Re: Registry lock - two-factor or intervention

On 09/19/13 01:29, Jay Daley wrote:

> In my view, the threats and  realistic likelihood of those threats, are:
> 
> 1.  The registrar is hacked and the miscreant sends a change request using the registrar credentials. [Likelihood = Possible]

That's an understatement. Sooner or later this will happen to some
registrar(s) We've had that experience with some of our registrars, so
have others (most of us probably remember the New York Times incident).

http://blog.fox-it.com/2013/08/05/dns-takeover-redirects-thousands-of-websites-to-malware/

> .nl
> 	• service called .nl control
> 	• lock all data, but not name servers

Locking of (in zone) name servers will be possible in due time with
'nl-Control'. After the incident above, we have speeded up the
development of that feature.

> 	• it is a manual process
> 	• sold for 50 Euros per annum

That's is probably a retail price. Wholesale prices are considerably
lower (but upon request of our registrars we refrain from publishing
wholesale prices).

> 	• numbers sold are very low

Surprisingly low, given the risks involved.

--
Marco
SIDN

_______________________________________________
provreg mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/provreg