[ga] RISKS: Changing Domain Registration info without verification

[Thomas Roessler <roessler@does-not-exist.org>]

----- Forwarded message from RISKS List Owner <risko@csl.sri.com> -----

To: risks@csl.sri.com
Date: Tue, 15 Apr 2003 16:51:07 PDT
Subject: [risks] Risks Digest 22.69

RISKS-LIST: Risks-Forum Digest  Tuesday 15 April 2003  Volume 22 : Issue 69

   FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
   ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator


Date: Sun, 30 Mar 2003 16:41:51 -0500
From: risks@Orwellian.Org
Subject: Changing Domain Registration info without verification

I found a reference to a USPS Web site allowing anyone to issue a change of
address via the web in a 1997 issue of RISKS.
  [Actually, it allowed you to print a form that you could mail in.
  See RISKS-19.18 to 19.20.  PGN]

Here's a twist I recently noticed, as conveyed in a message I just sent
Network Solutions:

  I just tried to login to my ******** account for the first time in a long
  time, and it is trying to force me to accept a service agreement before I
  can access my account.

  I don't know if it was in the previous service agreement, but this
  provision is UNACCEPTABLE:

  #  4) You agree that VeriSign is authorized, but not obligated,
  #  to use Coding Accuracy Support System (CASS) certified software
  #  and/or the National Change of Address program (and/or such other
  #  systems or programs as may be recognized by the United States
  #  Postal Service or other international postal authority for
  #  updating and/or standardizing address information) to change
  #  any address information associated with your account (e.g.,
  #  registrant address, billing contact address, etc.), and you agree
  #  that VeriSign may use and rely upon any such changed address
  #  information for all purposes in connection with your account
  #  (including the sending of invoices and other important account
  #  information) as though such changes had been made directly by you. 

  This USPS change-of-address can be done BY ANYBODY WITHOUT VERIFICATION at
  https://moversguide.usps.com/

  I DO NOT authorize that my contact information be changeable by anyone via
  this process. (The USPS site even lets the e-mail address be changed.)

  If you cannot remove this clause from my agreement to service, I will
  transfer my registration to Register.com, which does not have this
  provision.


----- End forwarded message -----
--
This message was passed to you via the ga@dnso.org list.
Send mail to majordomo@dnso.org to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html