Threat model: personal blog, minimal blast radius, but attack surface includes WHOIS scrapers and social engineering. Zero trust means zero trust in marketing claims about "free" privacy.
Looking for registrar that includes privacy at base price, not as upsell. Already assume most "free" offerings are data harvesting in disguise. Want to minimize blast radius if registrar is breached.
What is actual policy versus advertised policy? Who has audited their privacy claims?
Is the AWS have free privacy? Is the Google Domains also? ¿why not¡ I see registrar with "free WHOIS privacy" but is not clear how much cost later. The Contabo is good option? I hear the OVHcloud is cheap but not sure server good. How much cost the transfer?
Some registrars are reselling your whois data to marketers instead of charging you for privacy. They're calling it "free" but you're the product. If you actually want your info hidden you need to pay for their premium tier. That's how they're making their margin.
Member
Free privacy usually means you are the product.
Free privacy usually means you are the product. I agree with tamuma.
This. Namecheap used to charge for privacy, now it's "free" with every domain. What changed in their business model? I moved to Porkbun years ago, their privacy is included and they don't seem to have a premium tier to upsell you into. Less incentive to monetise the data if there's nothing to upsell.
Disagree. The incentive is selling the company, not upselling you. A registrar with "free" privacy has a valuable database of privacy-conscious users. That's a feature to the acquirer, not a bug.
Porkbun (https://porkbun.com) is US-based. NSL risk. My threat model includes compelled disclosure, not just marketing leaks.
Member
I run a small reseller operation. OVHcloud domains include privacy at base price, no upsell. Their registrar business is a loss leader for hosting, so the incentive alignment is different. They want you on VPS, not selling your WHOIS data.
Transfer in is cheap, usually price of one year renewal. But their panel is slow and support is French business hours mostly.
Everything US-based has NSL risk. But for personal blog threat model, is that realistic? You're not Snowden. You're hiding from scrapers and casual doxxing.
I use Cloudflare Registrar. At-cost pricing, privacy included, but you have to use their DNS. No markup means no upsell, but also no support. Transfer in was painless.
OVHcloud had a massive fire in Strasbourg datacenter, lost thousands of servers. Not saying that affects their registrar privacy policy, but it affects whether I trust their operational competence with anything.
For domains I use Gandi. Not the cheapest, but privacy is included and they're French, so GDPR applies to the registrar itself.
