Network Solutions E-Mail Security Alert 245
Ralph writes: Network Solutions has starting spamming some of its customers with notices that include, among other things, the news that they've set up a free e-mail account for you, without bothering to ask first, at their new dot com now mail Hotmail clone. They've even taken the liberty of assigning you a password:
3. Lastly, we are pleased to offer you a FREE e-mail account using our new dot com now mail service. Because it's Web-based, you can use it in the office, at home or on the road. You'll need the following information to set up your account:
>>>>>>>>>>>>Login name: domainid >>>>>>>>>>>>Password: domainidnsi
Note that nifty password? It's the same pattern for every domain they've registered an e-mail address for.
Big security [bleep]up. If someone beats you to your account and "guesses" your password, now they can masquerade as you, and if they change the password, you can't even get into the account.
I've already gone into my "accounts", verified that they exist, and changed the passwords. I know that they exist because when I entered other domain IDs I control that I wasn't spammed at, I was returned to the login screen rather than being brought to a presumably newly-created mail page.
I called Network Solutions tech support to demand that they remove the accounts, but the moron on the line didn't understand that they were doing something incredibly boneheaded and wouldn't listen to my explanation. The person on the line insisted that they wouldn't create an account without me signing up for it, but I didn't have to sign up; it was already in place.
The mail I received started out "As a customer of Network Solutions or one of our Premier Program members", so I'm not sure if they're doing this for everyone or just for people who bought their domains through some of the big providers like Pair who are part of the "Premier Program". If you get the e-mail from them, I suggest logging on immediately and changing your password, whether you wanted the account or not. Maybe with a little prodding, Network Solutions will realize they screwed up and delete the accounts and change their procedure.
Update posted 2:10 p.m. EDT by RM - doulos writes "If your tired of getting a busy signal at the 703-... phone number, I found that they have a nice staff of people waiting to answer your questions and complaints at the following TOLL FREE phone number: 1-888-642-9675
They did refer me to the toll-line, but I (politely) insisted that because this was a matter of security that they had initiated, that I should be able to at least speak with a supervisor. They nice person on the phone _politely_ complied, and I was able to put in my request to have those e-mail accounts removed with my appropriate domains.
I just thought I would submit this as an article update because I felt maybe if the phone # was posted as an update it might help alieve some of the offense of having to call, by at least removing the toll from being on your nickel..."
However much you may hate XXXX corp. (Score:3)
However much you may hate XXXX corp DO NOT try and masquerade as them!
It's not big, clever or AFAIK legal.
What may seem as a good idea right now may land you/us/everyone in the world in a whole heap of trouble.
Kinda makes you wonder... (Score:4)
Mind you I guess it's not surprising when we consider the other screw ups we've seen lately - even in other web based email systems like the recent hotmail scare.
All we can do is hope that they will be a learning experience for us all, and that screw ups in the "early" days of the internet for the masses will prevent (or at least lessen the effect of) major security holes in future systems..
Oh dear (Score:4)
What's next, my bank creating an email account for me and assigning it the password 123456, like everyone else's?
Just imagine the possibilities of such a monumental foul-up:
-) Email Masquerading:
"Hi InterNic Tech Support, this is so-and-so, I'd like my contact information changed to... No, I'm really so-and-so. You can tell because I'm emailing you from so-and-so's account..."
-) Spam, Spam, Spam, Spamitty-Spam:
"You've got mail! Oh joy, so-and-so@internic is spamming me. Lets get them blacklisted and ban their server."
-) Misrepresentation via Email:
With this, and some of the information available from a standard whois query, you easily order products and have them shipped to someone COD. And of course, it's authentic because it was shipped from your internic account....
Someone stop the madness before it continues to spread!
Could not get in (Score:1)
Will this piss off enough people to get NSI sued? (Score:1)
Can you say ... (Score:1)
Who wants to keep track of how much time is lost due to this?
Anyone know how I can figure out what other accounts I might have?
Bah! (Score:1)
Also, I think it's disturbing that something important as control of your domain name is left wide open by only offering cleartext passwords. i.e, even if you *do* log in and change your password, it can be seen in transit and your name can still get hijacked.
I think this is a demonstration of NSI's utter incompetence/unwillingness to take due dilligence and that their contract should be terminated.
Site appears to be down (Score:1)
Paul.
Hmmm... (Score:1)
Personally.. (Score:1)
If we can expect quality service like this because of it, I'm all for monopolies over services, products, whatever you got! Tell Uncle Sam to stick it.. Let those businesses continue to deliver the good stuff until it hurts!
Warning: The views expressed in this message are not necessarily shared by the poster, Slashdot, or the free-thinking populace at large.
Update (Score:4)
A bit better; anyone trying to screw up somebody's account would have to know how to use WHOIS and guess a short number.
Clueless. Utterly clueless. And these are the guys who claim to be running the Net??
My password is now a random string that I've already forgotten. Why would I need another e-mail account anyway? Don't you have to have an e-mail address (contact point) to set up a domain name?
Same story here (Score:1)
Re:Site appears to be down (Score:1)
Mailing out passwords (Score:3)
New Advertising slogan? (Score:4)
what am I missing? (Score:5)
If someone beats you to your account and "guesses" your password, now they can masquerade as you, and if they change the password, you can't even get into the account
I'm probably just extremely dense, but isn't dotcommail just yet another free mail service?
do you really think people are stupid enough to think that a mail from 'slashdot@dotcomnow.com' (or 'slashdot@hotmail.com' which I just grabbed) must necessarily come from someone working for slashdot?
if that's the case, we're in deep trouble. there are hundreds of free mail services out there...
Wait a second... are we reacting too hastily? (Score:5)
I am glad there was nothing, no dotcomnow account that I can think of and no email with my nice little present from Netsol. If there was, I guess I might have joined in the frenzy here.
This got me thinking about what the "security hole" is.
a) That account cannot be used to change my domain parameters, since it does not match the e-mail address I registered from.
b) Anyone can really set up an account on one of thousands of webmail providers and pretend to be me. Heck, this has happened to me before on some discussion groups, and there is simply nothing I can do to prevent someone from misrepresenting me to lusers. People who know me know where my e-mail comes from, and know I use digital signatures.
c) How is this different from your friendly bank sending you a credit card without your approval? Infact that is something which I consider more dangerous than this act of stupidity by Netsol.
Having said this, I seriously think we're over reacting.
Shri -- returning to the scheduled Typhoon York.
You can change your password (Score:1)
Re:Site appears to be down (Score:1)
NSI/Slashdot Conspiracy Theory (Score:1)
You may have just given NSI more power then they deserve.
Wouldn't you just love to be a corrupted employee working for dot com mail?
Just think... if you were, you'd have passwords to hundreds of thousands of root accounts, etc.
God, what the hell were you guys thinking doing this. Big whoop. Spank NSI.
But realize that this is a double edged sword.
-krs
Re:Weird... (Score:1)
More likely is indeed the last name of the administrative contact. I've already found several that work that way
Good luck...
barbaBob
BTW: it's not for everyone (Score:2)
Re:Update (Score:4)
The number appended to the admins last name isn't random. If you do a whois lookup on yourself or your domain, you'll find this is actually your ns 'handle.' The number NS has appended to your last name (usually the entire last name, plus the uid), and is just as easy to obtain as any other piece of info you've registered.
Re:NSI/Slashdot Conspiracy Theory (Score:2)
Re:Bah! (Score:1)
As far as I can tell, this doesn't directly compromise control of the domain name, just the cheesy webmail account. Of course, as others have stated, that may be an effective tool to help with social engineering..
Anyway, I prefer to roll my own webmail service using Imp [horde.org] along with mod_ssl [modssl.org] which doesn't require sending cleartext passwords over the net.
We probably are, but... (Score:3)
You're right about there not being a real security at the moment. Only people who used their Dot Com Mail address as their contact's e-mail address will be at risk of losing control of their domain, since most of them use 'MAIL-FROM' as their authentication method for authorizing changes to their domain registration.
It does make me think about advertising ourselves as a 'Network Solutions Partner' though. But then again, I doubt that you'd be really better off with any of the other TLD registrars.
Cya
barbaBob
Password mailing. (Score:1)
I'm impressed... It's been a while since I saw a monumental cockup like that (well, since the hotmail affair anyway).
I'm sure that a couple of minutes adding a check with cracklib wouldn't have gone amiss, or just adding in a random password generator..
I wonder.. Do these people have a QC department, to make sure that the code they release is robust?
Or is a building of PHBs with a lone coder stuck in a cabinet somewhere and let out to be fed and watered every now and then..
For a large company with huge resources at their disposal, there's no excuse for not checking their functionality a hundred times before release... Especially as this is supposed to be their core business!!!
I'd love to see their PR dept. right now..
Re:We probably are, but... (Score:1)
Go to this URL and activate your account. On activation the password would be sent to the e-mail in your contact info.
BAD security. But not a major concern for now. Unless they have updated your NSI contact info to your new e-mail addr
Re:what am I missing? (Score:2)
You're most likely correct that most people will not believe that mail coming from slashdot@hotmail.com is from the
For a competitor, this could be a real easy way to generate bad publicity...
Re:NSI/Slashdot Conspiracy Theory (Score:1)
-krs
Re:Is USA.Net effected by this? (Score:1)
Even more annoying to me was... (Score:1)
So basically, if I don't want stupid emails like this, I have to give up "real-time" communication from NSI about my account? That sounds kind of stupid, don't you think?
Sujal
PARC Lemmings at Network Solutions (Score:5)
Check out this piece of wholesome goodness, delivered in the same message as my (cleartext) domain hijacking password:
If you do not wish to receive e-mail from Network Solutions, click on this
+e-mail address and type "remove" in the
+subject line.
PLEASE NOTE: by opting to be removed from this list we will not be able to
+communicate to you, in real-time, on issues regarding your account.
The mind boggles. One of the primary aspects of the net's formative power is its ability to quickly report the consensus of a company's customer base. Emails such as the one recently sent to all domain owners--containing both an unprecedented security breach and a jaw-dropping amount of arrogance(read our spam or we lose your bill)--only serve to increase internal communication within NSI's customer base, and to erode and eliminate the trust that the company has built up over the years.
I am positive there are alot of others out there like myself who hold a great deal of technical respect for their extremely high-uptime management of the closest thing we have to a single point of failure. They've done much right, and honestly, they've scaled better than one might have expected considering their ever increasing workload and the sheer number of years they've been doing their job.
I almost see a parallel to Microsoft here. People complain that the Windows 9x kernel is buggy, but considering that it runs everything from ancient DOS games to 32 bit applications, it's a miracle it runs at all. There's some truly respectable hackery involved in that! However, nobody, not even Microsoft's staunchest allies will say that their businesspeople are the most ethical in the industry, and most of the industry will claim that the Microsoft businessdroids have even less faith in their coders than the Linux bigots.
Why else fudge the numbers and force the shipments? Nobody's going to run Internet Explorer unless they're forced to...so lets force 'em. That seems to be the mindset.
Similarly, the Network Solutions folks have pulled off some significant technical miracles, but their business side is obsessed with the concept that nobody cares about anything technical. Since nobody would use NSI if they had an alternative registrar, the quality and quantity of alternatives must be fought tooth and nail. Since NSI is nothing but its collection of names and addresses retrieved under contract from the federal government, they'll claim de facto ownership of the WHOIS database until the Commerce Department's gun is pointed at their head with the hammer cocked.
Nobody cares about name resolution, you see. The real fad is WEB BASED EMAIL; create accounts for people without even following basic security procedures!
Nobody would actually want any of the services offered by NSI through email, so issue a vague threat to cut off all email--even that which is critical to the operation of one's domain--unless the domain owner agrees to sift through the latest thing being hawked by NSI.
The more NSI does in this style, the more they disenchant, disenfranchise, and disconnect themselves from their customer base.
There's no logical reason for this to occur.
I call all of this the PARC Lemming Syndrome. Every hi-tech businessperson secretly(or not-so-secretly) laments that he or she wasn't there at Xerox PARC to bring all of those amazingly profitable inventions to market. The agony of imagining so many lost dollars causes them to try to milk whatever or wherever they're at without due concern for what this will actually do to the businesses Core Competency [doxpara.com].
To the businessperson...maybe he's breaking loose, pulling ahead of the pack, about to lift off, ascend to new hights...or maybe she's in the middle of a herd, trailblazing, secure in the knowledge that together new possibilities are being forged.
The the customers, and the rest of us...just looks like a bunch of lemmings racing headlong towards a cliff.
I implore you, Network Solutions. Buy a clue. Get a twelve pack if needed. Your customers trust you because your uptime is unbeatable, your security is generally reasonably tight, and because you've been doing it right longer than anyone else in the business. I'm one of your customers. Before you tell me anything, offer me anything, or do anything, think of why I do business with you, and about what could make me stop.
Don't be a lemming!
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com [doxpara.com]
Once you pull the pin, Mr. Grenade is no longer your friend.
Incredible. Even for NSI. (Score:2)
This is frankly amazing. Not only that such a large, allegedly net-savvy company could make an elementary security blunder(*), but that they even thought to was a viable business plan.
After all, all existing domain holders already have valid contact addresses(**) and don't need another poxy webmail account. They're also likely to be the kind of net users who'd not use webmail for importantish stuff. Maybe they just wanted to be able to claim X current users to advertisers, whilst not telling them none of the actually use the service.
Just glad they don't seem to have included any domains I'm involved in...
(*) Hey! Has anyone tried to get root at NSI using the password 'nsinsi' or something?
(**) Except for the spammers, obv. Maybe NSI were aiming the service at spammers. That would certainly fit their modus operandi.
--
Still works.. (Score:1)
friggan turds.
Surfing the net and other cliches...
works (Score:1)
I just sucessfully picked 3 random names
and added nsi to the end for the password and it actually let me log in=P
The stupidity of some people...
Re:NSI/Slashdot Conspiracy Theory (Score:1)
Re:Is USA.Net effected by this? (Score:1)
Re:Mailing out passwords (Score:1)
1. I get a verbal request from operations
2. I tell operations to put it in writing
3. The request comes in writing
4. I generate a user ID & password generated by my random password generator
5. The user id & password goes out to the user by tracked mail. (Snail Mail)
Re:works (Score:1)
Imagine what that poor webmaster thought... (Score:2)
"Hey, look! My new e-mail service is getting tons of hits! Wow, it's only been available for a few hours, and everyone is logging in with their new accounts! Unbelievable! I'm going to be a huge success! I'll be on the cover of Fortune. Hotmail, move over, baby." (sound of smacking lips)
So let's all contribute to his trumped-up feeling of greatness. I'm logging in with every name I can find (someone else's, of course) and sending congratulatory e-mails to webmaster@dotcomnow.com about what a wonderful service this is, blah blah blah.
FYI, http://mail.dotcomnow.com [dotcomnow.com] still works, even though the original URL sent out in the e-mail is
And before you try it, I've already snatched clinton, lewinsky, and elvis. Heh heh heh....
No SSL either (Score:1)
Only customers inside the US of A? (Score:1)
barbaBob
Not at all surprised.... (Score:5)
I've seen networks brought to their knees entiely due to management making decisions on the network topology. I have seen distributed networks fail due to a management descision to consolidate all logins to one single server! (Doh!) I have spent hours trying to bring dead systems back to life because no one bothered to maintain or monitor the system for 7 years, hoping the system would look after itself, and once I got it working the machine suffered a catastrophic hardware failure, and no more spares were avaialble world wide. And it goes on...
The most ironic thing is that earlier this year I spent 4 months out of work. For every single interview, the decision rested on someone with no technical experience. I've found a position now, but it is 200 miles from home, and half the team I have to work don't deserve their position.
There are too many fools in this industry making decisions. No wonder NT is so bloody popular.
The moron who thought of this, and the bozo who hired him should never be allowed to touch a keyboard again.
Re:Even more annoying to me was... (Score:1)
-earl
NSI - Best security of all (Score:3)
Prepay for a domain name??? (Score:1)
Re:Update (Score:1)
If this is true, then they have me confused with someone else because that number is not part of my handle!
Just to make certain they hadn't assigned two handles to me, I did do a whois on the number I received and it returned information about someone else.
Another Potential problem with security.... (Score:1)
My guess is all you would have to do is change things put in a fake name, verify it when they call you and your all set.
Okay, so it's not critical information. But some people might be depending on this engine to find information about companies. Network Solutions is supposed to be a reputable company.
I'm still waiting for my phone call to see what they use to verify I have permission to change a companies information.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
heads up (Score:2)
The phrase "Core Competency" is a [tm] trademark of Gary Hamel, a management science professor at the London Business School. He's a cool enough guy (I know him), and doesn't usually get heavy over the fact. But he makes his living out of going round talking to companies as "the Core Competency[tm] guy". So he's a bit touchy if anyone else tries to pass themselves off. And sometimes he feels obliged to defend his trademark in order to stop it passing into the public domain ("use it or lose it")
I'm not sure what your firm DoxPara Research does, but if you're planning on using the phrase "Core Competency" in a consulting context, you might want to send ghamelATlbsDOTacDOTuk a message, just to keep everything above board.
Me, I'd say screw it, trademark law's a crock and the thing's probably gone public domain anyway by now. But the information can't make you poorer.
this free business advice brought to you by
jsm
Now I'm really scared... (Score:1)
I just changed the password for my own personal domain, but that got me thinking and I tried to guess the login/password for the domains of my customers.
Nearly every single one of them has ended in the digits 57. Within a few minutes of picking common names and numbers around 57, I was able to log in to dozens of accounts. It was hard to resist the temptation to commandeer account gates57 =)
Re:Update (Score:1)
Looks like I'll be checking out those alternative registrars quickly.
No, this reflects on NSI's security as a (w)hole (Score:2)
Someone assigned every single account the same password, in essence. This violates so many common sense rules that it's amazing: easy-to-guess user names, standard passwords, passwords sent out in regular e-mail, no authentication process, yadda yadda yadda. I mean, I just logged on and snagged three major commercial sites, just to see if I could do it. I'm batting
If I did something that stupid and assigned all my local office users with easy-to-guess passwords, it would be no big deal, because I'm small potatoes. But when a giant like NSI does it, it's insulting to all of us. None of us would make that mistake, and it's fair to say that most of us probably aren't getting paid whatever the NSI schmuck was.
Re:Wait a second... are we reacting too hastily? (Score:1)
And second, (I don't know how it is in the states these days) but a bank sending unwanted credit cards causes quite an outrage here in the Netherlands.
A big organization tried this with its members, trying to force the terms of the credit card company (with regards to abuse, etc.) on their members, and because of the outrage they had to change it such that those terms would only go into effect after the first authorized use of the credit card.
So yes, I agree with your c), it's just as bad as sending an unwanted credit card, and I think that's pretty bad.
EjB
This is 'webmaster@dotcomnow.com' talking! (Score:2)
I changed the password. I'll mail it to postmaster@netsol.com later on. Jeez....
Accept our SPAM or else! (Score:1)
If you do not wish to receive e-mail from Network Solutions, click on this e-mail address and type "remove" in the subject line. PLEASE NOTE: by opting to be removed from this list we will not be able to communicate to you, in real-time, on issues regarding your account.
So by opting out of their spam, you are opting out of ANY communication from them at all regarding your domain(s).
To paraphrase The Who, "Who the fuck are they????????
Bite My Ziff, Davis!
======
"Cyberspace scared me so bad I downloaded in my pants." --- Buddy Jellison
Alternative registrars -- who are they? (Score:4)
This is absolutely crazy, and I want it to be the last straw. I have been screwed over by NSI both personally and professionally now:
All in all, NSI has screwed me over again and again, and their callous disregard for professionals that need to get their jobs done by not even allowing me access to engineers (after repeated requests) to repair the aforementioned host handle problem is a load of bullshit.
Now, to the thrust of this posting -- where can I find these so-called alternative registrars? Are they yet capable of freeing me from the shackles of NSI -- to the point of never having to email anyone at networksolutions.com again -- and still keep my .com, .org, and .net's?
I sincerely hope that if they are not here now, that they arrive very soon. I have a lot of new business for them.
Way to deal with this... (Score:1)
When I tried to access my dot.com webmail (what a dorky name), I was told to go to mail.domainname.tld, which redirected me to my mailserver since I already register that machine name in my DNS settings.
---
Re:Update - Various ways (Score:1)
OH, and it gets worse... (Score:1)
Idiots (Score:1)
And people worry about electronic privacy. They should be more worried about gross ineptitude.
Put your dotcomnow mail account to good use! :) (Score:1)
The link in the email is either
My username/password was not related to any of my NIC handles in any way. The password was the combo of 'username+nsi' which is truly awful as already noted here.
You can go to http://mail.dotcomnow.com [dotcomnow.com] to access your account, so they definitely *haven't* taken the site down.
I logged in, changed my password, set up the vacation message, and sent mail to NSI expressing my displeasure at this rather silly attempt to gain yet more business from me ( it ain't gonna happen. )
So now, when they reply to my emails, they'll get my autoreply vacation message.
Hrm... wonder if there are any autoresponders at NSI that I could mail from my wonderful new account... ( heh )
Huh? (was Re:Way to deal with this...) (Score:1)
If they had tried to pull something on redirecting mail on my domain at all, you can bet I would be down to Herndon (they are in Herndon, aren't they?) as fast as I could with an aluminum bat demanding to see the person who made that decision.
You know what makes me MAD? (Score:1)
As I read this, it means that if I choose not to get their spam, then they will not email me anything at all! Like "Your domain is being shut down". Now maybe that isn't really what they mean -- but if not they are deliberately making it sound like that's what they mean.
I really, really, really resent this. Guys -- it is clear that Network Solutions and the domain name system in general is completely, totally out of control. I have been waiting 5 years for some reasonable new TLD's. Waiting, with no luck. All because of network solutions. I want these jerks out of business, and I think I know how.
I think it's time to start our own DNS, a la alternic. If we could get participation from slashdot participants, we would probably cover 50% of the net. If we really agressively pushed it, we could probably get 90% coverage.
*sigh* It would probably never work, but internic makes me mad.
Server offline? (Score:1)
Now, I can't even get online! The server must be down or just bogged by people trying to break in to the server. What a load of crud...
Take a look at the headers, folks. (Score:1)
INTEGRAM (INTEGRAM4-DOM)
2730 Prosperity Ave.
FAIRFAX, VA 22031
US
They don't seem to have much in common with NSI. their web address seems to be an empty directory (has the apache feel to it though).
So, what gives with this?
Re:Oh dear (Score:1)
Just use the account to spam Network Solutions, and maybe they'll revoke your account!
reminds me of that 70's SNL skit... (Score:1)
"We'll sell your personal information if we feel like it. We'll privitize public information. We'll set up an e-mail account for you, without even asking, and make the password obvious. If you complain, we won't care. We don't have to. We're NSI."
Scary thing is, back then it was comedy. Now, it's the truth.
Re:You know what makes me MAD? (Score:1)
They seem to have shut it off now (Score:1)
Re:Only customers inside the US of A? (Score:1)
Thanks, Slashdot. This has given me the chance to look good in front of some pretty senior people here.
Paul.
Re:Mailing out passwords (Score:1)
Man! Is this one of my biggest pet peeves! I can kinda understand it for a service that generates a password for me-- I need to log in real quick and change it. It's basically a one time password.
But when I sign up, and PROVIDE a password, and STILL the service sends me an insecure e-mail with the password I JUST PICKED, it really pisses me off!
Even worse, there was a site (I forget which one now) that I hadn't visited in awhile. So, I get spam from them saying, "Hi we haven't seen you around in awhile, in case you forgot, here's your username and password!"
AAAAUUUGGGHHH!!
Re:Update (Score:1)
SIGH (Score:1)
Oh well, it's not like I have nothing to do anyways, I'm glad internic created me this account, it is a true service on there part.
Now I can access my email from home, work and on the road
What ever happened to the key concept in CS 101?
KISS - Keep It Simple Stupid.
These morons are in cahoots with MS (Score:1)
This really sucks and I'm not renewing my domains with NSI ever again - when they expire I'll register with someone else and I'll lobby to have them put on the MAPS RBL if they spam me again [slashdot.org].
These f*ckers have screwed up before but this really takes the cake. I swear to God they've got to be working with MS on this!
Re:NSI/Slashdot Conspiracy Theory (Score:1)
I would hope no slashdotters would be foolish enough to do that.
I've changed the password for "my" account and for those of the Fortune 100 company I work for to such things as "idiots.nsi", "nsi-criminals", etc.
(I also got into "amazon", "bn", and "msn", but don't want to be seen as trying to "take" those accounts... they're available right now if anyone wants them!)
Re:However much you may hate XXXX corp. (Score:1)
They ignore their own spamming and nearly get blacklisted.
They make a security blunder and 10-year old with a couple of computer classes in school wouldn't make.
Why can't I go somewhere else for my service? This might be a naive question, but somebody humour me and explain this, please.
Mike
Re:heads up (Score:1)
Good luck. I have seen that phrase used at least 10,000 times over the last six years [yes, I was on the dark side in an MBA program], in widely distributed business journals and mass market publications, without attribution or a trademark reference. IANAL, but I think he would have a hard time bringing a case against anyone based on the widespread public use of the phrase.
sPh
Re:...also username=last_name, pw=last_name+nsi... (Score:3)
Note, for last names that are consecutively numbering them. So the first the accounts are set up like this:
user: smithpass: smithnsi
user: smith1
pass: smith1nsi
user: smith2
pass: smith2nsi
user: smith3
pass: smith3nsi
user: smith4
pass: smith4nsi
Needless to say I don't consider that a good security measure either. And no, I'm not telling you what mine is numbered...
--
Gah. (Score:2)
Oh, and they only have authenticated web-based access for modification. I don't think they use https, though, but then again, email-based NSI updates aren't exactly secure either.
This just settles it for me. I'm never going to trust NSI with any domainnames.
---
"'Is not a quine' is not a quine" is a quine.
Re:heads up (Score:2)
Did he come up with the concept that I named my paper after? Hurm, after I clean it up a bit(some significant alterations are in order after that rather interesting session I had at LWCE), I may toss the paper over to him for evaluation.
The term is reasonably public domain(hell, I've heard of it), but if he's the inventor of the field of thinking, it would behoove me to understand a bit more of what his theories are.
(For those who are wondering WTF all this is about--Core Competencies [doxpara.com] is an essay regarding the economics of Open Source. I brought it up when discussing the diseconomic meanderings of everybody's favorite registrar.)
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
Once you pull the pin, Mr. Grenade is no longer your friend.
Need directions to change to alternate registrar (Score:2)
Thanks.
The risks of email spoofing (Score:2)
OTOH, this is a problem because "dotcomnow" is NSI, and NSI has a reputation for trust. Thus, there's a world of difference between "microsoft@foo.com" and "microsoft@dotcomnow.com".
Just some thoughts for figuring out how nasty this security breach is.
Re:what am I missing? (Score:2)
Bottom line, the ability to recieve mail under a domain, in all but a few exceptions, is not the be-all end-all of security breaches. The only people who would be fooled by this aren't going to take the time to reply back; they're going to take it at face value.
Hotmail was a security breach. This is stupidity, but on a far more minute level.
Forward all NSI SPAM to the MAPS RBL. (Score:3)
---
Spammed? Click here [sputum.com] for free slack on how to fight it!
Re:Alternative registrars -- who are they? (Score:2)
http://www.joker.com/
(not a joke)
Re:heads up (Score:2)
I attempted to email Gary, but the message was returned. Could you verify his address and contact me? I'd like to contact him, per your suggestion.
I checked google--yeah, this guy very likely would be interested in the software impacts of much of his economic theories. Particularly with the business model evolution I need to work on involving the future of software development--his input would definitely be appreciated.
Thanks!
Yours Truly,
Dan Kaminsky
DoxPara Research
http://www.doxpara.com
Once you pull the pin, Mr. Grenade is no longer your friend.
Re:You know what makes me MAD? (Score:5)
Err...not true. The main reason no new gTLDs have been rolled out is that the Intellectual Property (IP) and Trademark (TM) interests are scared of cybersquatting, and refuse to pay what it would cost to police these new gTLDs for possible infringement. This is troublesome, because IP and TM law require the famous mark holder to bear the cost of protecting their marks. They want to shift that cost to the registry and/or registrar, who will of course pass it on to the domain name owner.
They keep asking for things like unilateral, full, standardized, searchable access to all registrant data, enforced verifiable contact info, heavily restrictive and punitive Dispute Resolution Policies, etc.
NetSol may suck, but in this instance, it's not NetSol that's creating the vacuum. It's the people who own famous names and marks, who keep pushing for more than anyone is willing to give. Net result: No new gTLDs.
If you're concerned, stop whining and get involved. The ICANN Domain Name Service Organization [dnso.org] is acting on these very issues right now.
The Individual Domain Name Owners' Association [idno.org] is fighting to ensure things like equity in dispute resolution and protection of your personal information are present in the future worldwide DNS system.
Nice domain name (Score:2)
Class action lawsuit (Score:2)
Anybody want to start a mailing list? If we can get about 1,000 subscribers I think we might have something here.
Re:No, try THIS. (Score:2)
Time to clean the mountain dew of my damn monitor now.
Re:However much you may hate XXXX corp. (Score:2)
Why doesn't our (USA) government take the monopoly away and assign it to another company? Can't be all that hard to transfer control of a bunch of root domain servers over to another company, can it?
Re: NSI real name (Score:2)
Re:Alternative registrars -- who are they? (Score:3)
Register.com [register.com] was the first. Joker.com [joker.com] is currently the cheapest (it's based in Germany but its English webpages are passable).
Jamie McCarthy
Re:what am I missing? (Score:2)
Re:Prepay for a domain name??? (Score:2)
Forcing online billing is their way of saying that they can't do their own accounting.
fake? (Score:3)
Transfer registration to register.com! (Score:2)
Apparently, register.com lets you transfer the registration of your domain from NSI to them. Check out this page [register.com]. It seems to require a fax or snail-mail, but at this point, I don't really care how clumsy it is.
We have choices. (Score:2)
----
We all take pink lemonade for granted.
Re: Unsolicited credit cards (Score:2)
They can, and do, send you "preapproval" letters that only require you to confirm some information and sign it. Someone can still steal these letters and forge you signature, but theft and forgery are already crimes.
It is legal for a company to issue you a replacement card without prior notice, but it runs the risk of pissing off customers. A bank manager quietly told me that a full third of the customers, including myself, closed our accounts after our bank was bought out and the new bank decided to issue "debit cards" (pre loss caps) to replace "atm cards" without prior notice or consent. It was rude, crude, and socially unacceptable, but legal.
Back to the "generous" NetSol offer, I am outraged. And not just because they keep making me these wonderful offers yet are incapable of changing my contact informaton despite repeated requests.
The currency on much of the net today is reputation, and NetSol's indifferent disregard to the consequences of its actions is as shocking to our sensibilities as the 60's banks disregard to the consequences of it's far-too-open credit card policy was to their peers. Of course nobody should automatically assume that the NetSol accounts are actually controlled by the person whose name appears on them, but a lot of people will. Unlike most (all?) other free mail sites, NetSol accounts can be tied to real names, real addresses and real phone numbers. So they have *far* more intrinsic credibility than "HotMail" or "GeoCities."