Moniker Users: Email Re: Security Changes

[Dave_Z]

I got an email from Moniker that they're putting in some security changes. No
idea of the exact date when all of them will take effect, but one of them did
say we'll "be prompted to select and provide answers to two secret questions"
starting November 12.

However, one of the changes requires you to practically change your account
password every 3 months. Personally I don't mind, but I'd imagine others can
find this...inconvenient.

Contact your account manager about this and let them know your thoughts if
you feel this is important.

Mods, kindly merge this with any other thread about Moniker's email, if any. Thanks.

 

[jido]

Contents of the mail-------------
------------------------------------

Dear Valued Client:

Moniker is well known for it’s reputation as one of the most secure registrars in the industry. To continue providing you with the utmost in protection for your valuable domain assets, Moniker will be instituting new policies with regard to account passwords and overall account protection. Please note the following changes:



* Excessive attempts to enter a password will freeze account logins – Starting in the next few weeks, Moniker will limit the number of times a password can be attempted. If the correct password is not entered within a specific number of attempts, the Moniker system will lock down the account and reject any future attempts to log in. To avoid this situation, be sure to use the “forgot password” link if you are unsure of your secret code.



* Secret questions added for additional security – For account logins starting after Monday, November 12, 2007 you will be prompted to select and provide answers to two secret questions. In the future, you will need to answer both questions to be issued an automated password reminder. These questions may also be used to confirm certain other activities for your account, or to verify requests that are unusual based on your account history.



* Passwords will now expire – Moniker will begin rolling out a new policy on password maintenance. In order to protect your domains, account passwords will need to be renewed every few months. When it is time to change your password, you will be automatically prompted to do so upon your next account log in. No other special action will be required for this. This new policy will be rolled out over the next few weeks. Moniker will alert all active accounts when the corresponding password is about to expire.



* New password retrieval procedure – If you have forgotten your password, you will now have an easy, more secure way to retrieve it. Simply follow the link for “Forgot your password?” Upon submitting your account number or username you will receive via email a “password reset” link. You will need to answer your two secret questions (see above). If you do not have your security questions setup, you will have to contact our customer service department to make special arrangements, as we will no longer email passwords back to you.

Help us protect you

In today’s world of charlatans, con artists and fraud, we all have to be more careful in order to preserve the convenience of online account management. As a result, it’s extremely critical that you keep your Moniker account information up to date and accurate, especially your e-mail address. Remember that ICANN policy requires that all account information be maintained accurately by the registrant. By using Moniker Privacy Services, you can still protect yourself from unwanted spam, solicitations and exposure of your personal information. Please log in to your Moniker Account now to update any new information or sign up for Privacy Services.

Coming Soon: Moniker’s Executive Lock

Moniker is also working on a new product that will allow you to opt in to ADDITIONAL security features to protect your domain assets. This additional layer of security will block certain transaction unless a specific pass code on record is provided to Moniker in addition to personal files housed here at Moniker with critical information such as secret passwords, in case of disability or death instructions, partnership rights, etc, . More information will be available soon about this increased peace of mind.

True Domain Asset Management starts with security

Moniker’s central mission is to help you protect and grow the value of your Domain Assets. Whether you’re a domain investor, web developer or are responsible for driving online sales or branding for your company, we understand that your domains are the cornerstone of your business. Moniker is pleased to be able to provide you with these superior security features, but top notch security is only the start. We’ll continue to work at providing you with value-added services you’ve come to expect from Moniker, so you can do more with your business and succeed.

Sincerely,

Moniker Online Services

Monte Cahn

CEO and Founder

Moniker Online Services, LLC

 

[dnk]

If you do not have your security questions setup, you will have to contact our customer service department to make special arrangements, as we will no longer email passwords back to you.

Any idea what the "special arrangements" are ?

 

[Cronus]

In order to protect your domains, account passwords will need to be renewed every few months. When it is time to change your password, you will be automatically prompted to do so upon your next account log in.

I hope they reconsider this one, and I emailed my rep about it. It isn't a big deal, but is a nuisance. None of my banks require these frequent password changes, nor do any of the dozens of other registrars I use. I'm sure many of us here have dozens of registrar accounts. Imagine if they all did this!

Also, this could combine in a bad way with Moniker's new policy of locking out accounts after too many login attempts. People may forget their latest password or type their old one in and end up locked out of their account. Then they have to contact Moniker support, which is already overburdened and often unresponsive even without all the new support requests these policies will bring.

I'm surprised they aren't also instituting a policy that passwords have to be at least 10 characters long and contain at least two punctuation marks and a mix of upper/lower case. That usually goes hand-in-hand with the frequent-forced-changes policy. Both are well known to lead to passwords on sticky notes attached to monitors or under keyboards.

 

[goodkarmaco]

Cronus,
very good points.

I am sure though some accounts are being comprimised and passwords are one area they get attacked from.

 

[sashas]

I personally find it hard to come up with passwords that are hard, but still easy to remember
and Cronus has a very valid point...I recently changed the password to all my accounts, but I still typed in my old password for my godaddy account about 5 times before realizing that I'd changed the password...this could definitely lead to account lock ups

 

[Silhouette]

hope it just accepts a password used before.
Or else, many will run out of passwords, then forget their passwords too often.

 

[Brad|E]

I personally find it hard to come up with passwords that are hard, but still easy to remember
and Cronus has a very valid point...I recently changed the password to all my accounts, but I still typed in my old password for my godaddy account about 5 times before realizing that I'd changed the password...this could definitely lead to account lock ups

I would highly recommend spending the $30 or so dollars for a program such as RoboForm (password manager and form filler). Allows you to assign a unique password to every account, without having to remember each one, and includes a password generator. Just make sure you keep a hardcopy of all the info somewhere.

 

[Silhouette]

Just make sure you keep a hardcopy of all the info somewhere.

I beg to differ.
Everything in clear, this is extremely dangerous

Like me, I use a notebook (NOT the computer laptop), write down username and password that only you know how to UNcode it. (just remember your coding technique that applies throughout)

just mho
peace

 

[ssamriga]

at work I have to change password every 3 months, so nothing new to me

though I also think they could make that period of maybe 6 months?

 

[sky]

Moniker is my new hero

I'm glad they're taking this seriously. They're doing the right thing, absolutely. If fact, now they're doing it better than most of the other places.

OK, it's a little inconvenient, but if you were ever one of those people who found your portfolio hacked and prime names stolen you'd be furious with Moniker for NOT taking such actions.

My company enforces a password change policy too. It's a little inconvenient, but you get used to it. You just need to keep your password in a safe place, that's all. If you're not doing it already, then this should help push you into getting organized, cogent and responsible about it.

 

[mhdoc]

It's a little inconvenient, but you get used to it. You just need to keep your password in a safe place, that's all.

I manage 300 or so websites each of which has an account password, an email password, and frequently a database password. I have a system to make all of them unique without having to write them down. When Moniker forces me out of my system it's a lot more than "a little inconvenient"

 

[MyNet-Tony]

I agree, it should be an option, not standard. I don't like it.

 

[Gerrit]

Changing the passwords every now and then is not really making things easier, still I am glad to see Moniker is really taking security seriously. They are still the only registrar going really far in terms of security, they for example manually verify every domain transfer to prevent theft. So in general I am happy to see Moniker is taking domain security seriously, and the majority of their new rules please me.

Of course the most secure would be that for every outgoing transfer you need to sign a contract and send it to the registrar by fax. If any registrar would use this system, I'd be a customer straight away because I believe this is the safest way of dealing with domains.

 

[fonzie_007]

Personally I don't mind, but I'd imagine others can
find this...inconvenient.

You put it kindly. Personally, I think it is a PITA. They haven't lost a domain yet, so their system for the past decade must have been doing something right. I see these changes as unnecessary and an added burden.