Namecheap live chat social engineering leads to loss of 2 VPS
1–10 of 426 posts
Re: Namecheap live chat social engineering leads to loss of 2 VPS
#2The most significant security problem with Namecheap is really this: It only takes a 4 digit PIN to perform any action on an account through live chat (which seems to be outsorced to Eastern Europe), even if the account is protected with a 2FA... All you need is the PIN, and an attacker can do anything to the account.
Sometimes you get what you pay for.
Re: Namecheap live chat social engineering leads to loss of 2 VPS
#3I guess you can't blame them too much, they are a domain seller after all.
Re: Namecheap live chat social engineering leads to loss of 2 VPS
#4Is password recovery a bug or a feature? cloud providers seem on the fence about this. AWS has certainly had similar problems in the past.
Re: Namecheap live chat social engineering leads to loss of 2 VPS
#5That's bad, really bad. No 2auth can save you from humans who do support.
I also had one of my VPS attacked recently, and I feel for you.
But the name namecheap says "cheap". Maybe they are indeed cheap? I'm not sure the same would have happened with say HE. You pay, but you know what you pay for and get in return.
Personally, I am thinking about moving from a "manually setup" distribution to a "no ssh but deploy", so as to ease reimaging in the future. This way, if a server is compromised, all I have to do it to start the install of a new one.
Any suggestion for tools to do that with Debian distro? (yeah I could write a shell script, but I think there must be better tools out there)
Re: Namecheap live chat social engineering leads to loss of 2 VPS
#6The most significant security problem with Namecheap is really this: It only takes a 4 digit PIN to perform any action on an account through live chat (which seems to be outsorced to Eastern Europe), even if the account is protected with a 2FA... All you need is the PIN, and an attacker can do anything to the account. Sometimes you get what you pay for.
If I wanted more security on my account, is there a different service I should be using?
Re: Namecheap live chat social engineering leads to loss of 2 VPS
#7On another note, there 2FA seems to broken as well. I once received a text about resetting my Instagram account from the same number that they send me to authenticate my login session. I've never had an Instagram account.
Re: Namecheap live chat social engineering leads to loss of 2 VPS
#8The most significant security problem with Namecheap is really this: It only takes a 4 digit PIN to perform any action on an account through live chat (which seems to be outsorced to Eastern Europe), even if the account is protected with a 2FA... All you need is the PIN, and an attacker can do anything to the account. Sometimes you get what you pay for.
If I wanted more security on my account, is there a different service I should be using?
Amazon Web Services is great, and as far as I experienced, their support knows more than average.
Re: Namecheap live chat social engineering leads to loss of 2 VPS
#9Does Namecheap claim to take backups? Even if they do you should be taking backups as well if you care about your data.
I do agree with more login forms needing to support 2FA. At this point I wish almost everything did. It is a bit more hassle but is easy to manage for me at least.
Re: Namecheap live chat social engineering leads to loss of 2 VPS
#10Is password recovery a bug or a feature? cloud providers seem on the fence about this. AWS has certainly had similar problems in the past.
It depends on how its implemented.
If it's "Whats your mother's maiden name?" and they let you reset it in the browser, it's a bug.
But if they send you an email (in my case to Gmail, that has 2FA turned on), then it is a feature, because then you'd be required to either 1) intercept the recovery email (and get the password reset URL) or 2) know the format of the password reset URL and just happen to guess mine after brute-forcing every possible link (assuming there is no timeout for the URL or anything else like that).