Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Namecheap live chat social engineering leads to loss of 2 VPS

postphp.com

Post reply on HN
Print view View original

331–340 of 426 posts

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#331

Post by kelukelugames »

tamar wrote: post #320
kelukelugames wrote: post #318

Earlier quoted context omitted.

The namecheap CIO never uses the word mistake. The execs rarely show any remorse. Best case they delegate to underlings like the social media guru.

Let's not throw personal attacks at me (and the tongue-in-cheek "congrats for being promoted to executive!" comment). There's plenty of remorse and there's plenty of acknowledgment of mistakes here. That said, as we acknowledged elsewhere, we're responding to the matter across several different platforms and specifically say we're rushed in trying to get out some basic insights behind what happened and transpired. A…

It's a common practice. I don't see how it is personally offensive to you. My description was for the CIO and execs in general, yet you insisted they were for you. So maybe you should stop making tongue-in-cheek comments. In fact, I am moving my domains off of Namecheap because I don't think Namecheap is very good at handling customer relations, particularly on social media.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#332

Post by [deleted] »

tamar wrote: post #320
kelukelugames wrote: post #318

Earlier quoted context omitted.

The namecheap CIO never uses the word mistake. The execs rarely show any remorse. Best case they delegate to underlings like the social media guru.

Let's not throw personal attacks at me (and the tongue-in-cheek "congrats for being promoted to executive!" comment). There's plenty of remorse and there's plenty of acknowledgment of mistakes here. That said, as we acknowledged elsewhere, we're responding to the matter across several different platforms and specifically say we're rushed in trying to get out some basic insights behind what happened and transpired. A…

[deleted]

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#333

Post by infinite8s »

kelukelugames wrote: post #309
swanson wrote: post #187

Earlier quoted context omitted.

My hobby: role-playing how I would respond as the CEO if my company was getting skewered on HN. Here is my version! --- Disclaimer: I'm [not] CIO @ Namecheap We messed up, big time. While we handle 1000s of live chat sessions everyday without issue, I realize that even one breakdown in security protocol can cause huge problems and a loss of trust for our customers. In response to this isolated case (in which our esta…

That's impressive, can you teach me to write like you?

It just requires thinking from the perspective of the person reading it, instead of trying to CYA.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#334

Post by mikestew »

I'd give money to a VPS, or what have you, that had a stated policy along the lines of, "here is a recovery key, here is the 2FA setup, here's how you recover your password with those items if you forget. If you call about account recovery and you do not have $REQUIRED_ITEMS, our service reps have been instructed to hang up on you. If you lose access to your account without $REQUIRED_ITEMS, you have lost access to your account permanently because we have set procedures from which we do not, under any circumstances, deviate. With a name like Ft. Knox VPS, our customers value the security of their accounts. As security is our priority, we have chosen to trade convenience and possible loss of data for the elimination of a large threat surface. If you regularly lose your car keys, don't use a password manager, or get angry when companies won't just email you your password instead of making you reset it, we're probably not the right choice for your VPS needs."

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#335

Post by [deleted] »

Ntrails wrote: post #212
mundo wrote: post #172

Earlier quoted context omitted.

This works well until you get to the "Our site is so secure that we need you to answer three security questions from our canned list, and they can't all be the same string" geniuses. Such an antipattern.

I had something along those lines tryin to log in to mojang on a new computer. "We've not seen you log into this pc before (although I had on that IP), please answer these three security questions. Of course I don't remember so I just reset them. I imagine the new answers and the old answers had a lot in common - they were composed primarily of expletives.

[deleted]

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#336

Post by matheweis »

mikestew wrote: post #334

I'd give money to a VPS, or what have you, that had a stated policy along the lines of, "here is a recovery key, here is the 2FA setup, here's how you recover your password with those items if you forget. If you call about account recovery and you do not have $REQUIRED_ITEMS, our service reps have been instructed to hang up on you. If you lose access to your account without $REQUIRED_ITEMS, you have lost access to yo…

I don't know... Apple did this for a while, and it backfired on them. The average user (even technically savvy user) simply wasn't competent enough to understand that they really truly would be locked out forever.

From 2014: http://thenextweb.com/apple/2014/12/08/lost-apple-id-learnt-...

They no longer do this: https://support.apple.com/en-us/HT204921

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#338

Post by tamar »

kelukelugames wrote: post #331
tamar wrote: post #320

Earlier quoted context omitted.

Let's not throw personal attacks at me (and the tongue-in-cheek "congrats for being promoted to executive!" comment). There's plenty of remorse and there's plenty of acknowledgment of mistakes here. That said, as we acknowledged elsewhere, we're responding to the matter across several different platforms and specifically say we're rushed in trying to get out some basic insights behind what happened and transpired. A…

It's a common practice. I don't see how it is personally offensive to you. My description was for the CIO and execs in general, yet you insisted they were for you. So maybe you should stop making tongue-in-cheek comments. In fact, I am moving my domains off of Namecheap because I don't think Namecheap is very good at handling customer relations, particularly on social media.

(the reply link didn't show up before, so I don't know if you saw my response posted right after this)

To be fair, your third edit was only for me. And that was the only comment I was replying to.

As I said, we are working to respond to hundreds of comments across dozens of platforms. I certainly respect your distaste in the more rushed responses in order to address all of the deluge, and that is why we were also simultaneously working on a longer and more thoughtful response that speaks for all of us at the company via that blog post (in a far more emotional tone).

It certainly is difficult to envision the challenges of responding to dozens of responses if you're not in our shoes. But I genuinely thank you for the feedback - and we're noting this (as well as the feedback all have been sent to date; a lot of that was factored into policy adjustment and our blog response) for handling it differently next time.

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#339

Post by mikestew »

matheweis wrote: post #336
mikestew wrote: post #334

I'd give money to a VPS, or what have you, that had a stated policy along the lines of, "here is a recovery key, here is the 2FA setup, here's how you recover your password with those items if you forget. If you call about account recovery and you do not have $REQUIRED_ITEMS, our service reps have been instructed to hang up on you. If you lose access to your account without $REQUIRED_ITEMS, you have lost access to yo…

I don't know... Apple did this for a while, and it backfired on them. The average user (even technically savvy user) simply wasn't competent enough to understand that they really truly would be locked out forever. From 2014: http://thenextweb.com/apple/2014/12/08/lost-apple-id-learnt-... They no longer do this: https://support.apple.com/en-us/HT204921

I by no means intend such a system be sold to average consumers. As you point out, it would be doomed to failure. More for the hard-core "I'd rather lose my customer DB than watch it walk off in the hands of someone with a good sob story" crowd. And I'm not 100% sure that there is large enough, bold enough type to forestall some customer saying, "but I didn't think you meant it!"

Re: Namecheap live chat social engineering leads to loss of 2 VPS

#340

Post by swanson »

kelukelugames wrote: post #309
swanson wrote: post #187

Earlier quoted context omitted.

My hobby: role-playing how I would respond as the CEO if my company was getting skewered on HN. Here is my version! --- Disclaimer: I'm [not] CIO @ Namecheap We messed up, big time. While we handle 1000s of live chat sessions everyday without issue, I realize that even one breakdown in security protocol can cause huge problems and a loss of trust for our customers. In response to this isolated case (in which our esta…

That's impressive, can you teach me to write like you?

Formula:

* Actually apologize in a human way

* Show empathy by identifying the impact of what happened to customers (not your impact internally)

* State action items that you've created, even if they are just in 'evaluation' state

* Indicate that the specific incident in question is being handled outside of this forum

* Take responsibility for things even if you shouldn't "have to"

Post reply on HN