I'd like to register a .ir domain for a neat domain hack, but it seems to be quite difficult as it's Iranian. Every site I've seen requires either an Iranian National ID (which I don't have) or passport information. Is it safe to give these sites my passport information? Thanks.
This is not your father's
Libya was under the control of Muammar Khadafi, author of the Pan Am 103 bombing and many other horrors. But Libya farmed out their TLD to a western company for hard cash, so it wasn't completely reckless to have all those adverb sites ending in .ly.
Iran makes full use of
.ir internally. Your site would be a guest of the Iranian government. Your site would need to comport itself in line with Iranian government values, which as a "revolutionary" (read: nationalist, xenophobic) government founded in religion, will have a very high standard for conduct.
No free speech, corporate veil, nor Safe Harbor
So all the content you host or link to would need to conform with legal (moral) requirements of the government of Iran. Which would hobble your speech rather painfully. It would also have countless blind-sides, like so much as mention the existence of Judaism, or even promote the US military, ka-zinga!
I think you would have a great deal of difficulty retaining the domain, unless you had Iran experts curating every bit of content.
Further, Iran has no concept of DMCA "Safe Harbor". You know, the thing that lets you run a bulletin board where users generate content (UGC) and your corporation is not personally liable when a user posts a cut-and-pasted copy of a copyrighted newspaper article.
For that matter, Iran doesn't even recognize the idea that employees and officers of a corporation should be generally shielded from liability for corporate activities which didn't intentionally break the law.
So they not only get to come down on your company for a random user's pro-Israel statement, they punch through the corporate veil and come after you personally! "What'd I do!?"
The US Government would not approve
Since Trump reimposed sanctions on Iran, US actors are very limited in whether and how they can do business in Iran. This itself is a legal minefield, and you'll need experienced counsel on board to guide your every move, or you could find yourself in dutch with the US government also.
Being trapped in the middle between a very powerful and very dangerous government... man, that must be one heck of a domain hack!
Exposing your users to hacking
The most powerful cyber-warfare operations are the "state level actors". They not only have the sheer depth of resources to do whatever they need, but they also have traditional spy stuff (which hackers normally do not have): SIGINT (traditional phone etc. monitoring)) and HUMINT (ability to place spies in physical locations).
Iran was probably an also-ran player... but then, Stuxnet happened. This motivated Iran to "up their game" in a big way. They now have one of the leading nation-state hacking operations.
And you want these guys to control your TLD. Probably a big part of why Iran would even consent to this is the possibility of manipulating your TLD to their advantage.
I'd like to register a .ir domain for a neat domain hack, but it seems to be quite difficult as it's Iranian.
This is not the only problem you have to take into account. Once you get the domain of your wish, if you do, you have to remember that the domain, and its use, is still bound to Iranian laws. You may lose it, or worse, if you do not abide by those laws and all registry regulations about disputes, etc.
Imagine that the contract (which you sign during registration) stipulates that any kind of dispute on the name has to be settled only in front of a court located on Iranian soil. What will you do in case of problems? You can ignore this, but if you buy a domain to use as a hack, and build something successful on top of it, events like that can be devastating.
Which all boils down to: is your domain hack worth all the risks?
Is it safe to give these sites my passport information?
This question can not be replied to. You have to trust your registrar, the registry, and any networks in between where your personal data will transit. Sending personal data to anyone makes you potentially a future victim of identity theft.
Is this risk worth your domain hack? No one except you can know and reply to this.