Namecheap live chat social engineering leads to loss of 2 VPS

Post by abrookewood » Wed, Apr 13, 2016, 2:36 AM UTC

ramm110 wrote: post #176

brianwawok wrote: post #77

Earlier quoted context omitted.

It's tricky because a lot of customers really DO lock themselves out of a service, and forget their password reset code. Fun story time. I use to play MTGO, the online Magic the Gathering game. Played it from beta for a few years say 2002-2004. Wanted to check it out in 2014 to see how it changed. Failed password reset online, had to call in to support. The support guy was like chortle what was your security passcode…

I had a similar thing happen with my Battle.net account. I forgot to transfer over my authenticator backup code when I switched password managers last time. I had to send them a photo of my driver's license next to my face and another one of it next to a physical newspaper with the date on it. This seems like a much better process for recovering accounts that matter.

Post by DiabloD3 » Wed, Apr 13, 2016, 3:33 AM UTC

tamar wrote: post #297

po1nter wrote: post #259

Since the CIO (and another employee) are here. Why are you not offering support for Google Authenticator? Last time someone asked for it was 2 years ago[1] and still no sign of the feature. Cheap prices are good to have but combining that with more security can only add value. [1]: https://www.namecheap.com/support/knowledgebase/article.aspx...

It's in the works. We're aware of the request.

Post by PhantomGremlin » Wed, Apr 13, 2016, 3:44 AM UTC

extrapickles wrote: post #139

jqueryin wrote: post #101

As someone in the domain registrar industry, are there any features beyond 2FA that you would like to see implemented by registrars? More bluntly, what is it that you think your current registrar is lacking? I read a few comments on Gandi and support of GPG keys. I'm guessing this is what you're referring to: https://wiki.gandi.net/en/gandi/documents

I would like to see something where a postcard is mailed and a phone call, each with half of the code needed for a reset. Postcard should not be sent using a method that supports forwarding so an attacker cannot setup a mail forward. Customer support should not be able to see anything about these accounts except for a reset button. I do expect to be charge a fee for a reset if I need to use it. This would need to be…

Post by PhantomGremlin » Wed, Apr 13, 2016, 4:00 AM UTC

mikestew wrote: post #334

I'd give money to a VPS, or what have you, that had a stated policy along the lines of, "here is a recovery key, here is the 2FA setup, here's how you recover your password with those items if you forget. If you call about account recovery and you do not have $REQUIRED_ITEMS, our service reps have been instructed to hang up on you. If you lose access to your account without $REQUIRED_ITEMS, you have lost access to yo…

   I UNDERSTAND THAT I WILL PERMANENTLY LOSE
   ALL ACCESS IF I FORGET MY PASSWORD AND
   MY RECOVERY KEY

   I UNDERSTAND THAT I WILL PERMANENTLY LOSE
   ALL ACCESS IF I FORGET MY PASSWORD AND
   MY RECOVERY KEY

Post by gst » Wed, Apr 13, 2016, 4:16 AM UTC

brianwawok wrote: post #77

r1ch wrote: post #50

I had my 2FA at Singlehop bypassed by social engineering attack. They helpfully changed the entire account contact info without any notice to me, presumably from a phone call. The attacker didn't even have any information to go off other than the IP address. I only found out when I saw the server rebooting into rescue mode and luckily I still had an active management portal cookie (changing the password doesn't log y…

It's tricky because a lot of customers really DO lock themselves out of a service, and forget their password reset code. Fun story time. I use to play MTGO, the online Magic the Gathering game. Played it from beta for a few years say 2002-2004. Wanted to check it out in 2014 to see how it changed. Failed password reset online, had to call in to support. The support guy was like chortle what was your security passcode…