Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Namecheap gave my account to an unverified third party

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 190 posts

Re: Tell HN: Namecheap gave my account to an unverified third party

#151

Post by palmotea »

geuis wrote: post #11

I've been a long, long term customer of Namecheap as well. Domain privacy protection is a feature that Namecheap provides for all valid domains. Its included by default at no extra cost. The poster didn't indicate if they had this feature enabled or not for the domain. It would have prevented the college club person from even seeing their email address to initiate a password reset. This clearly isn't an answer for NC…

> Domain privacy protection is a feature that Namecheap provides for all valid domains. Its included by default at no extra cost.

That's not exactly true. IIRC, it's not allowed for .us domains.

Re: Tell HN: Namecheap gave my account to an unverified third party

#152

Post by turpentine »

geuis wrote: post #11

I've been a long, long term customer of Namecheap as well. Domain privacy protection is a feature that Namecheap provides for all valid domains. Its included by default at no extra cost. The poster didn't indicate if they had this feature enabled or not for the domain. It would have prevented the college club person from even seeing their email address to initiate a password reset. This clearly isn't an answer for NC…

https://bsky.app/profile/neocities.org/post/3mnkqgxostk2k - This is recent and inexcusable sloppy work for a domain registrar. Private equity explains it if they're cutting and offshoring operations. Even if they hadn't been acquired by PE, it is still inexcusable. They didn't even bother to respond publicly to explain how it happened and that they're course correcting.

Re: Tell HN: Namecheap gave my account to an unverified third party

#153

Post by system2 »

assimpleaspossi wrote: post #128
slig wrote: post #125

Earlier quoted context omitted.

I believe you did not see this https://news.ycombinator.com/item?id=30506581

So now you need to dig into another anonymous post from over four years ago with no details of what happened?

I moved many domains to Cloudflare because of savings. I am just concerned about the good domains I really care about. And I was thinking about it recently. I really want to have an American company on American soil.

Re: Tell HN: Namecheap gave my account to an unverified third party

#154

Post by preg_match »

dalmo3 wrote: post #8

I've had the exact same issue with a small local registrar. Had an account where I managed multiple clients. One of the clients had their "IT guy" contact the registrar for a DNS change. The registrar promptly gave the guy full access to my account, changing the password and locking me out in the process. As soon as I regained access I moved everything off there.

This is basically sim swaps attacks or number porting attacks but for domains.

If the telecos can figure it out, anyone can. Yes it took them way too long, but those attack vectors are essentially dead now.

Re: Tell HN: Namecheap gave my account to an unverified third party

#155

Post by preg_match »

paxys wrote: post #24

People are (rightfully) concerned about superintelligent AI but social engineering continues to be by far the biggest attack vector for digital infrastructure. And it’s being made worse by companies continuously cutting costs in areas like support. The call center employee making third world minimum wage doesn’t give a shit who the real owner of the domain is. They want to end the call quickly and get 5 stars from th…

Social engineering attacks can be thwarted by technical measures.

For example, try to social engineer a sim swap attack or number port attack with sim lock and port lock turned on. Won’t work. These attacks were super common just 5 years ago, now they’re effectively dead in the US.

You have to technically make sure the customer service people can’t break security. If you give them the keys, you’re cooked. So put the keys in a vault and then cover the vault in spikes and a 5 day timer.

Re: Tell HN: Namecheap gave my account to an unverified third party

#156

Post by joecool1029 »

joshuamcginnis wrote: post #41
terribleperson wrote: post #27

Earlier quoted context omitted.

...seriously? Where do I jump ship to now?

I like https://www.dynadot.com/ . Good prices and privately owned for 30+ years.

Been moving all my domains to them for a couple years now. Happy so far with them and they handle some of the harder tld’s to find a registrar for.

Re: Tell HN: Namecheap gave my account to an unverified third party

#157

Post by ethin »

mook wrote: post #66
ethin wrote: post #38

Earlier quoted context omitted.

Honestly I'm wayyy more concerned with social engineering attacks than some theoretically superintelligent AI. Social engineering is, IMO, the far worse of the too

Isn't prompt injection basically social engineering for LLMs already anyway?

Pretty much. Which is why I'm far more concerned about that. So many of the AI doomers are terrified of some super-intelligent autonomous AI doing something on it's own that wipes us out (and, mind you, they have no evidence that any super-intelligent AI would actually do that, other than si-fi, but that's a different topic). But there's nothing stopping us from doing something stupid like developing some super-intelligent AI that has yet to not have any reason to disobey the "help the user" and is subsequently socially engineered to do something horrible that ends up destroying a nation for example.

Re: Tell HN: Namecheap gave my account to an unverified third party

#158

Post by jurgenburgen »

jasongill wrote: post #122
duskwuff wrote: post #107

Earlier quoted context omitted.

> Cloudflare, for example, removed the ability to change the nameservers for all domains registered with them. Cloudflare never offered that ability. From the time they started offering domain registrations, it was always with the caveat that the nameservers would be fixed to Cloudflare's.

Correct, I guess I should have clarified that I mean they removed the ability that most registrars have, in an attempt to make domains into a revenue driver for their primary product.

Remove implies they previously offered it. I would say they just offer a more opinionated product.

Re: Tell HN: Namecheap gave my account to an unverified third party

#159

Post by Cider9986 »

richardchilders wrote: post #37

Namecheap forces users to log in to identify themselves. So far, OK. But then when one attempts to pay for a domain, after one has already provided all of one's credit card information to Namecheap ... Namecheap up and refers its customers to something called Link, which forces Namecheap's customers to create an account and become Link's customers - providing all that confidential credit card information, all over -…

Plenty of services to buy domains with Monero because traditional finance online is a surveillance hellscape.
Post reply on HN