We’re not the bad guys here; we do plenty to fight fraud; and, let’s not forget, we’re victims, too.
That’s the gist of what directNIC CEO Sigmund Solares had to tell me after his company was singled out by F-Secure chief research officer Mikko Hypponen as a prime example of domain name registrars not doing enough to deny registrations to blatant phishers. Hypponen highlighted directNIC’s selling to a “Craig Smith” the domain name “signin-ebay-c.com,” which was then used as a phishing site.
Earlier this morning we posted the views of Dave Jevans, chairman of the Anti-Phishing Working Group, who calls the issue “complex.”
Now it’s Solares’ turn. While much of what he has to say sounds reasonable, it’s also clear that this self-described “former economics major” has competing interests to weigh. And it should go without saying that directNIC’s bottom line carries more weight with him than, say, some poor sap who gave credit card information to “Craig Smith” through signin-ebay-c.com. Ultimately, these issues are always about the money. Always.
As for the transaction with Mr. Smith: “When it was brought to my attention the site was already shut down (by our people),” says Solares.
While he says he believes that the phishing site was shut down through the routine diligence of his company’s filtering procedures — as opposed to being in response to Hypponen’s prod — he adds that he has no desire to dig too deeply into the details of what happened when.
In general, though, he’s adamant that that directNIC is diligent about fighting fraud and always on the lookout to improve its procedures.
“Fraud probably costs us several hundred thousand dollars a year, so we want to keep that as low as possible,” he says. “We devote resources to fighting fraud every day. However, as a former economics major it seems to make more sense to me to have one entity prevent phishing domains from being registered instead of hundreds of registrars. So it would seem to me that changes could be made at the registry level instead of the registrar level. This would also prevent one registrar from allowing phishing sites while another does not.”
Filtering can mean delays. More filtering can mean more delays.
“The more you filter, obviously, the less sales you’re going to have,” says Solares. “You’re going to potentially be at a competitive disadvantage.”
“Is it a perfect system? Obviously, there is no perfect system.”
