Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Namecheap gave my account to an unverified third party

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 190 posts

Re: Tell HN: Namecheap gave my account to an unverified third party

#31

Post by blcArmadillo »

Thrashed wrote: post #13
geuis wrote: post #11

I've been a long, long term customer of Namecheap as well. Domain privacy protection is a feature that Namecheap provides for all valid domains. Its included by default at no extra cost. The poster didn't indicate if they had this feature enabled or not for the domain. It would have prevented the college club person from even seeing their email address to initiate a password reset. This clearly isn't an answer for NC…

I did have domain privacy enabled. NC allows people to initiate a password reset via username, email address, or domain name. I was a happy customer right up until this incident. And I certainly agree that due diligence is a must for something as critical as a registrar.

Did you have 2FA enabled too?

Re: Tell HN: Namecheap gave my account to an unverified third party

#32

Post by em-bee »

rickydroll wrote: post #9
happytoexplain wrote: post #3

Just a few weeks ago I moved from Namecheap to Porkbun. That's not an advertisement - I simply Googled popular registrars. But it is an indictment of Namecheap. They are going the way of GoDaddy. Please move away from them immediately. They are shifting to short-term strategies (high prices, immoral data practices, etc). Edit: Apparently they were bought by private equity just weeks before I noticed something was wro…

Is it time to change registrars already? I fled Gandi a while ago because of private equity fuckery. And now I need to go somewhere else. Who won't adopt enshitification-as-a-business-plan for a few years? No wonder people are leaving tech to go be goat farmers.

namecheap has had a mixed reputation for several years now. when i took over responsibility for a domain registered on namecheap the first thing i did was move it off there (to gandi, because that was before gandi was sold) because i heard some problematic stories about namecheap. it baffles me everytime i see namecheap recommended.

Re: Tell HN: Namecheap gave my account to an unverified third party

#34

Post by xyst »

Notably, they have been bought out by private equity.

> September 2025, CVC Capital Partners acquired a majority stake in Namecheap for an undisclosed amount, valuing the company at $1.5 billion.[3][4] Kirkendall stepped down as CEO on December 16, 2025

But prior to this they have had many incidents. Switched all domains to porkbun a few years ago

Re: Tell HN: Namecheap gave my account to an unverified third party

#35

Post by deadalus »

terribleperson wrote: post #27
pilingual wrote: post #19

Namecheap has been owned by a private equity firm for several months now. It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.

...seriously? Where do I jump ship to now?

Porkbun. Yes, Cloudflare Domains exists but let's support the small guys.

Re: Tell HN: Namecheap gave my account to an unverified third party

#36

Post by ryandrake »

This kind of story makes me wonder what's the most popular/valuable domain I can take control of simply by being convincing over the phone. Sounds tempting!

I can't even log in to most web sites anymore without doing a side-trip to my E-mail inbox, "for enhanced security," but these clowns let you just take a domain by asking nicely!

Re: Tell HN: Namecheap gave my account to an unverified third party

#37

Post by richardchilders »

Namecheap forces users to log in to identify themselves. So far, OK.

But then when one attempts to pay for a domain, after one has already provided all of one's credit card information to Namecheap ... Namecheap up and refers its customers to something called Link, which forces Namecheap's customers to create an account and become Link's customers - providing all that confidential credit card information, all over - leaving the customer wondering why Namecheap collected it and what they are going to do with it.

Link forces you to authenticate via SMS so that they know where you are.

This all happened less than 24 hours ago and I was already getting ready to put domain service shopping on my list of things to do but I'm glad to see I'm not the only one.

I nominate Paul Vixie as a possible candidate for CTO or even CEO of a hypothetical nonprofit DNS domain service.

More info: uggcf://fnynanir-ehalba.bet/ureovr.ugzy

Re: Tell HN: Namecheap gave my account to an unverified third party

#38

Post by ethin »

paxys wrote: post #24

People are (rightfully) concerned about superintelligent AI but social engineering continues to be by far the biggest attack vector for digital infrastructure. And it’s being made worse by companies continuously cutting costs in areas like support. The call center employee making third world minimum wage doesn’t give a shit who the real owner of the domain is. They want to end the call quickly and get 5 stars from th…

Honestly I'm wayyy more concerned with social engineering attacks than some theoretically superintelligent AI. Social engineering is, IMO, the far worse of the too

Re: Tell HN: Namecheap gave my account to an unverified third party

#39

Post by kilroy123 »

terribleperson wrote: post #27
pilingual wrote: post #19

Namecheap has been owned by a private equity firm for several months now. It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.

...seriously? Where do I jump ship to now?

I moved all my from name cheap to porkbun years ago.

Re: Tell HN: Namecheap gave my account to an unverified third party

#40

Post by sandeepkd »

In the absence of actual details its hard to say what was considered for making this decision. If I have to take a wild guess then being able to demonstrate the control on the webserver hosting the content could have been one way to prove ownership over the domain.

It can be called social engineering, however one can also put it in category of account recovery by verifying content control on the domain.

The part where it gets hairy is if your credit card was associated with the account, thats probably a recipe for disaster?

Post reply on HN