- Impact
- 1,964
I've been thinking about steps to take to prevent domain theft and thought it might be worthwhile to start a thread where we can share ideas on how to best secure our domain assets. I'll start the ball rolling with some ideas of my own ( some of them might be overly paranoid ) and hopefully others can add to the discussion.
1. The email address in your whois info should be different from the administrative email address you use for your registrar. Hackers will sometimes try to get into your email account so that they can then unlock your registrar account by going the "forgot password" route and intercepting the reset password email. If a hacker doesn't know what email address you use for your account, that makes their job that much more difficult. Domain privacy can add an additional layer of security here since your whois information won't provide any clues about who you are and what email addresses you tend to use.
2. The email account you use for your registrar should be an address you don't use for any other purpose. This will prevent hackers from being able to research you and deducing your administrative email address based on publicly available information.
3. Use 2 factor authentication for both your registrar account and your email account.
4. Use strong passwords for your email and registrar accounts and don't use the same password for both.
5. Don't use an easy to guess username for your accounts ( eg firstname/lastname or company name are a bad idea ).
6. Keep your computer secure and free of malware. If a hacker gains access to your computer, they can potentially gain access to your accounts. I've personally switched over to Linux since protecting a Windows based machine seems like a never ending battle.
7. Pay extra attention when receiving emails that seem to be coming from your registrar and that have you clicking links. If the link takes you to a page that requests your username and password, it's most likely a hacker site.
Any other suggestions?
1. The email address in your whois info should be different from the administrative email address you use for your registrar. Hackers will sometimes try to get into your email account so that they can then unlock your registrar account by going the "forgot password" route and intercepting the reset password email. If a hacker doesn't know what email address you use for your account, that makes their job that much more difficult. Domain privacy can add an additional layer of security here since your whois information won't provide any clues about who you are and what email addresses you tend to use.
2. The email account you use for your registrar should be an address you don't use for any other purpose. This will prevent hackers from being able to research you and deducing your administrative email address based on publicly available information.
3. Use 2 factor authentication for both your registrar account and your email account.
4. Use strong passwords for your email and registrar accounts and don't use the same password for both.
5. Don't use an easy to guess username for your accounts ( eg firstname/lastname or company name are a bad idea ).
6. Keep your computer secure and free of malware. If a hacker gains access to your computer, they can potentially gain access to your accounts. I've personally switched over to Linux since protecting a Windows based machine seems like a never ending battle.
7. Pay extra attention when receiving emails that seem to be coming from your registrar and that have you clicking links. If the link takes you to a page that requests your username and password, it's most likely a hacker site.
Any other suggestions?