Could you imagine doing this today? You'd probably get lawyers making you sign agreements saying your payment of the domain renewal is not a ownership interest in the domain and threatening to take you to court for renewing their domain.

According to the story, it took somewhere between 13 and 19 hours for passport.com to resolve properly after he renewed it for Microsoft. Is that normally how long it takes to reactivate a domain name that has gone into a renewal grace period, or was something different back then?

Perhaps the NXDOMAIN response was cached by ISPs for an especially long time because it was such a frequently visited hostname?

Try to go passport.com nowadays. It redirects you to Bing and search "passport" as result. Handy.

> in addition to a new copy of Visual Studio 6.0 (which I need to compile and run the decss program to decode my DVD's so that I can play them under Linux)

Why would you need VS6 to compile a program for Linux?

I'm confused, how did he pay for someone else's domain? Was there no authentication?

perhaps the most surprising to me is the apparent willingness to enter credit card info online in 1999. I wasn't around for this period but wasn't the conventional wisdom back then that this was insecure? hence PayPal?

It’s always nice to hear about people doing the right thing. Thanks for sharing the story.

Biggest anachronism is his mailing (maybe home) address and phone number at the bottom.

Great move, kudos to Micheal!

This happened in 1999/2000, maybe someone could add (2000) to the title?

> even today I see no reason why renewal should have to be gated behind login walls.

This actually reminds me on a somewhat interesting social engineering "vulnerability" a little while back[0].

1. The hacker would call into Amazon and say that the website was acting up and they needed to add a card to the victim's account. It wouldn't take much effort because why would it?

2. The hacker'd call right back and say that "their" email had been compromised and they needed to change it/add a new one and reset the password. You supply the card you just gave (and name/billing address, but those aren't too hard to find)

3. Use that to hop on to the account and grab the last 4 digits of the victim's real card.

You now have the victim's billing address and last 4 of a credit card. A surprising amount of authentication power.

I think the lesson here is if it can be privileged information, it is. Even if it's privileged for someone else.

[0]: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking...

yup, i use gandi for that reason. they support payment from anyone. it's especially convenient for volunteer community sites. we don't depend on the person who registered the domain and forgot to give access to others.

In the UK, student loan payments can be made online without authentication: if you know the right details, it just works. Which was convenient for me, because I have never managed to log into my account.

There are other registrars that support paying for an arbitrary domain without having ownership.

The general wisdom was (as it still is) that you couldn't trust that anyone with a credit card form on their website would honor your trust. In this case the recipient wasn't just anyone with a credit card form on their website, but Network Solutions.

No, not at all?

SSL had been around for 6 years already, credit card transactions were quite common, especially with known, reputable hosts (Network Solutions can be safely be assumed to have qualified at the time)

In 1999 Amazon (for example) was already 5 years old and plenty of people were using credit cards online.

People who used mail orders before the internet might remember that the options included sending a cheque along with the order form or filling in your credit card details on the order form (that's a paper form that you send in the post), and I think that this is still the case. So I don't think that average people really saw sending card details online any differently. I even remember being asked for my card details by email!

Memory's hazy (it might have been a year or two before 1999) but I remember in the UK buying a domain from Network Solutions with a credit card but then I had to fax a signed document to their US office to actually authenticate ownership. This wasn't an automated anti-fraud thing like you might see today, it was just standard procedure for on-line orders (or at least non-US ones).

But, yeah, paying on-line with credit cards was absolutely a thing in 1999.

Back then, I remember Internic let you register a domain and you had 30 days to pay up, because people would commonly put a cheque in the post ("mail a check.")

Average non-technical people used well-known companies, but that included eBay and Amazon.

Presumably Network Solutions was trusted by this customer of theirs.

Well we had https ("check for the lock icon") back then, you could pay for plenty of things with credit cards online. Of course there was some fear of it among the general public. PayPal by no means invented online payments they just popularised it.

It was fairly common. Paypal was around in 1999 (only just). More remarkably it was common to mail a personal check or money order for things on ebay and for the most part, it worked.

I regularly made normal payments for normal products such as movies and nothing. It generally was considered safe.