Tell HN: Namecheap gave my account to an unverified third party

About my use of the word "genocide": genocide is defined not primarily by the scale of the killing, but most importantly by the intent behind it. The intent of the war on Gaza, as expressed repeatedly by the people prosecuting it, is to destroy the Palestinian people as a people. That's what makes it a genocide, not just the raw number of dead. https://www.un.org/sites/un2.un.org/files/doc.1_convention_o...

(In the interest of keeping things on topic for HN, I won't respond to your other points)

the author explicitly said they had domain privacy on. so we know that the caller did not have the address information.

and we can be certain that domain privacy wouldn't have helped in this case (because it didn't).

https://news.ycombinator.com/item?id=49028611

>Convinced how? Often such things are via "knowing things" about the account holder.

i have some experience with social engineering attacks (former infosec turned teacher) and it was probably a combination of:

    - caller confidence that they were the club owner/manager (because they were)
    - offering/sending club-specific information that matched information on the site (flyers, pamphlets, etc.)
    - "call the number on the website and i will answer it"
    - an official college website page that had the caller listed as an owner/manager of the club
    - some poor 20-something year old working in a hellish, windowless tier 1 tech support center

[flagged]

[flagged]

Hate to do a hit & run post but here we go...

Both AT&T and Apple transferred (albeit both temporarily) ownership of my phone # (AT&T) and my Apple ID (OK you know the company) from purely social engineering.

The AT&T one was basically like this post. A phone call with a convincing person. Eventually (through threat of legal action) I was able to listen to the recorded call where it happened, and it was simultaneously infuriating and fascinating.

The Apple one was more sophisticated. Too much to write here, but essentially to pull it off all the thief needed to do was have Apple call my number on file and have me answer it. I suspect I know the attack vector, but all I got from Apple was a very quick reversal, not an apology but an acknowledgment, and an explicit message that the details on their end wouldn't / couldn't be shared b/c of corporate policy (which honestly I think makes some sense if a novel vulnerability via social engineering has been found & exploited).

"The meatbag in the loop is the weak link" is said often, isn't always true... but sometimes it is indeed.

N.b.: I work in firmware & electronics security & cryptography.