Should domain name registrars accept fees from and provide addresses to customers who are quite obviously in the midst of a criminal enterprise?
That’s the pointed question being asked by Mikko Hypponen, chief research officer for security vendor F-Secure, in an open letter to registrars on his blog. And it seems to be a question that’s at least worth batting around.
“I know you are in the business of registering domain names for people who need them,” Hypponen writes. “However, are you sure you want to let people register any domain name? Even when the name is obviously going to be used for phishing?”
Hypponen provides a glaring example: A “Craig Smith” registering the name “signin-ebay-c.com” with directNIC and then launching a phishing site that directs the personal information collected from unsuspecting users to an unsecured e-mail address.
“Wouldn’t it make sense for a registrar to filter such obvious registrations and have a real person review and approve them before they go through?” Hypponen asks.
Obviously, the argument against such screening will be that criminal intent is not always obvious. But sometimes it is: Craig Smith? Signin-ebay-c.com? … C’mon.
Would such filtering be practical? Do registrars care?
I’ve asked directNIC, several other domain-name registrars, ICANN and the Anti-Phishing Working Group to respond to the point Hypponen raises. Their replies should be enlightening.
(Update: Head of Anti-Phishing Working Group calls the issue “complex.”)
(Update No. 2: DirectNIC boss Sigmond Solares defends his company’s anti-fraud efforts.)
Welcome Farkers, regulars and assorted passersby. Here are the six most-read Buzzblog items over the past month, in case you’ve got time and interest:
Need a valid e-mail address to register but don’t want the spam? Try this Seam-based Web app.
Early returns on voting machines.
‘Gates for President’ bandwagon picks up, uh, something
Questions to ask MADD before every car has a Breathalyzer.
A meteoric rise in meteoroids observed
Our love/hate relationship with Wikipedia
