Verifying domain name ownership

I got a nice shout-out on TechCrunch today for discovering an issue with the new Kindle Publisher program.  The vulnerability allowed anyone to claim a blog as their own and take advantage of the 30% rev-share that Amazon offers on their $1.99 subscription fee.  Erick Schonfeld did a nice job covering the issue and explaining the implications of the hack.  You can read about it on the TechCrunch article.

The interesting thing about this vulnerability is that there are already accepted methods in place for verifying that someone owns a domain name.  I understand that Amazon may have wanted to remove the friction from getting people started, but this stuff matters too much to get wrong — especially when there is a large audience and money to be gained.

For those who are interested in the best way to do domain name ownership (ahem, Amazon) Google would be a great role model for you to follow.  There is a nice explanation on how Google’s domain verification process works on their help pages:

To verify that you own a site, you can either add a meta tag to your home page (proving that you have access to the source files), or upload an HTML file with the name you specify to your server (proving that you have access to the server).

Each verification method has its advantages. Verifying using a meta tag is ideal if you aren’t able to upload a file to your server. If you have direct access to your server, you may find it easier and faster to upload an HTML file.

Amazon would do well to follow Google’s lead.

  • Sam

    I saw this on TechCrunch and I was quite surprised Amazon had no ownership verification. I would think verification would be one of the first things you do in a situation like this.

    Google has definitely set a good example.

    • Josh Fraser

      It wouldn't be an issue if they weren't charging for otherwise free content in the first place. :)

      • Justin

        Amen to that. You rock, Josh!

  • Anonymous

    How do you verify ownership for blogs hosted on eblogger/livejournal/wordpress etc? I don’t think this is a simple domain verification.

  • Jon

    Well, in their defense, I think at least part of the idea is to cover the cost of the data transmission (since you don't pay a service fee for the wireless connection in the Kindles). That being said though, I think they should either build that in to the cost of the device or move to a monthly "all-you-can-eat" subscription. Just charge me $10 / month (or whatever) to download all the normally free content I want. At least that model I could get my head around and I might consider reading blogs on my Kindle.

  • KrisBelucci

    Great post! Just wanted to let you know you have a new subscriber- me!

  • Dennis Yu

    You got a PageRank 5 link from TechCrunch– good job!

  • Ahmad Saadillah