I once lost my gandi.net password. It took sending copies of 2 photo id, and answering the phone listed in the who is database before they reset it.

I just wish that their DNS updates were push through faster.

Seriously. Gandi is the only registrar I use anymore.

That's not good verification. It takes a couple of minutes to produce convincing fake ID scans, and they aren't going to have anything to verify them against.

And presumably they wanted you to send those photos to them as an unencrypted email attachment, right?

As someone mentioned above, they publish a gpg key for sending this data.

As for fake IDs, yes, it is certainly possible to create them. But when it is so much easier to socially engineer your way into another service like Namecheap, it creates a disincentive for going after Gandi (and other similar hosts).

No security measures can be foolproof, possibly short of sending someone to your home to take a DNS sample, but at least they're trying for a better solution.

Other comments in this thread have indicated that Gandi will take GPG-encrypted emails have have published their public key for this purpose: https://wiki.gandi.net/en/gandi/documents

Faking ID scans adds a whole layer of law enforcement on top. I'm uncertain about the situation in the US, but in germany the fake itself is punishable by law (up 10 ten years). It also creates more traces to look at and creates work. You'd also need much more information to create a convincing fake id scan of your intended victim. It's all about increasing the amount of work for the would be attacker.

>Faking ID scans adds a whole layer of law enforcement on top.

That's why nobody has ever used a fake ID at a bar!

> but in germany the fake itself is punishable by law (up 10 ten years).

https://dejure.org/gesetze/StGB/267.html 5 years.

But producing fake scans isn't covered by this law, scans aren't even an official document. In fact, it is illegal for a german company to ask you to send them scans of official documents.

> You'd also need much more information to create a convincing fake id scan of your intended victim

To fake a good enough passport scan you'd need your victims name. That's all the rep is going to have.

That was a few years back when another well-known registrar only required the last 4 digit of the customer's credit card, and would even help them guess if they didn't remember.

I sent the ids by fax (yeah a few years back, I still had a fax machine).

I thought asking for id's + phoning on the number listed in the whois database was a good cross check, especially back then.

its better verification than most will require.

Most will require a password reset email, I'd say that's significantly better than asking for ID scans.

Edit: Since I'm getting some downvotes I'd really like to know how one could possibly argue that asking for ID scans is better than email resets. You can't really forge the ability to receive email at an address, but you can very easily replace the name on an ID scan.

Did you read the article? I ask because one of the problems was a compromised email account.

I did. It doesn't change anything, email is still a way better verification method than ID scans that the company will be unable to authenticate.

unless your email account has been compromised.

Even if the email account is compromised it's still stronger proof of identity than ID scans.

An attacker can't just pretend to be able to read your email, such ability is too easy to conclusively prove. To be able to read your email they need to hack you somehow.

But for a fake ID the attacker only needs to throw your name in a PSD and they're good to go.

Use 2FA on your Email Accounts

Use 2FA on your Namecheap account

Maintain a sensible backup policy

Store your passwords in something secure like KeePass

NearlyFreeSpeech seems pretty serious about this sort of thing: https://www.nearlyfreespeech.net/about/faq#LostEverything

Amazon Web Services is great, and as far as I experienced, their support knows more than average.

You can get AWS customer support to reset your password if you know the last 4 digits of the credit card used to pay for the account. This is the same info that's printed on any credit card receipt.

If they have your bank account number for whatever reason you can also use last 4 of the bank account number. Your bank account number is not secret by design and most people only have one.

Not only is it not secret, it's printed on every single check for that account.