Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Namecheap gave my account to an unverified third party

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 190 posts

Re: Tell HN: Namecheap gave my account to an unverified third party

#101

Post by jacobgkau »

I stopped trusting Namecheap when they shunted all Russian users due to the Ukraine war. While it wasn't against ICANN regulations (since they did facilitate transfers out), it seemed against the spirit to me for them to do that to individual people and small businesses who weren't legally sanctioned.

I kept a couple of domains on them for a while simply because their prices for some exotic TLD's were significantly lower than my previous go-to of Hover, but now Porkbun's got them beat on everything I use, anyway, so I'd transferred the last of them out over the past year or so.

Re: Tell HN: Namecheap gave my account to an unverified third party

#102

Post by ccamrobertson »

davnicwil wrote: post #88
pilingual wrote: post #19

Namecheap has been owned by a private equity firm for several months now. It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.

I heard some advice recently, I think in an article here on HN, to just use a big company registry where it's not their profit center, indeed may even be netural to loss making, to drive other business. This makes total sense to me. I'm not saying it solves all problems but it eliminates so many of them, including a meta problem: the risk of new classes of problems being unexpectedly introduced (by say a private equi…

As someone still smarting from the loss of Google Domains, I would consider this advice carefully.

When domains are not the profit center the company might just arbitrarily turn them off as a feature.

Re: Tell HN: Namecheap gave my account to an unverified third party

#103

Post by ajb »

pilingual wrote: post #19

Namecheap has been owned by a private equity firm for several months now. It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.

The problem is that they also need to be big enough not to be rolled by aggressive behaviour such as lawsuits, pressure from politicians, etc. I mean, some of my domains are at a tiny company run by geeks, but I wouldn't really blame them for caving if someone really put the heat on them.

There's a certain threshold above which you want to use the "law firm with in-house domain registry" type. I think the threshold is pretty high though, definitely "call us for a quote" territory. But you will notice that big companies like Amazon and Google that have their own registry, don't use it for their critical domains - such as Google.com or Amazon.com.

Re: Tell HN: Namecheap gave my account to an unverified third party

#104

Post by [deleted] »

throwaway219450 wrote: post #84
system2 wrote: post #56

Earlier quoted context omitted.

Password reset would bypass 2fa.

I’ve reset 2FA with a known password and it was pretty onerous. Had to provide a lot of info: username, full name on account, other domains, phone number, order number, email, invoice IDs and payment proof. Asking for my legal ID would have been an improvement, but someone would need a lot more than “pretty please” on the phone.

[deleted]

Re: Tell HN: Namecheap gave my account to an unverified third party

#105

Post by tredre3 »

pilingual wrote: post #19

Namecheap has been owned by a private equity firm for several months now. It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.

> Namecheap has been owned by a private equity firm for several months now.

Namecheap's cavalier attitude long predate private equity, let's stop blaming the evil financiers for everything. I'm sure it's going even further downhill from here because of it, but what happened to OP happened to others before as well and is par for the course when being a namecheap customer.

Re: Tell HN: Namecheap gave my account to an unverified third party

#106

Post by tredre3 »

geuis wrote: post #11

I've been a long, long term customer of Namecheap as well. Domain privacy protection is a feature that Namecheap provides for all valid domains. Its included by default at no extra cost. The poster didn't indicate if they had this feature enabled or not for the domain. It would have prevented the college club person from even seeing their email address to initiate a password reset. This clearly isn't an answer for NC…

Namecheap's privacy WHOIS still shows a unique email address so that the owner is reachable. Sending mails to it would have been forwarded to OP.

Re: Tell HN: Namecheap gave my account to an unverified third party

#107

Post by duskwuff »

jasongill wrote: post #99
davnicwil wrote: post #88

Earlier quoted context omitted.

I heard some advice recently, I think in an article here on HN, to just use a big company registry where it's not their profit center, indeed may even be netural to loss making, to drive other business. This makes total sense to me. I'm not saying it solves all problems but it eliminates so many of them, including a meta problem: the risk of new classes of problems being unexpectedly introduced (by say a private equi…

The only problem with this is that having such a complex function as a non-core business unit makes it ripe to get rid of, or try to find a way to make it a profit center. Cloudflare, for example, removed the ability to change the nameservers for all domains registered with them. Google got tired of being in the business and sold it to Squarespace. Being a domain registrar is a total PITA and is not for the faint of…

> Cloudflare, for example, removed the ability to change the nameservers for all domains registered with them.

Cloudflare never offered that ability. From the time they started offering domain registrations, it was always with the caveat that the nameservers would be fixed to Cloudflare's.

Re: Tell HN: Namecheap gave my account to an unverified third party

#108

Post by jacobgkau »

system2 wrote: post #70

I have important domains on Namecheap. Should I move them to Porkbun or Cloudflare? I only buy cheap, throwaway-type domains with Cloudflare, as I find them too corporate-like to support me for my cheap $10 domain, and that's why I kept good ones with Namecheap despite their 2x pricing. I want to work with an American company with real support. (But not with godaddy of course).

For what it's worth, I have had brief one-on-one contact with Porkbun support once. Their checkout was failing when using PayPal one day, and a seemingly real person emailed in response to my ticket about an hour and a half later to let me know they'd corrected the issue.

Re: Tell HN: Namecheap gave my account to an unverified third party

#109

Post by foresto »

linsomniac wrote: post #21

CloudFlare has their plusses and minuses, but they do offer domain registration at cost, for example $10.46/year for .com (every year, not one of those deals for the first year then more expensive down the line).

Cloudflare has become a middleman and gatekeeper of the web, a single point of surveillance, and an enemy of the open internet. Giving them more business would make these problems worse. No thanks.

Re: Tell HN: Namecheap gave my account to an unverified third party

#110

Post by sandeepkd »

maxgashkov wrote: post #61
sandeepkd wrote: post #40

In the absence of actual details its hard to say what was considered for making this decision. If I have to take a wild guess then being able to demonstrate the control on the webserver hosting the content could have been one way to prove ownership over the domain. It can be called social engineering, however one can also put it in category of account recovery by verifying content control on the domain. The part wher…

Webserver control is never used and must not be used to prove domain ownership. If you're pwned and have to re-point to a server stood up from backup, having registrar relying on someone being able to put up a random file on a compromised machine would be a total security disaster.

To clarify, my observation is around how it might have happened, not if this is the right way to do it
Post reply on HN