Normally people can pay to extend their domain registration.

No, usually you can renew a domain for anyone without authentication

Hah, reminds me of an old Married with Children episode where Al Bundy is going to the cable provider's customer service office to buy access to a Pay-Per-View event, and, after going through a lot of hassle, is asked for his ID, which he doesn't have on him.

I don't remember exactly what happened after, but my immediate reaction was, "lol what? Why do they care about whether this is really Al? At worst, it just means some random benefactor is paying their own money so Al gets to see the PPV."

(IIRC he was paying cash too so there wasn't even an issue of CC fraud.)

One distinction being that the owner of a domain holds some liability for what happens on that domain, a risk that no one should be required to take on just because other people don’t want some service disrupted.

On top of this, being physically in prison isn't some sort of show stopper. The owner should be able to execute a limited power of attorney that gives someone (likely, their attorney) the power to stand in for them and renew the domain name. If Godaddy still wants to reject the POA, then they can find another registrar that will respect it and transfer the domain name out.

uh. what?

I'm not sure about Godaddy, but on Gandi you can definitely pay to extend someone else's domain name.

https://docs.gandi.net/en/domain_names/renew/how_to_renew.ht...

That's wild. I had had no idea.

Happened to microsoft: https://slashdot.org/story/99/12/25/114201/microsoft-hotmail...

Thats not the same thing. The domain lapsed and someone else bought it, which is exactly what is going to happen to eth.link according to this post.

From the horses mouth:

> I read through the discussion area for that story and found that the problem had been tracked down to an outstanding invoice for passport.com at Network Solutions, the domain name registrar.

> I own a number of domains myself, including doublewide.net, so I'm no stranger to the payment system at Network Solutions. I went to the payment page at https://payments.networksolutions.com and typed in "passport.com", after which I was greeted with a page showing the outstanding invoice for $35. One of the buttons near the bottom of the page was "Make payment", so I pressed it.

https://web.archive.org/web/20031002153020/http://www.double...

Ha, what a great story; thanks for sharing.

> On Tuesday, December 28 I heard from Microsoft. I was happy to hear that the payment did fix Passport, and of course they wanted to reimburse me, and thank me.

With companies so lawyer-ed up, I wonder if that would be the case today. I'd be very hesitant before hitting submit in that payment page.

Too late to edit, thats a wild story, thanks for sharing it!

I mean, most banks don't require ID to make a deposit. It's not an unrealistic thought that someone should be able to top up some dude's account so that his stuff can autorenew. Though a company would need some sort of explicit policy for that more than likely.

> I mean, most banks don't require ID to make a deposit.

Due to money laundering regulations, that isn't really true anymore. Most banks straight up won't take cash deposits into someone else's account, identification or not. Other means (ACH, etc.) require KYC from the originating institution. I'm not sure about secure funds like a money order, but I'm guessing they'd be subject to some sort of verification as well.

At my bank, if you fill out a deposit bag with the account number and put in cash, you can drop it in the deposit slot and it shows up in the account. There is no verification that you own the account, beyond knowledge of the account number.

Sure, if the original contract had a clause that said “anyone can come add money to this and if they do, go ahead and extend it under my name” then this would be entirely reasonable. It seems that clause doesn’t exist here or at least GoDaddy isn’t required to exercise it.

This hasn't been true in the UK for at least a few years now

I’ve done it for other people multiple times. Not sure about godaddy though.

It's not the case with GoDaddy. I just had a hosting client run into this a few weeks ago -- someone they know had registered their domain for them long ago, and they didn't have the GoDaddy login. I tried to help out when their domain expired and spoke to GoDaddy support. They do not provide any way to renew domain without logging into the account that owns the domain. They were fortunately able to get in touch with the person who originally registered it, so that person could renew it and work on transferring it to an account controlled by the true "domain owner".

I personally don't see a security issue with allowing anyone to renew any domain. It's not like you can change WHOIS information or the authoritative name servers -- you're just paying to continue with the existing ownership/configuration.