“So put your contact address as "123 fake st" and your phone number as "555-555-5555". Make a
fake email”
All I’m trying to do is note that this kind of advice can cause real unintended operational consequences for well-meaning
registrants who might think it’s a great way to avoid having their PII published via services like WHOIS. It isn’t.
Scott
From: Greg Aaron [mailto:gca@icginc.com]
Sent: Tuesday, February 14, 2017 2:20 PM
To: Hollenbeck, Scott <shollenbeck@verisign.com>; 'elsakoo@gmail.com' <elsakoo@gmail.com>
Cc: 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org>
Subject: [EXTERNAL] RE: [gnso-rds-pdp-wg] Dangers of public whois
No, the RAA validation steps are trivially easy to get around. You use the example of a fake email address. Criminals know not to use fake email addresses, and they don’t
need to because they can get email addresses for free. One can sign up for free email accounts anonymously. There are even underground services that will generate freemail accounts in bulk. These services cater to criminals such as spammers who need to
register lots of domain names.
All best,
--Greg
From:
gnso-rds-pdp-wg-bounces@icann.org [mailto:gnso-rds-pdp-wg-bounces@icann.org]
On Behalf Of Hollenbeck, Scott
Sent: Tuesday, February 14, 2017 1:57 PM
To: 'elsakoo@gmail.com' <elsakoo@gmail.com>
Cc: 'gnso-rds-pdp-wg@icann.org' <gnso-rds-pdp-wg@icann.org>
Subject: Re: [gnso-rds-pdp-wg] Dangers of public whois
From: allison nixon [mailto:elsakoo@gmail.com]
Sent: Tuesday, February 14, 2017 1:35 PM
To: Hollenbeck, Scott <shollenbeck@verisign.com>
Cc: vgreimann@key-systems.net;
gnso-rds-pdp-wg@icann.org
Subject: [EXTERNAL] Re: [gnso-rds-pdp-wg] Dangers of public whois
>>[SAH] Actually, there *are* requirements to provide valid data and for registrars to perform validation processing:
How do you expect toothless policy to work *on the Internet*? Seriously?
Yes, seriously. Registrars who do not implement the policy are subject to having their accreditation revoked. ICANN has, in fact, revoked or suspended accreditations. Here are
two examples:
https://www.icann.org/news/announcement-2-2007-03-16-en
https://www.icann.org/en/system/files/correspondence/serad-to-patel-2-18jul14-en.pdf
worst that can happen when you put in fake whois data is that your domain gets reported, you change "123 fake st" to "124 fake st", and your registrar is satisfied because what more can they possibly do. I know this because I went through
this with an old sinkhole domain. It's a total joke. Let's not pretend it's anything more than that.
Not true. A fake email address, for example, can be detected easily when email sent to it (one of the registrar’s validation requirements) gets bounced back. The worst that can
happen is that your domain gets put into some non-operational state (“suspend the registration” per the RAA).
Scott