Leave Spicer alone! (Or, why DNS registration is horrible)

Sean Gallagher
White House Press Secretary Sean Spicer takes questions on February 7. His home address, phone and personal e-mail were discovered in the domain registration data for his now-defunct personal blog.
Alex Wong / Getty Images
White House Press Secretary Sean Spicer has gotten a lot of grief from some quarters for a variety of reasons. Among them are his problems with information security—including his apparent posting of passwords to his Twitter account. But the latest privacy problem Spicer has on the Internet is one that thousands of others who have embraced the Internet have had, and it's mostly the fault of the Internet's archaic address book—the Domain Name System.
In 2009, Spicer registered a domain for his personal blog—seanspicer.com. He updated his domain registration data in March of 2010, apparently after moving into his home in Alexandria, Virginia. And when he did, he used his own personal home address, phone number, and e-mail account. That information, as Mashable reported on February 6, is still publicly accessible through a whois lookup against the Domain Name Service, as published by his domain registrar GoDaddy. The phone number matches one associated with Spicer present in the DNC e-mail breach posted by WikiLeaks.
Spicer's Yahoo e-mail account—which was part of data exposed in the MySpace, Dropbox and LinkedIn "mega-breaches" discovered in 2016—is also associated with a number of other domains, including those bearing the name of family members. These sites have largely been taken down (as in the case of theelephanttrunk.org, a Republican-themed online tie store), are still essentially blank template sites (including stateoftherace.org), or are parked. The parked domains include:
  • pronesource.com and pr1source.com, apparently domains Spicer considered using for business purposes
  • campaignonesource.com and campaign1source.com, parked for likely similar purposes
  • ratethereporter.com—a site Spicer may have envisioned as a "Hot or Not" for journalists
  • And various domains registered under combinations of his wife and children's names
Spicer was smart enough to block the archiving and search-engine trawling of his personal site by using a robots.txt file to exclude them from the site. But as Mashable's Brian Koerber pointed out, "Apparently, Spicer didn't feel like shelling over the $7.99/year to his domain host GoDaddy to hide his own data."

WHOIS the boss?

But most people who have set up a personal domain—particularly domains set up in the "pre-doxing" era—never considered the threat DNS posed to their personal privacy. While GoDaddy has offered its paid privacy service since 2002, it's not something most people use. In a 2013 study by NORC at the University of Chicago for the Internet Corporation for Names and Numbers (ICANN, the guardian organization for the DNS), researchers found only 20 percent of domain registrants used privacy services, while a third appeared to be registered by "natural persons"—individuals providing personal contact information.
The Domain Name Service was not designed with privacy in mind because it was developed long before anyone ever conceived of the idea of an individual owning a personal Internet domain name. Originally developed for the pre-Internet ARPANET in 1982, the WHOIS database was intended to provide technical contact information for organizations transmitting data over the network—which at the time was limited to corporations, the US government, the military, and a handful of academic institutions.
The WHOIS service has gone unchanged since 1999, when ICANN began to allow other entities to handle domain registration. And as the domain name space has expanded, ICANN has blocked private registration for some top-level domain (TLD) spaces, such as the .us TLD. In 2015, ICANN proposed eliminating private registration entirely based on studies that found most malicious domains used registration proxies or services that allowed the use of fraudulent contact data of some sort.
Privacy groups protested, and there has been no further movement on the effort. And the proposal was in direct contradiction to a previous initiative by ICANN to protect registrant data. A 2013 study by Carnegie Mellon University commissioned by ICANN found substantial misuse of WHOIS data for both unsolicited calls and e-mails and targeting phishing and malware attacks. ICANN subsequently proposed eliminating public access to data through the WHOIS service. But that ran into resistance as well, particularly from organizations that use WHOIS data for tracking threats from malicious sources (including DomainTools and LegitScript).
Mocking the victims of DNS "doxings" like Spicer may provide the more technically savvy a moment of schadenfreude. But it's not the way to solve this problem. Given the lack of forward motion on WHOIS privacy at ICANN, it falls to the registrars to provide an easier answer. For the most part, they've used privacy services as a profit center. While privacy services have become integrated with some registrars (such as Google's, which now offers privacy as a check-box), GoDaddy and others make easy money off of it. But because the DNS is forever (thanks to services like DomainTools), even people who convert over to using privacy services for their domains will have their personal data left hanging in historical WHOIS records.
Leave Spicer alone! (Or, why DNS registration is horrible) Reviewed by Bizpodia on 00:25 Rating: 5

No comments:

Bizpodia © All Rights Reserved!

Contact Form

Name

Email *

Message *

Powered by Blogger.