8 ms·

Do not let your domain expire with Google Apps

281 points by benreyes 15y ago

tallanvor 15y ago
I originally registered one of my primary domains through Google, but I transferred the domain to my primary registrar before I had to renew it. --Back then there were some problems with people not being able to renew some domains and running into problems as a result.
brackin 15y ago
Great post ben i'm amazed this can happen with such ease.
DenisM 15y ago
You have likely broken the law by accessing that Amazon account which was not yours, and now you blog about it. It might be a good idea to talk to a lawyer. not a legal advice
- ditojim 15y ago
  it sure sounds like legal advice. does saying it isn't legal advice make it true?
  - JeremyBanks 15y ago
    Without the disclaimer, in some jurisdictions the post could be interpreted as unauthorized or inappropriate practice of law. http://en.wikipedia.org/wiki/IANAL http://en.wikipedia.org/wiki/IANAL
    - ditojim 15y ago
      so someone can give legal advice, but say it isn't legal advice, and that makes it not legal advice?
      - deleted 15y ago
        [deleted]
      - JeremyBanks 15y ago
        IANAL, but I think that in this context "legal advice" has a meaning beyond the English one. It is also used to indicate an attorney-client relationship and the associated liability and confidentiality. So someone can give legal advice (English), but say it isn't legal advice (Legalese) and that makes it not legal advice (Legalese).
        jacques_chester 15y ago
        The main reason for IANAL, TINLA is that lawyers have attorney's immunity, and joe shmoe does not. If somebody relies on my opinion as if it is legal advice and from the circumstances it looks like legal advice, I can be in deep poop if the advice was wrong.
        mtogo 15y ago
        You can say shit on the internet.
        jacques_chester 15y ago
        I see your point. The law does not. I use the same disclaimer on websites, in email, over the phone or down at the pub.
        mtogo 15y ago
        I meant literally the word "shit". Your point is completely valid.
        jacques_chester 15y ago
        Well shit.
      - 15y ago
- benreyes 15y ago
  I accessed the person(s) amazon account to find contact information. They are now fully aware that I accessed the account as I left a voicemail. I offered full access to the GMAIL account and gave the password on the Amazon account so it could be shut it down and alert amazon who could also further do a full audit of what I accessed. There does not seem to be any alarming distress in the situation. It has been over 2 months since the incident, I made sure that the person(s) involved was fully aware and of the blog post. No issue was raised about me writing it up and posting it. I also waited for a period of time to hear back from the Google Security Team. I believe I have taken the correct response here.
  - deleted 15y ago
    [deleted]
  - jacques_chester 15y ago
    The philosophical nature of criminal law in common law countries is that offences against a person are offences against the Crown or People (depending on your jurisdiction). The practical outcome is that the Crown or People can choose to independently charge you of a crime, regardless of what the actual 'victim' wants. Be careful. Of course, IANAL, TINLA.
  - MichaelApproved 15y ago
    There was no need to notify the owner of the issue. If your intentions were honest, as I'm sure they were, then just delete the information. You don't need to break into the amazon account to notify anyone since the information wasn't public and you weren't going to do anything malicious with it.
- joshfraser 15y ago
  Good idea to talk to a lawyer? I'd wait until you're actually sued before wasting your time and money worrying about something so stupid. Most people aren't going to sue you if explain what you did (and why) and it's obvious you had genuine intentions.
  - pyre 15y ago
    Personally, I think that's naive. There are a lot of people that will overreact in the extreme. Especially since they've been caught with their pants down (even though they haven't been specifically outed by name).
  - patio11 15y ago
    Danger Will Robinson! Danger! As anybody who has recently decided to browse Sarah Palin's email can tell you, accessing a computer system to which one does not have legitimate access to with genuine intentions is still a federal crime and "It was easy to do!" is not a defense. If you ever find yourself logged into someone else's account log out and, if you absolutely have to reproduce it, reproduce the attack against an account you have legitimate control over. (e.g. Register dummydomain.co, set up a Google apps account tied to it, transfer the domain, regain access to the Google apps account using nothing but the DNS settings to the transfered dummy domain. If this succeeds, you know you can compromise any account linked to a Google Apps email account on an expired domain -- you don't need to commit a federal crime to demonstrate this.)
    - Retric 15y ago
      Don't take this as legal advice, but there is such a thing as mitigating circumstances. Your suggested approach leaves a gaping security hole open for a fairly long time before anything happens. Also, simply logging in once and doing nothing to verify a new security breach is vary different then browsing info. It's like noticing a door was left slightly open yelling your doors open and if nobody answers and closing but not locking it. Technically you broke the law, but a prosecutor is unlikely to win a case so they will probably just drop it. PS: Under the right circumstances you could still be sued though. Edit: You can also be sued for just about anything so IMO it's somewhat moot.
- larrys 15y ago
  Bring a law suit against someone requires, in general, damages or some loss. Not to mention a retainer. Getting a prosecutor to enforce a law when there is essentially no harm would be next to impossible. If a law was broken.
joshfraser 15y ago
It sounds like Google have changed their policies on this. Just a few months ago I was caught on the other side of this issue. Basically I bought a domain and wasn't able to get Google Apps set up because someone else had used it in the past. Here's the full story: http://www.onlineaspect.com/2010/11/12/issues_with_google_apps/ http://www.onlineaspect.com/2010/11/12/issues_with_google_ap...
- benreyes 15y ago
  Thanks JoshFraser, I have appended a note to the blog post to check your comment on here. Although the Google Apps team may have altered their policies according to my blog post which I contacted them about 2 months ago. This issue is still a serious matter. I would have still been able to access the person's Amazon account using a wildcard email address. Although it does lessen the blow if a social engineer takes a hold of your domain as they might not be able to get into your GMAIL, but the real lesson here is you shouldn't let your domains expire with any form of identity or online accounts still attached to them. It's also a cautionary tale of what you leave up on the cloud when you abandon your email account. I could have potentially found a lot more damaging information from gaining access to this persons email.
  - pyre 15y ago
    > This issue is still a serious matter. I would have still been able > to access the person's Amazon account using a wildcard email > address. That's just a general 'loss of domain' issue. It would also be much harder. This Google Apps issue allows you to exploit everyone using that domain without any prior knowledge. Without access to the previous Google Apps accounts, you would have to be specifically targetting someone. (Note: This is the same for any service similar to Google Apps.)
btucker 15y ago
Any thoughts on how Google could prevent this? Seems important they provide a way to reclaim domains.
- vladd 15y ago
  When a domain is being reclaimed by someone signed into a different Google Account than the previous admins, check if the domain's whois creation date has changed, and if so, make it mandatory to wipe out the data previously associated with the domain before continuing. In addition, password resets via email requested at domains having the whois creation date after the account creation date should probably be disabled.
- DenisM 15y ago
  Require a phone number and send SMS for accessing domains which have previously expired.
  - vladd 15y ago
    That won't work for existing customers since requiring a phone number must be done when initially signing up. In addition, expired domains purchased by someone else won't be usable with Google Apps.
- Sidnicious 15y ago
  I think that the trust model for Google Apps account recovery is wrong. The domain name is a separate asset from the Apps account and the data in it. The owner of the domain name should be able to create a brand-new Google Apps account for it. Recovering access to an account should be done through another channel (secondary email address, SMS, postal mail).
  - vladd 15y ago
    This isn't practical since any Apps admin account has by definition access to modify/reset all regular accounts belonging to that company/domain, so if you don't use things like wipeouts upon whois creation date modifications, the potential to expose a lot of private data from the former owner still exists.
ltamake 15y ago
Google should remind you that your domain is expiring and offer to switch to a regular account or clear your data.
- dspillett 15y ago
  Is it really Google's responsibility though? You'll already be getting emails from your registrar telling you that the domain is about to expire. And it isn't just Google, any service that is linked to another account/service in this way would be vulnerable, so the headline should be "don't let X expire while you have important stuff in Y that can be accessed through it". That said, a warning message on login would be nice. They could check the whois records on initial registration to see when the domain is due to expire, and verify that (in case it has been extended) before giving a warning. There is an easy way to detect a domain expiring that would stop accidental access to data like this by new domain owners. IIRC on signup for Google's apps you add a TXT record to the domain to prove that you control it - if a domain is expired and renewed by someone else then this TXT record will be gone. Again there is no need to check on every login, just when the domain is due to have expired. Of course this does not protect against intentional access, as the TXT record could be remembered and re-entered by the attacker if they are registering the name specifically to get access to the data on accounts like Google apps.
cwb71 15y ago
Thanks for pointing out this issue, Ben. I am curious why you did not mention whether there is an option to simply delete your Google Apps account before letting the domain expire?
hackount 15y ago
Making sure to renew your domain name is a good solution if you actually want to keep your domain. But what if you are done with that domain, and purposely let it expire? Is there a way to delete your Google Apps account entirely before letting the domain name expire, so the next person to register that domain can start from scratch with Google Apps, as if that domain had never been used before?
- lmok 15y ago
  There is an option in the Google Apps cpanel: "Delete Google Apps for mintcake.com". Underneath which it reads: "You can close your Google Apps account and delete all user accounts and data associated with it." It's in Domain settings > Account information.
  - phillijw 15y ago
    But this is only accessible BEFORE you drop the domain, right? I just logged in to one I dropped a few months ago (before I realized this was a problem) and I was not able to access my inbox or any other settings even though I knew the password.
kwantam 15y ago
A few weeks ago I tried to register Google Apps on a domain I purchased, and found that it'd already been registered by someone else. I sent an email to the support team explaining that there was a previous account and that I was the new owner, and upon proving that the domain was now mine they deleted the old account and had me start anew. Obviously, while the email-support method is safe, the automated system for unlocking admin access based on "proof of ownership" is pretty scary! Seems like this could be solved by requiring you to prove ownership and then releasing new auth info to a linked email account on a different domain. That helps to establish both present ownership and a chain of ownership back to the last time you had authorized access and were able to adjust the "emergency email account" setting. It's not perfect, but it's a heck of a lot better. It also seems to me like someone wanting to abuse this right now could do so pretty easily: you can confirm that a domain is available and that it has had a google Apps account set up in the past before you spend a dime, so you can just set a computer to trawling known Google Apps domain names (e.g., by looking at traffic on large mailing lists) to find ones whose registration has expired.
steveh73 15y ago
You did not completely censor the last screenshot.
megamark16 15y ago
It took me about 10 minutes to write a python script that grabs a list of recently expired domains and checks each domain to see if it's a valid Google Apps domain. This is a pretty serious issue, if indeed it's still possible to take ownership of accounts as the article suggests. Hopefully Google has added some mitigating steps to keep this sort of thing from happening.
- DenisM 15y ago
  How do you verify if a domain has a google apps account? I actually need this for a different, legitimate purpose.
  - megamark16 15y ago
    The off the cuff way I was doing it was to go to https://mail.google.com/a/DOMAIN_NAME/ https://mail.google.com/a/DOMAIN_NAME/ and see if I get a login screen or an error saying that the domain wasn't using google apps.
    - DenisM 15y ago
      I see. Some domains use SAML authentication, so it doesn't work as well for them. E.g. uw.edu
- asbtlt 15y ago
  tltbutik.ru
- deleted 15y ago
  [deleted]
- asbtlt 15y ago
  arbuz1.ru baka-club.ru infame.ru puzkarapuz.ru luxury-institute.ru khrip-time.ru oilgasservice.ru voxtelecom.ru skippy.ru relaxpnz.ru kupi-proektor.ru akr-komanda.ru madamfurne.ru instaforgeg.ru oblomfilm.ru cmt-mitishi.ru 2mq.ru 4low.ru obzori.ru 2v4.ru tvfreak.ru concurent-vrn.ru baztv.su de-ti.ru autokg.ru kovgok.ru briztur.ru all-rest.ru opti-pro.ru infomarker.ru smartcities.ru stroystudio.ru instrumentnn.ru ontam.su beage.ru eds63.ru klint.ru moda1.ru otwod.ru nonic.ru pl110.ru apk-vs.ru mirrpg.ru sement.ru 1078fm.ru animirk.ru bigbear.ru dudusya.ru emiflex.ru odp-spb.ru
zacharypinter 15y ago
Any idea if this applies for a domain that's an alias to your primary domain? For example, if you have foo.com as your Google Apps domain, and you have foo.us as an extra domain that was aliased but then expired, does that expose the foo.com Google Apps account?
- pyre 15y ago
  If Google Apps doesn't know about foo.us, then I think that answer would be no. (Though I would confirm this with someone more knowledgeable)
  - pasbesoin 15y ago
    I haven't used the alias feature, myself, but I believe the grand parent post is asking about a circumstance where your Google Apps account specifically does know about and supports the second domain (as an alias).
    - zacharypinter 15y ago
      Exactly. Thanks for clarifying :)
kevinpet 15y ago
Google's problem isn't in their authentication, it's in the whole idea that having a domain name now means I should have access to the previous google apps account. They're separate entities. This is probably related to why google isn't able to move an apps account to a new domain (our real domain is just an alias to our google apps account on previous company name's domain).
giberson 15y ago
While it may add an extra step on their end process wise, it seems like the obvious solution to this matter is to simply enact a policy such that if domain ownership changes hand the associated accounts are reset unless a signed transfer of ownership and proof of identity is provided by the original owner.
- jacques_chester 15y ago
  Everything I've ever read about Google's customer support infrastructure is that they don't "do" person-to-person transactions. Hardcopy? You must be joking.
  - giberson 15y ago
    I was simply supplying what a solution was--which has nothing to do with Google's likelihood to implement it.
  - lukeschlather 15y ago
    That seems to square with my experience. Google Apps is free for nonprofits up to 3000 users, though they start you out with something like 100. I hit the "request more users" button and I was up to 500 almost instantly (though it said "we'll get back to you" after I hit the button.
- jonknee 15y ago
  That sounds like an awful idea. If you update your Whois information all of a sudden all your Google Apps data gets deleted? I'd be furious.
  - giberson 15y ago
    I hadn't considered the case of updating whois information. However, to resolve that issue I'd simply provide a mechanism where you could flag your account as pending an authorized whois update. Then, when the whois is updated, google would not take any action since the update was pre-approved by yourself.
deleted 15y ago
[deleted]
yuhong 15y ago
"There's more, around the last 4 digits of a credit card. This is used by others as authentication when you loose your password, for example PayPal." Can you say fundamentally flawed?
a3_nm 15y ago
Notice that you will have the same kind of trouble if you're using OpenID on your own domain and let it expire... (An attacker could buy the domain name and set up a page at your OpenID URL which would delegate the OpenID to something under their control.)
larrys 15y ago
I want to point out that as a ICANN registrar not a day goes by where some tech person working on behalf of a customer will contact us and request an auth code to transfer out a domain name. Just like that. As if we will send one to anyone that asks. Later when the customer makes the request many times the domain ends up at another registrar in the name of the tech person, isp, web designer etc. who has been told they need to be able to login and make changes. The name subsequently is deleted for non-payment (customer isn't notified and invoice goes to new contact) and they loose control of their domain.

281 points by benreyes 15y ago

I originally registered one of my primary domains through Google, but I transferred the domain to my primary registrar before I had to renew it. --Back then there were some problems with people not being able to renew some domains and running into problems as a result.

brackin 15y ago

Great post ben i'm amazed this can happen with such ease.

DenisM 15y ago

You have likely broken the law by accessing that Amazon account which was not yours, and now you blog about it. It might be a good idea to talk to a lawyer. not a legal advice

ditojim 15y ago
it sure sounds like legal advice. does saying it isn't legal advice make it true?
- JeremyBanks 15y ago
  Without the disclaimer, in some jurisdictions the post could be interpreted as unauthorized or inappropriate practice of law. http://en.wikipedia.org/wiki/IANAL http://en.wikipedia.org/wiki/IANAL
  - ditojim 15y ago
    so someone can give legal advice, but say it isn't legal advice, and that makes it not legal advice?
    - deleted 15y ago
      [deleted]
    - JeremyBanks 15y ago
      IANAL, but I think that in this context "legal advice" has a meaning beyond the English one. It is also used to indicate an attorney-client relationship and the associated liability and confidentiality. So someone can give legal advice (English), but say it isn't legal advice (Legalese) and that makes it not legal advice (Legalese).
      - jacques_chester 15y ago
        The main reason for IANAL, TINLA is that lawyers have attorney's immunity, and joe shmoe does not. If somebody relies on my opinion as if it is legal advice and from the circumstances it looks like legal advice, I can be in deep poop if the advice was wrong.
        mtogo 15y ago
        You can say shit on the internet.
        jacques_chester 15y ago
        I see your point. The law does not. I use the same disclaimer on websites, in email, over the phone or down at the pub.
        mtogo 15y ago
        I meant literally the word "shit". Your point is completely valid.
        jacques_chester 15y ago
        Well shit.
    - 15y ago
benreyes 15y ago
I accessed the person(s) amazon account to find contact information. They are now fully aware that I accessed the account as I left a voicemail. I offered full access to the GMAIL account and gave the password on the Amazon account so it could be shut it down and alert amazon who could also further do a full audit of what I accessed. There does not seem to be any alarming distress in the situation. It has been over 2 months since the incident, I made sure that the person(s) involved was fully aware and of the blog post. No issue was raised about me writing it up and posting it. I also waited for a period of time to hear back from the Google Security Team. I believe I have taken the correct response here.
- deleted 15y ago
  [deleted]
- jacques_chester 15y ago
  The philosophical nature of criminal law in common law countries is that offences against a person are offences against the Crown or People (depending on your jurisdiction). The practical outcome is that the Crown or People can choose to independently charge you of a crime, regardless of what the actual 'victim' wants. Be careful. Of course, IANAL, TINLA.
- MichaelApproved 15y ago
  There was no need to notify the owner of the issue. If your intentions were honest, as I'm sure they were, then just delete the information. You don't need to break into the amazon account to notify anyone since the information wasn't public and you weren't going to do anything malicious with it.
joshfraser 15y ago
Good idea to talk to a lawyer? I'd wait until you're actually sued before wasting your time and money worrying about something so stupid. Most people aren't going to sue you if explain what you did (and why) and it's obvious you had genuine intentions.
- pyre 15y ago
  Personally, I think that's naive. There are a lot of people that will overreact in the extreme. Especially since they've been caught with their pants down (even though they haven't been specifically outed by name).
- patio11 15y ago
  Danger Will Robinson! Danger! As anybody who has recently decided to browse Sarah Palin's email can tell you, accessing a computer system to which one does not have legitimate access to with genuine intentions is still a federal crime and "It was easy to do!" is not a defense. If you ever find yourself logged into someone else's account log out and, if you absolutely have to reproduce it, reproduce the attack against an account you have legitimate control over. (e.g. Register dummydomain.co, set up a Google apps account tied to it, transfer the domain, regain access to the Google apps account using nothing but the DNS settings to the transfered dummy domain. If this succeeds, you know you can compromise any account linked to a Google Apps email account on an expired domain -- you don't need to commit a federal crime to demonstrate this.)
  - Retric 15y ago
    Don't take this as legal advice, but there is such a thing as mitigating circumstances. Your suggested approach leaves a gaping security hole open for a fairly long time before anything happens. Also, simply logging in once and doing nothing to verify a new security breach is vary different then browsing info. It's like noticing a door was left slightly open yelling your doors open and if nobody answers and closing but not locking it. Technically you broke the law, but a prosecutor is unlikely to win a case so they will probably just drop it. PS: Under the right circumstances you could still be sued though. Edit: You can also be sued for just about anything so IMO it's somewhat moot.
larrys 15y ago
Bring a law suit against someone requires, in general, damages or some loss. Not to mention a retainer. Getting a prosecutor to enforce a law when there is essentially no harm would be next to impossible. If a law was broken.

joshfraser 15y ago

It sounds like Google have changed their policies on this. Just a few months ago I was caught on the other side of this issue. Basically I bought a domain and wasn't able to get Google Apps set up because someone else had used it in the past. Here's the full story: http://www.onlineaspect.com/2010/11/12/issues_with_google_apps/ http://www.onlineaspect.com/2010/11/12/issues_with_google_ap...

benreyes 15y ago
Thanks JoshFraser, I have appended a note to the blog post to check your comment on here. Although the Google Apps team may have altered their policies according to my blog post which I contacted them about 2 months ago. This issue is still a serious matter. I would have still been able to access the person's Amazon account using a wildcard email address. Although it does lessen the blow if a social engineer takes a hold of your domain as they might not be able to get into your GMAIL, but the real lesson here is you shouldn't let your domains expire with any form of identity or online accounts still attached to them. It's also a cautionary tale of what you leave up on the cloud when you abandon your email account. I could have potentially found a lot more damaging information from gaining access to this persons email.
- pyre 15y ago
  > This issue is still a serious matter. I would have still been able > to access the person's Amazon account using a wildcard email > address. That's just a general 'loss of domain' issue. It would also be much harder. This Google Apps issue allows you to exploit everyone using that domain without any prior knowledge. Without access to the previous Google Apps accounts, you would have to be specifically targetting someone. (Note: This is the same for any service similar to Google Apps.)

btucker 15y ago

Any thoughts on how Google could prevent this? Seems important they provide a way to reclaim domains.

vladd 15y ago
When a domain is being reclaimed by someone signed into a different Google Account than the previous admins, check if the domain's whois creation date has changed, and if so, make it mandatory to wipe out the data previously associated with the domain before continuing. In addition, password resets via email requested at domains having the whois creation date after the account creation date should probably be disabled.
DenisM 15y ago
Require a phone number and send SMS for accessing domains which have previously expired.
- vladd 15y ago
  That won't work for existing customers since requiring a phone number must be done when initially signing up. In addition, expired domains purchased by someone else won't be usable with Google Apps.
Sidnicious 15y ago
I think that the trust model for Google Apps account recovery is wrong. The domain name is a separate asset from the Apps account and the data in it. The owner of the domain name should be able to create a brand-new Google Apps account for it. Recovering access to an account should be done through another channel (secondary email address, SMS, postal mail).
- vladd 15y ago
  This isn't practical since any Apps admin account has by definition access to modify/reset all regular accounts belonging to that company/domain, so if you don't use things like wipeouts upon whois creation date modifications, the potential to expose a lot of private data from the former owner still exists.

ltamake 15y ago

Google should remind you that your domain is expiring and offer to switch to a regular account or clear your data.

dspillett 15y ago
Is it really Google's responsibility though? You'll already be getting emails from your registrar telling you that the domain is about to expire. And it isn't just Google, any service that is linked to another account/service in this way would be vulnerable, so the headline should be "don't let X expire while you have important stuff in Y that can be accessed through it". That said, a warning message on login would be nice. They could check the whois records on initial registration to see when the domain is due to expire, and verify that (in case it has been extended) before giving a warning. There is an easy way to detect a domain expiring that would stop accidental access to data like this by new domain owners. IIRC on signup for Google's apps you add a TXT record to the domain to prove that you control it - if a domain is expired and renewed by someone else then this TXT record will be gone. Again there is no need to check on every login, just when the domain is due to have expired. Of course this does not protect against intentional access, as the TXT record could be remembered and re-entered by the attacker if they are registering the name specifically to get access to the data on accounts like Google apps.

cwb71 15y ago

Thanks for pointing out this issue, Ben. I am curious why you did not mention whether there is an option to simply delete your Google Apps account before letting the domain expire?

hackount 15y ago

Making sure to renew your domain name is a good solution if you actually want to keep your domain. But what if you are done with that domain, and purposely let it expire? Is there a way to delete your Google Apps account entirely before letting the domain name expire, so the next person to register that domain can start from scratch with Google Apps, as if that domain had never been used before?

lmok 15y ago
There is an option in the Google Apps cpanel: "Delete Google Apps for mintcake.com". Underneath which it reads: "You can close your Google Apps account and delete all user accounts and data associated with it." It's in Domain settings > Account information.
- phillijw 15y ago
  But this is only accessible BEFORE you drop the domain, right? I just logged in to one I dropped a few months ago (before I realized this was a problem) and I was not able to access my inbox or any other settings even though I knew the password.

kwantam 15y ago

A few weeks ago I tried to register Google Apps on a domain I purchased, and found that it'd already been registered by someone else. I sent an email to the support team explaining that there was a previous account and that I was the new owner, and upon proving that the domain was now mine they deleted the old account and had me start anew. Obviously, while the email-support method is safe, the automated system for unlocking admin access based on "proof of ownership" is pretty scary! Seems like this could be solved by requiring you to prove ownership and then releasing new auth info to a linked email account on a different domain. That helps to establish both present ownership and a chain of ownership back to the last time you had authorized access and were able to adjust the "emergency email account" setting. It's not perfect, but it's a heck of a lot better. It also seems to me like someone wanting to abuse this right now could do so pretty easily: you can confirm that a domain is available and that it has had a google Apps account set up in the past before you spend a dime, so you can just set a computer to trawling known Google Apps domain names (e.g., by looking at traffic on large mailing lists) to find ones whose registration has expired.

steveh73 15y ago

You did not completely censor the last screenshot.

megamark16 15y ago

It took me about 10 minutes to write a python script that grabs a list of recently expired domains and checks each domain to see if it's a valid Google Apps domain. This is a pretty serious issue, if indeed it's still possible to take ownership of accounts as the article suggests. Hopefully Google has added some mitigating steps to keep this sort of thing from happening.

DenisM 15y ago
How do you verify if a domain has a google apps account? I actually need this for a different, legitimate purpose.
- megamark16 15y ago
  The off the cuff way I was doing it was to go to https://mail.google.com/a/DOMAIN_NAME/ https://mail.google.com/a/DOMAIN_NAME/ and see if I get a login screen or an error saying that the domain wasn't using google apps.
  - DenisM 15y ago
    I see. Some domains use SAML authentication, so it doesn't work as well for them. E.g. uw.edu
asbtlt 15y ago
tltbutik.ru
deleted 15y ago
[deleted]
asbtlt 15y ago
arbuz1.ru baka-club.ru infame.ru puzkarapuz.ru luxury-institute.ru khrip-time.ru oilgasservice.ru voxtelecom.ru skippy.ru relaxpnz.ru kupi-proektor.ru akr-komanda.ru madamfurne.ru instaforgeg.ru oblomfilm.ru cmt-mitishi.ru 2mq.ru 4low.ru obzori.ru 2v4.ru tvfreak.ru concurent-vrn.ru baztv.su de-ti.ru autokg.ru kovgok.ru briztur.ru all-rest.ru opti-pro.ru infomarker.ru smartcities.ru stroystudio.ru instrumentnn.ru ontam.su beage.ru eds63.ru klint.ru moda1.ru otwod.ru nonic.ru pl110.ru apk-vs.ru mirrpg.ru sement.ru 1078fm.ru animirk.ru bigbear.ru dudusya.ru emiflex.ru odp-spb.ru

zacharypinter 15y ago

Any idea if this applies for a domain that's an alias to your primary domain? For example, if you have foo.com as your Google Apps domain, and you have foo.us as an extra domain that was aliased but then expired, does that expose the foo.com Google Apps account?

pyre 15y ago
If Google Apps doesn't know about foo.us, then I think that answer would be no. (Though I would confirm this with someone more knowledgeable)
- pasbesoin 15y ago
  I haven't used the alias feature, myself, but I believe the grand parent post is asking about a circumstance where your Google Apps account specifically does know about and supports the second domain (as an alias).
  - zacharypinter 15y ago
    Exactly. Thanks for clarifying :)

kevinpet 15y ago

Google's problem isn't in their authentication, it's in the whole idea that having a domain name now means I should have access to the previous google apps account. They're separate entities. This is probably related to why google isn't able to move an apps account to a new domain (our real domain is just an alias to our google apps account on previous company name's domain).

giberson 15y ago

While it may add an extra step on their end process wise, it seems like the obvious solution to this matter is to simply enact a policy such that if domain ownership changes hand the associated accounts are reset unless a signed transfer of ownership and proof of identity is provided by the original owner.

jacques_chester 15y ago
Everything I've ever read about Google's customer support infrastructure is that they don't "do" person-to-person transactions. Hardcopy? You must be joking.
- giberson 15y ago
  I was simply supplying what a solution was--which has nothing to do with Google's likelihood to implement it.
- lukeschlather 15y ago
  That seems to square with my experience. Google Apps is free for nonprofits up to 3000 users, though they start you out with something like 100. I hit the "request more users" button and I was up to 500 almost instantly (though it said "we'll get back to you" after I hit the button.
jonknee 15y ago
That sounds like an awful idea. If you update your Whois information all of a sudden all your Google Apps data gets deleted? I'd be furious.
- giberson 15y ago
  I hadn't considered the case of updating whois information. However, to resolve that issue I'd simply provide a mechanism where you could flag your account as pending an authorized whois update. Then, when the whois is updated, google would not take any action since the update was pre-approved by yourself.

deleted 15y ago

[deleted]

yuhong 15y ago

"There's more, around the last 4 digits of a credit card. This is used by others as authentication when you loose your password, for example PayPal." Can you say fundamentally flawed?

a3_nm 15y ago

Notice that you will have the same kind of trouble if you're using OpenID on your own domain and let it expire... (An attacker could buy the domain name and set up a page at your OpenID URL which would delegate the OpenID to something under their control.)

larrys 15y ago

I want to point out that as a ICANN registrar not a day goes by where some tech person working on behalf of a customer will contact us and request an auth code to transfer out a domain name. Just like that. As if we will send one to anyone that asks. Later when the customer makes the request many times the domain ends up at another registrar in the name of the tech person, isp, web designer etc. who has been told they need to be able to login and make changes. The name subsequently is deleted for non-payment (customer isn't notified and invoice goes to new contact) and they loose control of their domain.