Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare Registrar

cloudflare.com

Post reply on HN
Print view View original

101–110 of 111 posts

Re: Cloudflare Registrar

#101

Post by regecks »

AdamGibbins wrote: post #98
regecks wrote: post #92

Earlier quoted context omitted.

I think devy means that you usually cannot add a U2F as the only second factor - you usually need to first add TOTP or phone number as backup. So, an attacker can just target the weaker factor and ignore U2F. I certainly had the same thought.

The prime thing U2F mitigates is phishing attacks. You literally cannot be phished with U2F, you try to auth against the wrong domain and you get a different secret - so they can't then pass that on the backend (i.e. the real site) and login as you. Sure your TOTP might remain, but you're not using it, so it's not liable to be taken.

Construct a phishing site that gives some vague error message about being unable to connect to your device, and offer the TOTP fallback. How many people will fall for it?

"Literally cannot get phished" is woefully far away, because the phishing-resistant property of U2F has a giant hole in the side of it (fallback factors) and therefore still relies on human vigilance.

I do use U2F though, because it is pretty convenient.

Re: Cloudflare Registrar

#102

Post by h1d »

brobinson wrote: post #57
SnowingXIV wrote: post #54

Earlier quoted context omitted.

Every time I've thought about moving away from Namecheap to something else I've remembered those once in a blue moon times I've actually needed to reach out to support for mission critical type of events. The support I've received has been absolutely stellar. Above and beyond what I would have expected to be their scope of service. I don't know any other providers I hold as highly in support, especially anything comi…

I dislike Namecheap for a few reasons. They don't let you log in with a _valid_ username and password if you are using a VPN. Their UI is pretty bad, too. If you have an adblocker, you don't see "Submit" buttons on a lot of forms (editing WHOIS information, etc.)... lots of small annoyances with their service.

Submit button problem sounds solvable if people keep bugging the support.

It's 1 day job, probably button image or form URL includes 'ad' or something.

Re: Cloudflare Registrar

#104

Post by stevenicr »

nrook wrote: post #77

Before you register your domain with Cloudflare, please consider who their other customers are. Cloudflare today provides services for many white supremacist websites; they kicked off the Daily Stormer in 2017 after widespread criticism, but still receive money from many others. From what I can see, their senior leadership genuinely believes that, morally, they have an obligation to provide services for horrible peop…

If they had not kicked stormer I would be jumping on this - unfortunately it shows me that it's another service that can not be trusted to remain a neutral dumb pipe. Even worse they showed the world that they can be used to take things down / offline.

The day that happened I lost faith in American Internet, and actually now advocate for regulation of registrars and companies like cloudlfare - when you corner so much of the market (through low pricing using google's resources and others) for protecting transmission of data / information and you start blocking data on whims - you are no better then [insert other censorship regime here] -

they are not the only ones, godaddy has shown itself as a censor for various groups and so have others.

I can understand refusing to be a host / disabling hosting, but as far as data transmission, domain name registrars and similar internet functions, it should be let everything through and don't get involved imho.

Re: Cloudflare Registrar

#105

Post by dessant »

Sujan wrote: post #61
dessant wrote: post #55

Earlier quoted context omitted.

For a customer it's irrelevant that the discount is a loss leader. The end result is that I can renew a .space domain for half the price at Namecheap, without having to buy other services.

... which is why sam told you to take that deal as it makes sense to take it.

> If you can find it for $15.18 without having to buy other services, that's a deal and you should take it.

I was told to take the $15.18 Cloudflare deal, not the $9.06 Namecheap deal.

Re: Cloudflare Registrar

#106

Post by dazc »

tialaramex wrote: post #69
dazc wrote: post #52

Earlier quoted context omitted.

I can't see Nominet letting it happen.

Why in particular? Plenty of other registrars offer .uk or the public suffixes under it like .co.uk and .org.uk The Nominet requirements do cause these to break mysteriously much more often than some generic TLD spun up yesterday by people convinced this is a gold rush (e.g. my registrar offered me a great renewal deal for a .co.uk I control, I pressed "Yes please" and then their system believed I had taken the deal…

'Why in particular?'

Nominet is a bit of closed-shop with strong links to existing UK-based registrars. I may be too cynical but I just get the feeling that they'd see Cloudflare as too much of a threat?

Re: Cloudflare Registrar

#107

Post by dazc »

djmobley wrote: post #84
tialaramex wrote: post #69

Earlier quoted context omitted.

Why in particular? Plenty of other registrars offer .uk or the public suffixes under it like .co.uk and .org.uk The Nominet requirements do cause these to break mysteriously much more often than some generic TLD spun up yesterday by people convinced this is a gold rush (e.g. my registrar offered me a great renewal deal for a .co.uk I control, I pressed "Yes please" and then their system believed I had taken the deal…

“Some registries do not allow domains to be registered with WHOIS Redaction or WHOIS Privacy. Many of these are country TLDs (ccTLDs) like .uk. Cloudflare does not yet support TLDs that prohibit WHOIS redaction, but we will in the near future.” - https://developers.cloudflare.com/registrar/domain-registrat...

Thanks for the link, although whois has become something of a non-issue with the advent of GDPR.

Re: Cloudflare Registrar

#108

Post by albertvila »

brobinson wrote: post #57
SnowingXIV wrote: post #54

Earlier quoted context omitted.

Every time I've thought about moving away from Namecheap to something else I've remembered those once in a blue moon times I've actually needed to reach out to support for mission critical type of events. The support I've received has been absolutely stellar. Above and beyond what I would have expected to be their scope of service. I don't know any other providers I hold as highly in support, especially anything comi…

I dislike Namecheap for a few reasons. They don't let you log in with a _valid_ username and password if you are using a VPN. Their UI is pretty bad, too. If you have an adblocker, you don't see "Submit" buttons on a lot of forms (editing WHOIS information, etc.)... lots of small annoyances with their service.

I have a few domains with them and I totally agree that the UI needs some love.

Re: Cloudflare Registrar

#109

Post by Ayesh »

This has made news a few times but I will not use them for my domains.

It's been a few months since launch, but I still can't use my own nameservers for the domains.

While the registry-pricing can often workout cheaper, some registrars negotiate nicer deals with the registry. I have a .me domain for 8 years that I never paid the registry standard price, it has always been sent discounted rate.

Re: Cloudflare Registrar

#110

Post by tracker1 »

nrook wrote: post #97
tracker1 wrote: post #94

Earlier quoted context omitted.

You don't change peoples opinions by shutting them out, all that does is drive them deeper into their own echo chambers. It's usually a bad idea in practice. Freedom of speech means freedom of speech you don't agree with. There is no need to protect speech most people disagree with. FYI, the ACLU has also protected the same people you refer to. The problem with taking away civil liberties, is that eventually it will…

I support the First Amendment wholeheartedly, and believe it's important that the government refrain from shutting down speech it doesn't like. You may note that Cloudflare is not a government.

Considering how much traffic flows through it, you really think they don't have the more power than most governments?

And while, the First Amendment doesn't provide protection from private parties, it is still possible to agree with Free Speech rights as a private company, even if you disagree with the message. The problem is when you start shutting down conversations, you become part of the problem.

The likes of Twitter and Facebook, as an example are FAR more powerful than any government or localized platform traditionally protected, and may be considered Private Spaces for Public Use, which have been defined before (ref: Occupy Movement).

Just because you are a private entity does not mean you are free to do anything you want. The government has LOTS of limitations on what businesses can or can't do. Unless you are suggesting that businesses should never have to comply with disability laws, or laws regarding other protected classes too?

Post reply on HN