Forest Global Training Partners

Cyber Risks · Krebs on Security

WHOIS Privacy Plan Draws Fire

Summary: An ICANN working group proposed scrapping the current WHOIS system, which allows anyone to query domain registration records, in favor of a centralized lookup system closed by default and open only to authenticated requestors held accountable for appropriate use. The plan would create an aggregated registration directory service (ARDS) holding a non-authoritative copy of the data, with registrars and registries maintaining authoritative records, and it has drawn opposition from security firms including G2 Web Services, OpSec Security, LegitScript and DomainTools, plus concerns from France's Afnic registry about which law enforcement agencies would get access.

What's compelling: Security researchers and fraud investigators currently use WHOIS records to trace phishers and scammers through reused email addresses and phone numbers; under a closed-by-default system they would have to apply for credentials, and as Knujon's Garth Bruen put it, the consumer would be frozen out and forced to go to police or a for-pay service to learn who owns a domain name.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related