discuss What is the Lifespan of Auth Code for Domain Transfer?

[oskaaay]

Hi fellow NPers,

Am here again with a mind bothering question.

Does Auth code used for authorizing domain transfer from one domain host to another have expiring date?

If yes - explain and that good

If No - explain and help with how to prevent the previous owner after you purchase the domain from using the auth code to resell the same domain to another person without your consent as the case of @Blueforever via his thread. The response he got from @namesilo here namepros.com/threads/whats-happened-to-my-domain.1164292/page-3#post-7506219

 

[oskaaay]

looking forward to other domainers contribution. thanks

 

[biggie]

Hi

feed yourself:

https://www.google.com/search?sourc...hUKEwim07n6movmAhUOR6wKHU7fB3cQ4dUDCAc&uact=5


imo...

 

[oskaaay]

Hi

feed yourself:

https://www.google.com/search?source=hp&ei=1NneXaaZDY6OsQXOvp-4Bw&q="domain+name+transfer+auth+code+expiration+time&oq="domain+name+transfer+auth+code+expiration+time&gs_l=psy-ab.3..33i299.1023.48752..49039...31.0..7.536.15583.0j60j11j5j3j1......0....1..gws-wiz.......0j0i131j0i131i70i251j0i22i30j33i160j33i22i29i30.3Qfecfj6txE&ved=0ahUKEwim07n6movmAhUOR6wKHU7fB3cQ4dUDCAc&uact=5


imo...

checking...thanks

 

[TLDNIC]

I remember that at least one registrar displayed an auth code expiration time of 30 days when I requested the code. I ended up waiting two or three more months before I actually transferred it out, so I requested a new one just in case: They sent me the exact same code again. Can't tell if my request refreshed the code though or if it never expired.

 

[oskaaay]

I remember that at least one registrar displayed an auth code expiration time of 30 days when I requested the code. I ended up waiting two or three more months before I actually transferred it out, so I requested a new one just in case: They sent me the exact same code again. Can't tell if my request refreshed the code though or if it never expired.

Thats what am also curious about. If it does not expire or it is just a single code for a lifetime of the domain, won't that be creating a loophole for the previous owner of a domain with Auth code to retake over the domain after the sale.

 

[ultradog]

Thats what am also curious about. If it does not expire or it is just a single code for a lifetime of the domain, won't that be creating a loophole for the previous owner of a domain with Auth code to retake over the domain after the sale.

The link biggie gave doesn't seem to answer this question about the lifetime of epp codes, or if it did I didn't see it.
Yes, it would definitely be a security problem if the registrar doesn't expire epp codes after a period of time, and the major registrars seem to give them a lifetime of a few days, up to a week (or two?). I've never dealt with a registrar that left the same codes for too long.

The oddest thing I ever encountered was Encirca, which allows you to create your own code for your domain if you're transferring out.

 

[oskaaay]

The link biggie gave doesn't seem to answer this question about the lifetime of epp codes, or if it did I didn't see it.
Yes, it would definitely be a security problem if the registrar doesn't expire epp codes after a period of time, and the major registrars seem to give them a lifetime of a few days, up to a week (or two?). I've never dealt with a registrar that left the same codes for too long.

The oddest thing I ever encountered was Encirca, which allows you to create your own code for your domain if you're transferring out.

Thanks, you got my point of view.
@TLDNIC said he was still able to use the same auth code to complete the domain transfer after 2-3months even though the domain host claimed it expires in 1 month.
That is a mind-bothering loophole.

 

[TLDNIC]

Once used an EPP code won't become active again for the same domain. I have transferred some of my domains multiple times and they received different codes each time.

So, the only security concern I'd see here is if a deal falls through after the EPP code has been shared with another party. But even in this case the owner could still transfer the domain to another registrar to void the code.