Agreed, but none of that risks data tampering or attacks affecting the operator, only the data consumer *choosing* to use the old way are at risk, and they can remedy it whenever they want. They can be grownups and make their own choices as long as the blast radius is just themselves. On Tue, Sep 1, 2026 at 5:10 AM Job Snijders via NANOG <nanog@lists.nanog.org> wrote:
On Sat, Aug 15, 2026 at 09:59:54AM -0400, Patrick Klos wrote:
Don't tell me that the text based WHOIS service creates a greater "threat landscape" or "attack vector". Text based WHOIS has been around for decades - by now, I'm sure it's quite hardened!
On Sun, Aug 16, 2026 at 12:59:31AM +0100, Lavender-Jamie via ARIN-consult wrote:
What excessive attack surface is there to operating whois? Yes, it is an additional service, but whois, in some form, has been around since forever and I am most certain that after so many years, there are well hardened whois servers available.
The threat is in the use of the protocol. Port 43 Whois query/response transactions are susceptible to man-in-the-middle attacks due to the unauthenticated and unencrypted nature of the WHOIS protocol.
"Hardening" the Whois server does nothing to mitigate the risk of data interception or undetected tampering: there is no transport security in port 43 Whois. WHOIS-based services simply lack mechanisms for integrity and confidentiality.
The above means that entities using port 43 are at significant risk if they are making any kind of business decisions based on the WHOIS data retrieved via an insecure channel.
Kind regards,
Job
ps. ARIN discontinued unsafe protocols before https://www.arin.net/announcements/20250204/ _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/7APKQ2PO...