Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Namecheap live chat social engineering leads to loss of 2 VPS

postphp.com

Post reply on HN
Print view View original

271–280 of 426 posts

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#271

Post by ryanlol »

scrollaway wrote: post #38
ryanlol wrote: post #26

Earlier quoted context omitted.

They're cool until they start holding your domains hostage and demanding that you email them a scan of your passport.

Without context, anybody could say the same thing about anything. Care to share more? I personally haven't had this happen to me. I've hosted dozens of domains with gandi, under a variety of different TLDs, and can only recommend them. Cons: Slow website. Bad UX all over the admin/purchasing interface. Feels like they're not doing anything to improve that.

>Without context, anybody could say the same thing about anything. Care to share more?

Sure! Gandi received an abuse report regarding someone using one of my domains to scan for open dns resolvers. I informed Gandi that there was nothing I could do about this and expected that to be the end of it. Instead, they suspended my domain and started demanding that I send them ID proof.

As I needed the domain back I sent them a redacted photo of my id card, after which they demanded to see the full id. I decided to terminate my relationship with them.

I feel that this was absolutely unacceptable and likely unlawful behaviour from them as they had absolutely no need for that information. This wasn't a whois dispute.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#272

Post by mikeash »

0x0 wrote: post #81

I remember when NameCheap launched the "security notifications" feature where it would email you whenever there was a login or activity on your account. I noticed that logging in on the mobile site didn't trigger any emails. When asked, they replied that the mobile site was just a beta version. It doesn't help that the front door is securely locked when the back door is not! :-/

Crazy. I have trouble figuring out how you'd even program it that way. Is it not obvious that security notifications belong in the authentication layer that everything uses, and not in platform-specific front-end code?

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#273

Post by teraflop »

SeanDav wrote: post #203
Khao wrote: post #27

Earlier quoted context omitted.

> Established procedure was not followed Why have a procedure if your support doesn't follow it? Even if you have a procedure, everything falls apart when it isn't followed. This is the same as having no procedure at all.

People make mistakes. The customer support person was probably just trying to be helpful and not fully aware of all the ramifications. This is unfortunate but presumably there has been some retraining. Note: I have no direct or indirect relationship with Namecheap at all.

Sure, but retraining doesn't change the fact that people make mistakes, so it doesn't really solve the problem at all.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#274

Post by site-dot-onion »

So full of failure, this thread.

No, it is never okay to compromise security just because "it's good when you forget your password". There should be no way around this for any reason; a bypass via SE or any other mechanism is a failure of the company, end of. If you forget your password or you do not have your 2FA/security questions available, tough, you should lose access.

For the sake of "workarounds for legitimate users", that just translates to "a security hole".

Special pleading is a logical fallacy and if it works on a support rep, that rep has failed at their job.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#275

Post by ryanlol »

ProAm wrote: post #37
ryanlol wrote: post #26

Earlier quoted context omitted.

They're cool until they start holding your domains hostage and demanding that you email them a scan of your passport.

> email them a scan of your passport What? Why do they do this?

In my case there was absolutely no legitimate reason for them to request that.

And no, it wasn't related to registry rules or transfers as other users have suggested.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#276

Post by stephenr »

infinite8s wrote: post #136
stephenr wrote: post #87

Earlier quoted context omitted.

I had an interesting thought (literally as I was reading your comment) about improving "forgot password" emails, albeit only likely useful for the technically minded: Have the customer provide an SSH/GPG public key, and store it with the account. When a password reset is requested, encrypt a random string using said public key, and email it to the email for the account. An attacker who may have breached your webmail…

That's basically what TOTP/HOTP authentication tokens are, which many sites (including Google, AWS, Github) etc use for 2FA - https://en.wikipedia.org/wiki/Google_Authenticator . When you set it up, the service provider creates an 80 bit secret key, which you enter into your local device (or some implementations create a QR code) and then whenever you log in you need to provide a 1-time password from the app.

I'm aware of 2FA using (T|H)OTP, my thought was that a GPG/SSH key can be stored in a secure and yet reasonably easy to use way, effectively offline (i.e. add a passphrase and store it on a USB key or similar).

With a 2FA code, you either a) use the same code they use for regular logins, or b) require them to find a way to securely store the (T|H)OTP secret and then add that information to a 2FA app when they want to do a password reset.

I realise the pubkey concept is more than most people would bother with (or even be able to get through on their own), and I think the first 2FA option is definitely better than no extra security at all on password resets, but my thought was about increased security for those who are particularly paranoid/security conscious.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#277

Post by johnnyfaehell »

At the end of the post he seems quite snarky and bad mouthing namecheap's security for things that aren't even their fault or even security issues.

> The VPS panel allows full serial console with only a login/password (no 2FA required or possible)

Yea that's because it's a serial console, if you want 2FA or something then that's a matter for your operating serivce. A serial console is literally like you're plugged directly into the machine.

> They send out your VPS panel login/password in plain text emails when you sign up, and when you reset the password. So if you ever failed to delete one of those emails completely and someone gets into your email…your totally screwed…

To be fair this is pretty standard. It's your job to secure your passwords once they've given them to you. If they're storing it in plain text then you can complain but this basically sounds like you're complaining that they're not encrypting emails. Sure they could only show you it once when you boot it up. But since this action was done via customer support they would have to give you the password some how. To your email address the most secure other than the chat which can be by an attacker like it was in this case.

> VPS can be irrevocably wiped within seconds without any prompts or confirmations just by the click of one button; whether the server is turn on/off it doesn’t matter.

This isn't a security issue. A UX issue yea, but it's not even that big of a deal. It's in an area you won't be that often and where you know you're doing admin related thing.

> They keep no backups, even to cover hardware or security failure.

This isn't a security issue. It's your job to back up your stuff not a VPS provider.

> And of course the icing on the cake is that they ignore 2FA and are willing to send out your username/password to anyone that asks.

Yep. Pretty valid.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#278

Post by dougmany »

johnnyfaehell wrote: post #277

At the end of the post he seems quite snarky and bad mouthing namecheap's security for things that aren't even their fault or even security issues. > The VPS panel allows full serial console with only a login/password (no 2FA required or possible) Yea that's because it's a serial console, if you want 2FA or something then that's a matter for your operating serivce. A serial console is literally like you're plugged di…

>> They send out your VPS panel login/password in plain text emails >To be fair this is pretty standard.

This practice has always bothered me. An expiring link to reset is much better.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#279

Post by stephenr »

stordoff wrote: post #254
stephenr wrote: post #87

Earlier quoted context omitted.

I had an interesting thought (literally as I was reading your comment) about improving "forgot password" emails, albeit only likely useful for the technically minded: Have the customer provide an SSH/GPG public key, and store it with the account. When a password reset is requested, encrypt a random string using said public key, and email it to the email for the account. An attacker who may have breached your webmail…

> Have the customer provide an SSH/GPG public key, and store it with the account. Doesn't this just move the problem from "I forgot my password" to "I lost my private key"?

Higher security has some potential downsides.

If you enable 2FA on an account with a service, and subsequently lose access to 2FA otp's (e.g. phone lost/wiped/etc) and lose access to (or never kept) the recovery codes, you generally lose access to the account.

This is similar, but with the benefit that you can keep the key secure by default - i.e. put a passphrase on the key and then store it wherever you like.

In reality, if you fail this "recovery" method, my next suggestion would be a billing based one (i.e. talk to a human, get confirmation of previous invoice details, what is being billed for, how it's paid for, etc)

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#280

Post by jimktrains2 »

johnnyfaehell wrote: post #277

At the end of the post he seems quite snarky and bad mouthing namecheap's security for things that aren't even their fault or even security issues. > The VPS panel allows full serial console with only a login/password (no 2FA required or possible) Yea that's because it's a serial console, if you want 2FA or something then that's a matter for your operating serivce. A serial console is literally like you're plugged di…

> Yea that's because it's a serial console, if you want 2FA or something then that's a matter for your operating serivce. A serial console is literally like you're plugged directly into the machine.

Which, once the machine is up, is basically just exporting getty and exposing the system login prompt. Why couldn't the system login prompt require 2FA. Mostly for historical reasons I'm assuming, but just because it's serial doesn't mean it isn't just some software on the other end.

Post reply on HN