Category: domain names

In August 2014, I noticed a potential security vulnerability in relation to the .mil top-level domain, which is operated by the US military. As such, I reported the issue to CERT, describing the issue in sufficient detail that they could understand the problem.

Today, I learned via a tweet from Elliot Silver:

Mali's ccTLD is .ML and the US Military TLD is .MIL. https://t.co/5uS9QaNiGR

— Elliot Silver (@DInvesting) July 17, 2023

about the report in the Financial Times concerning millions of US military emails being misdirected, and quote-tweeted that I had reported the issue many years ago:

https://twitter.com/GeorgeKirikos/status/1680925062621216768

Elliot Silver later blogged about it, and it’s been reported on by many other news outlets.

You can read my August 6, 2014 CERT “Vulnerability Report” here (I had prudently saved a copy), and the confirmation was VRF#HYIXW4Z4. [The PDF is redacted, as it had contained my cell phone number, which I rarely disclose.]

Continue reading “Millions Of Sensitive US Military Emails Misdirected To Mali, Despite 2014 Warning From Me”

I’ve written extensively about the security implications of the “Losing FOA” step of domain name transfers. It’s the opportunity for registrants to “ACK” or “NACK” a pending transfer, before it completes. I wrote about this again yesterday,  and that post linked to all prior writings.

I wanted to give readers direct visual evidence of why the Losing FOA is so important as a security mechanism, so I intiated a transfer of a domain name from my company’s portfolio at Tucows/OpenSRS to GoDaddy. After I input the transfer code (currently called the “AuthInfo Code”, but it will be renamed the “Transfer Authorization Code” or “TAC”) at GoDaddy, Tucows/OpenSRS sent me (as registrant) an email, with a link to a page that would allow me to immediately approve the transfer (i.e. “ACK” it), or to reject the transfer (“NAK” it). Here’s a screenshot:

As you can clearly see, the page contains text saying:

The domain name listed above will be transferred to:

New Registrar
GoDaddy.com, Inc.

and gives me the opportunity to accept the transfer, or decline it (I’ve just left things in a pending state for now; I’ll perhaps “ACK” the transfer in a few days).

Continue reading “Visualizing the Security Benefits of the Losing FOA for Domain Name Transfers”

Despite months spent educating stakeholders, registrars continue to threaten to weaken domain name transfer security.

Continue reading “Registrars Continue To Threaten To Weaken Domain Name Transfer Security”

In August, I submitted extensive comments on behalf of my company to ICANN regarding proposed changes to domain name transfer policy.

I’d written multiple blog posts before then, warning about the negative ramifications should their recommendations be adopted. See here, here, here, here and here for those past articles on the topic.

In September, I participated (as a member of the public, not as a member of the working group) in the public ICANN75 session on the topic (I wrote another blog post immediately before that session.). After that session, one of the ICANN working group members posted some thoughts on my proposals.

As I’ve yet to be invited to participate directly in that working group (which might correct the severe unbalanced and unrepresentative participation, where registrants’ views are not being taken seriously), I’ve written a public response to that email. You can read that response here (while it’s 20 pages long, it’s very generously spaced, so it shouldn’t take long to read and digest).