I’ve recently registered a .eu domain name.

EURid registry has a portal where you can generate a transfer code, thus not fully relying on access to registrar (as well as check and verify your info).

Welp, security.

The only security is a code sent to e-mail associated with the domain. While the portal requires entering this address to log in, it can also be pulled from WHOIS where it is mandatorily published.
Regardless, e-mail (as a string) should not be affecting security.

The code, as I mentioned, is just lowercase letters and numbers. Precisely 6 of them. This is valid for 2 hours and one use.
While there is a “Request new code” button, I wasn’t able to generate multiple codes for one 2 hour window, so that’s good.

But now we get to rate-limiting. After 9 attempts, I get:

You have exceeded the allowed number of requests.
Please try again in 10 minutes.

Sounds good, BUT, clearing cookies bypasses this.
I have not (yet) tried any automation, I just quickly manually repeated this tomfoolery from same IP 3 times without actually being rate-limited.

I find this… at least strange. Especially since everyone is doing at least 2FA, while some sites even support physical security keys, and then there’s “we email you 6 characters”.

  • Potato Lover 💾 No brain foundOPEnglish
    2·
    11 days ago

    Sorry if I wrote something in a confusing way.

    This is concerning My .eu portal, which is a completely separate portal of the registry, that also allows generating tranfer codes without involving the current registrar (as well as showing all private info).

    This is the login page: https://my.eurid.eu/en/auth/login/?next=%2Fen%2F
    The only needed information is e-mail address associated with the domain and the domain name. While both are needed, and the domain name alone is not enough, the e-mail address is available in the WHOIS information.

    When the Registrant is a natural person the Registry publishes the Registrant´s e-mail address and language.

    Source [PDF]

    This mean anyone, at any time, can generate authorization code, and attempt to use it at the My .eu portal.

    Based on EURid’s info, entering the portal is enough to get access to the transfer code.

    From the My .eu platform: You can also issue the transfer authorization code yourself on the My.eu account. Please do not confuse the access code you will receive by email (which will enable you to enter the My .eu platform) with the transfer authorization code (which you will issue once you are on the platform).

    • sylver_dragon@lemmy.worldEnglish
      1·
      11 days ago

      Sorry if I wrote something in a confusing way.

      Nope, I just failed at reading comprehension today. This does seem like a bad oversight on their part. That a transfer code can be created by anyone other than the current owner is just bad from the start.