Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Namecheap gave my account to an unverified third party

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 190 posts

Re: Tell HN: Namecheap gave my account to an unverified third party

#141

Post by userbinator »

happytoexplain wrote: post #135
userbinator wrote: post #134

Posted by a 3-hour-old account (as of this comment), and then multiple mentions of the same competitor in the other comments here. Make of that what you will...

It's normal for people to make accounts to express grievances. And it's normal for a registrar bought by private equity to begin slowly enshittifying. And Porkbun is very clearly the next most popular choice, regardless of this thread. In fact, it's even been pointed out that they may be the next to enshittify - not something a shill says. I.e shilling skepticism is not rational in this case.

not something a shill says.

Shilling has moved on from being 100% positivity, precisely because it's too obvious otherwise.

Re: Tell HN: Namecheap gave my account to an unverified third party

#142

Post by sandeepkd »

maxgashkov wrote: post #117
sandeepkd wrote: post #111

Earlier quoted context omitted.

On a different note, adding a file on webserver is one of the ACME methods (HTTP-01) to get a SSL/TLS certificate so it is indeed considered as possession method in real world already

You're missing that HTTP-01 challenge grants you no ability beyond what the check has demonstrated, i.e. you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection. There are no comparable _technical_ proof-of-registration methods because all of them would require actual access to registrar control panel and be outright silly ('point the domai…

> you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection.

Its digression from the original topic, still, it goes way far than that, these certificates are signed by a CA that the client devices trusts by the virtue of root certificates installed on the device. If I can some how obtain the SSL/TLS certificate for google then thats a very big deal.

Re: Tell HN: Namecheap gave my account to an unverified third party

#144

Post by crossroadsguy »

sitzkrieg wrote: post #143
pilingual wrote: post #19

Namecheap has been owned by a private equity firm for several months now. It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.

happy porkbun customer of many years here

So am I. But I have already told myself that one day I WILL have to move to a "new Porkbun". Because such services are small, privacy focused services, until someone starts pouring dollar buckets at them. Until then porkbun it is. But I am mentally prepared.

Re: Tell HN: Namecheap gave my account to an unverified third party

#145

Post by crossroadsguy »

pilingual wrote: post #19

Namecheap has been owned by a private equity firm for several months now. It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.

The day Namecheap started terminating services for existing customers from Russia was the day I realised that service can't be relied upon at all and had initiated my domain transfer the very next day to another registrar I was using.

Re: Tell HN: Namecheap gave my account to an unverified third party

#146

Post by maxgashkov »

sandeepkd wrote: post #142
maxgashkov wrote: post #117

Earlier quoted context omitted.

You're missing that HTTP-01 challenge grants you no ability beyond what the check has demonstrated, i.e. you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection. There are no comparable _technical_ proof-of-registration methods because all of them would require actual access to registrar control panel and be outright silly ('point the domai…

> you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection. Its digression from the original topic, still, it goes way far than that, these certificates are signed by a CA that the client devices trusts by the virtue of root certificates installed on the device. If I can some how obtain the SSL/TLS certificate for google then thats a very bi…

That's why it's very unlikely that you will be able to put a file under google.com/.well-known/acme-challenge

But if you somehow managed to do that, no one in the right mind would argue that you're free to undelegate the domain or point it to a NS you control.

Re: Tell HN: Namecheap gave my account to an unverified third party

#147

Post by crossroadsguy »

davnicwil wrote: post #88
pilingual wrote: post #19

Namecheap has been owned by a private equity firm for several months now. It would be nice to have a nonprofit registrar so jumping every few years isn't necessary.

I heard some advice recently, I think in an article here on HN, to just use a big company registry where it's not their profit center, indeed may even be netural to loss making, to drive other business. This makes total sense to me. I'm not saying it solves all problems but it eliminates so many of them, including a meta problem: the risk of new classes of problems being unexpectedly introduced (by say a private equi…

I think a middle ground could be to use a great "domain registrar" and be prepared to move to another one when the last one stopped being great or sold to someone not so very great. And so on. Luckily this doesn't happen every month, or every year.

Re: Tell HN: Namecheap gave my account to an unverified third party

#148

Post by kstrauser »

ButlerianJihad wrote: post #132

So, reading through the holes in your story: you are not a leader of this club, nor a member, nor affiliated with the college at all. And the domain name wasn't actually "in use" but parked. And the legitimate leadership of the college-affiliated club was able to prove to NameCheap that they had a right to the domain name, as it was (not a right to your account, but a right to their club's name on the Internet). And…

This is bullshit. There are legal processes in place to decide disputes. Absent those processes, possession is ownership, and it would be absolute madness and chaos if it weren't.

I could make pretty convincing letterhead "proving" that I own "Google Foods", but that doesn't mean a registrar should give me google.com. The correct process if I want to assert that is to sue for ownership and prove to a court that I'm the rightful owner, and to get an order compelling the registrar to transfer it to me. And if I can't, then Google gets to keep it. This is the only possible sane way to manage domain ownership.

Re: Tell HN: Namecheap gave my account to an unverified third party

#149

Post by newsomix9xl »

I'd say asking nicely is a kind of social engineering.

It may not be some Mitnick level impersonation of a Senior VP on vacation needing an urgent change kinda trick but the point of S.E. was that it played on the human element and namely cooperation of same.

How it was obtained was not strictly defined AFAIK.

Re: Tell HN: Namecheap gave my account to an unverified third party

#150

Post by squigz »

userbinator wrote: post #134

Posted by a 3-hour-old account (as of this comment), and then multiple mentions of the same competitor in the other comments here. Make of that what you will...

The community response here is actually fascinating to me.

I would have expected at least some responses pointing out that this sounds far too bad to be true, and asking what parts of the story are we missing, as has happened when other stories like this show up.

Post reply on HN