Related: "Back to Basics: Encryption – Past and Future"
In light of Target's recent credit card fiasco, imagine if the company decided to revamp internal security policies and provide victims with credit monitoring. But let's say that in order to finance these improvements, Target goes ahead and charges each of the 50 million affected customers on record a $99 fee per year to defray these new costs. The outrage would be palpable. Strangely enough, Network Solutions is trying something very similar -- only their 'security' program automatically enrolls a subset of their customers into a fee of $1, 850 for the first year of service, with 'only' $1,350 being billed to the customer every year thereafter.
Network Solutions' Approach to Gouging Customers
According to Network Solutions, the program in question is designed for customers with high-visibility sites, which is roughly one percent of Network Solutions' customers. To try and get a sense of how many people would be affected by this, I tried finding some numbers on how many customers Network Solutions has. The best I came up with was a mention on Wikipedia that Network Solutions servers were hacked in August 2009 and the credit cards, names, and addresses of 573,928 customers were stolen. According to Wikipedia, Network Solutions still has no idea how their servers were breached.
Assuming that's a rough estimate of how many customers Network Solutions had at that point in time, then this program should impact roughly 5,000 people. Crunching the numbers, this means that Network Solutions is looking to take in roughly $9.2 million, assuming no one balks, explicitly calls to opt-out, or doesn't pack up and leave after being treated so poorly.
Here's the rub, though. First, anyone with a brain can see that offering such a protection policy is potentially a decent option -- but forcing customers to be auto-enrolled into this program seems not only abusive and ridiculous, but also makes Network Solutions look scummy and greedy.
Second, what happens if one of Network Solutions' customers with a 'high-traffic' domain opts out of this service and their domain is stolen right out from under them when registered with Network Solutions? Does Network Solutions just wash their hands of the whole ordeal and tells the customer that they really should have paid for these additional protections? If so, where do we draw the line between additional protection and racketeering?
Related: "OWASP Top 10 Project: Security Vulnerabilities for ASP.NET"
What I find most shocking about this whole affair, though, is that it represents such a colossal failure of Network Solutions' principal offering. In other words, there are really only two things you need from a domain registrar. First, you need them to point your registered domain towards the name-servers you've designated for DNS resolution. This is such an important facet of registration, as most registrars offer DNS management as a part of the price you pay to register with them. Second, you need your registrar to protect your domain name or stop it from being sold, stolen, or weaseled out from under you. Yet, Network Solutions is, in this case, admitting that their existing infrastructure really isn't good enough for high-profile domain names. But rather than stepping up to the plate to fix the flaws in their product, they've concocted a way to foist that cost off onto customers.
A Litany of Abuses
If this were an isolated problem or the first time something controversial occurred with Network Solutions, then it might be possible to cut them some slack. Then again, it's hard to think of any circumstance in which a $1,850 auto-enrollment program makes sense. Especially when followed up with a $1,350 per year fee. But, sadly, it's not.
For starters, Network Solutions' draconian policies for domain name transfers are simply so bad that they are literally borderline criminal. The few times I've helped people or organizations with this, the process involved a phone call to Network Solutions with wait times of about 20 to 30 minutes, and then a full three-day waiting period before details were sent by email. Wikipedia also confirms that this is still Network Solutions' official policy for transfers.
On top of this and to add insult to injury, Network Solutions' prices are easily some of the most expensive choices on the market. Although Network Solutions frequently runs 'specials' that would try to make it seem that they sell domain names for as little as $4.95, the fine print ensures that such prices only last for a single year, and then the normal annual rate (that's usually not mentioned on the site) of $37.99 kicks in, according to Wikipedia. In other words, it's not like Network Solutions is charging bargain basement prices and has no capital to work on bolstering the security of their product.
More importantly, Network Solutions has a long list of scandals and abuses that they've engaged in throughout the years, many of which are documented on Wikipedia. One of the more brazen practices was domain front-running, where Network Solutions used their knowledge of different domain names users were searching for to pre-emptively 'reserve' those domains for a short period of time to both prevent users from registering those domain names with other registrars and by which they could also jack' up the registration fees by more than 300 percent. Amazingly enough, though, that description only scratches the surface of how evil' this practice truly was. For another, equally brazen, practice engaged in by Network Solutions, check out Wikipedia's overview of how the company uses unassigned subdomains from its customers to host advertising, despite ownership of the top-level domain by its customers.
Save Yourself the Hassle of Working with Network Solutions
I really debated writing something so negative and disparaging. I even slept on it. But the reality is that Network Solutions is actually one of the first organizations that many non-technical people will work with as they start working on a new business idea, website, or startup and as they need to register and set up a website as part of their business or startup. If Network Solutions is abusing people on their first foray into interaction with the tech community at large, then that's doing everyone in our profession a complete disservice. Although it's bad form to go off in a tirade against any organization, I feel somewhat vindicated in doing so when the company in question has behaved like, well, Network Solutions.
