It was not declared whether 2FA was enabled on the account or not. I will assume that it wasn't enabled.
a support-initiated reset and transfer would bypass 2fa
Tell HN: Namecheap gave my account to an unverified third party
71–80 of 190 posts
Re: Tell HN: Namecheap gave my account to an unverified third party
#72Earlier quoted context omitted.
I did have domain privacy enabled. NC allows people to initiate a password reset via username, email address, or domain name. I was a happy customer right up until this incident. And I certainly agree that due diligence is a must for something as critical as a registrar.
Did you have 2FA enabled too?
Yes it was enabled but it's unclear to me how effective it would've been in this case.
I attempted to login after support changed the password, but prior to the club president connecting with me. So I filed a support ticket that my password stopped working, and to NameCheap's credit they locked the account shortly thereafter. I worked with support later to regain access.
I don't know for sure if the club president was able to successfully auth with the new password before NC locked the account at my request. To be completely transparent, keeping this domain on my personal account was a legacy arrangement that probably should have been handed off sooner. Student club turnover being what it is, I was just renewing it so it wouldn't get squatted. We are fully transferring ownership to them now so there's no friction.
It's fair to criticize this arrangement as messy. Regardless, NC shouldn't have simply handed over the account to an unverified phone caller.
Re: Tell HN: Namecheap gave my account to an unverified third party
#73I left Namecheap when they took away Databases for Palestine's domains for daring to publish evidence of the Gaza genocide. They do not deserve your business https://www.thecanary.co/skwawkbox/2026/01/03/namecheap-gaza...
[dead]
Re: Tell HN: Namecheap gave my account to an unverified third party
#74Earlier quoted context omitted.
How is domain privacy relevant here? That only hides your email from public records. What if the attacker already knows it (as they did in this case)? Email address is quite literally something you are meant to share publicly. It is not a password.
Registration info usually also includes a physical address and names.
i agree that's important to hide, but also irrelevant to preventing what happened here.
Re: Tell HN: Namecheap gave my account to an unverified third party
#75Earlier quoted context omitted.
Is it time to change registrars already? I fled Gandi a while ago because of private equity fuckery. And now I need to go somewhere else. Who won't adopt enshitification-as-a-business-plan for a few years? No wonder people are leaving tech to go be goat farmers.
namecheap has had a mixed reputation for several years now. when i took over responsibility for a domain registered on namecheap the first thing i did was move it off there (to gandi, because that was before gandi was sold) because i heard some problematic stories about namecheap. it baffles me everytime i see namecheap recommended.
Namecheap was one of the popular alternatives to GoDaddy, recommended by techies. That's changed now, but I'm not surprised people haven't all caught up to its new reputation.
Re: Tell HN: Namecheap gave my account to an unverified third party
#76I've been a long, long term customer of Namecheap as well. Domain privacy protection is a feature that Namecheap provides for all valid domains. Its included by default at no extra cost. The poster didn't indicate if they had this feature enabled or not for the domain. It would have prevented the college club person from even seeing their email address to initiate a password reset. This clearly isn't an answer for NC…
How is domain privacy relevant here? That only hides your email from public records. What if the attacker already knows it (as they did in this case)? Email address is quite literally something you are meant to share publicly. It is not a password.
I think their point was that if WHOIS data were hidden, a password reset request that relied on providing the email address would've been impossible. But since NC's account management allows visitors to provide just a domain name to generate an unlock email, domain privacy wouldn't be a protective layer here.
Re: Tell HN: Namecheap gave my account to an unverified third party
#77Earlier quoted context omitted.
Is it time to change registrars already? I fled Gandi a while ago because of private equity fuckery. And now I need to go somewhere else. Who won't adopt enshitification-as-a-business-plan for a few years? No wonder people are leaving tech to go be goat farmers.
> Who won't adopt enshitification-as-a-business-plan for a few years? I don't have a crystal ball, but NearlyFreeSpeech was recommended to me in 2010 and I've been using it since 2012. I don't think it's changed at all in that time. https://www.nearlyfreespeech.net/services/domains https://www.nearlyfreespeech.net/services/respect
I use NFS for hosting, and I agree they are still good. But it's just a matter of time. Always be ready to move.
Re: Tell HN: Namecheap gave my account to an unverified third party
#78Earlier quoted context omitted.
Porkbun. Yes, Cloudflare Domains exists but let's support the small guys.
Given Cloudflare's reputation for shakedowns once you pass their undisclosed thresholds I wouldn't trust them with my domains. I'm not expecting something for nothing, we all need to eat. I'm happy to stay within any limits or even have no free tier at all. I just don't want the fear of waking up to a sales email one morning demanding I suddenly fork out more then I earn in a year off the project for an enterprise pl…
Can you expand more on cloudflare's shakedowns? I have some domains on Cloudflare and thought they were a trustworthy service. Is there there anything particular you can point to?
Re: Tell HN: Namecheap gave my account to an unverified third party
#79Yep, never own a domain with NameCheap.
My experience was kind of opposite, but still bad nonetheless. I lost domains I had with them simply because I lost the phone I used for 2FA. After several calls to them, they requested some info. I supplied all they wanted, but it took them more than a year to get back to me, by which time I had lost all interest in maintaining domains with them.
Luckily these were not critical domains; I had bought them in anticipation of building a business on them.
I am moving my domains to CloudFlare.