whois' type database for TAG holders, it's not so easy keeping track of the changes.

As it happens, i found the information i needed to know in my notes, it was under my nose all the time. :roll:

Cheers for the feedback, nevertheless!