Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My website was stolen by a hacker and I got it back

ramshackleglam.com

Post reply on HN
Print view View original

151–159 of 159 posts

Re: My website was stolen by a hacker and I got it back

#151

Post by soulshake »

WickyNilliams wrote: post #136
soulshake wrote: post #127

Earlier quoted context omitted.

This is really good advice. Some additional things that come to mind regarding domains: - enable 2-factor authentication/IP-based login restriction, - disable password reset via email, - provide valid registrant data, in case you ever have to prove your identity - for the extra cautious, contact the provider and ask them to add a note to your file to be extra wary of any requests.

Hey, I'm with Gandi and only after this thread did I realise you offered 2FA. I would have enabled much sooner had a i known it was available. I know you guys don't often send out emails (and I really appreciate that), but perhaps a mail shot letting people know it's an option would be worthwhile. For security stuff I'm happy to receive unsolicited emails

Hmm, that's a good idea. I'll see what we can do. Thanks :)

Re: My website was stolen by a hacker and I got it back

#152

Post by lutusp »

mannykannot wrote: post #121
lutusp wrote: post #34

The most unfortunate part of this story is that the site owner had to use underhanded tactics of her own to regain control of her site. She didn't get her site back by going through formal legal channels, she got it back by using tactics similar to those used by the criminal she was dealing with. Different intent and legal standing, but same methods. It would be interesting to know what would have happened if she had…

That's a more unfortunate part of the story than the registrars' inaction? Or the theft itself? I don't think so.

> That's a more unfortunate part of the story than the registrars' inaction?

Okay, fair enough, I'll give that fact a close second in the rankings. But to me, the fact that she had to descend to the level of the criminals she was dealing with, had to do things that under slightly different circumstances would have made her a criminal, is the most discouraging part of the account.

Re: My website was stolen by a hacker and I got it back

#153

Post by heypete »

ezequiel-garzon wrote: post #85
zimbatm wrote: post #35

Earlier quoted context omitted.

http://gandi.net - I have never had my domain stolen but in general Gandi.net are good people and they care about their customers.

One aspect I found puzzling about Gandi is that until recently they published your "handle" in the WHOIS information, which in effect gave away your username. Now, some may tell me hiding that is security through obscurity or some such, but in my mind it adds another protection layer.

I seem to remember that being the case with Network Solutions back in the early days.

Gandi seems to hide your handle these days for certain domains if you have whois privacy enabled: my .com/.net names with Gandi don't show the handle, but my .org domains do. My .us domains (which don't allow whois privacy) also show the handle.

Then again, one can easily enable two-factor authentication and it's essentially irrelevant if the handle is known.

Re: My website was stolen by a hacker and I got it back

#154

Post by heypete »

jellicle wrote: post #45
zimbatm wrote: post #35

Earlier quoted context omitted.

http://gandi.net - I have never had my domain stolen but in general Gandi.net are good people and they care about their customers.

I lost a domain because Gandi refused to do anything about it; although I was well within the renewal period and tried to contact them many times Gandi refused to process any sort of renewal until it expired and was deleted by their system. Gandi ONLY accepts support requests through their web form (no email, no phone), and generally ignores those or provides nonsense answers several days later. As long as you never…

While I doubt neither the veracity of your claim nor your reaction to Gandi's actions (if such a situation happened to me, I would certainly not want to give a company my business going forward), I have had a very different experience with them: all of my queries to Gandi support have received prompt, relevant replies that addressed my issue.

Also, ny domain registered with Gandi can be renewed by any Gandi handle. In the event that you're having trouble accessing the handle that owns a domain or otherwise cannot renew it normally, you can create a new handle and use that to renew the domain. See https://wiki.gandi.net/en/domains/renew and https://www.gandi.net/domain/renew?lang=en for details.

I'm not sure if their "any handle can renew any domain" policy/system existed at the time of your situation, but it should prevent similar issues from occurring today.

Re: My website was stolen by a hacker and I got it back

#155

Post by nick_14 »

epsylon wrote: post #145
jacquesm wrote: post #140

Earlier quoted context omitted.

It's an escrow service, not a wiretransfer company. The bit that I don't get is that escrow.com (the one party that didn't actually do anything wrong here) now has acted in a way which they probably should not have done, from their point of view the transaction actually is legit (buyer has control of the domain name, so funds should be released). If Escrow.com can't be trusted to release the funds when the recipient…

That's what surprised me as well, but maybe the FBI intervening in the case was what pushed them to not honor the wire transfer.

I use Escrow.com a lot as a domainer, so I was initially concerned that a hold could be placed on the wire transfer after receiving the domain. The whole point of Escrow.com is that you are not able to cancel wire transfers and run away with my domain. However, it looks like they were operating under special circumstances due to the FBI investigation. Brandon Abbey is the president of Escrow.com and said “Escrow.com is holding the funds based on the proper legal authorities filing the necessary paperwork with the judicial system. We strictly follow the Escrow Law. That is what licensed escrow companies do.” Looks like it was just not explained correctly in the initial article.

Re: My website was stolen by a hacker and I got it back

#156

Post by harvestmoon »

rwallace wrote: post #77
harvestmoon wrote: post #58

The author did not mention that you can pay extra money to lock down a domain. If it is locked down, it can not be transferred without, iirc, a picture of your driver's license or something like that. There may also be time delays. For my valuable sites, I pay for this service.

That sounds like a good idea. How do you do it?

Quote from GoDaddy:

Go Daddy offers Protected Registration, which prevents a domain name from being transferred to another registrar. The product includes our privacy service, as well as a Deadbolt lock.

Our Deadbolt lock means that in order to cancel the service, you must show documented proof of your identification, which makes the lock more robust than a standard registrar lock. This may seem “cumbersome,” but that is the point; if the domain name is valuable to you, you would be well-served to use product that safeguards against making it easy for a hijacker to gain access.

Re: My website was stolen by a hacker and I got it back

#157

Post by dbbolton »

danielbarla wrote: post #125
dbbolton wrote: post #105

Earlier quoted context omitted.

The xkcd-style passwords may be less vulnerable to a brute-force attack, but they are more vulnerable to a dictionary attack. There are (very) roughly 2^17 words in the dictionary, so if you pick 4 there are 2^68 possibilities, or 2.95e20. There are 94 printable characters on a US keyboard. This means that an 11-character "hard to remember" password has over 16 times as many (~2^72, 5.06e21) combinations as a four-wo…

The issue with the numbers you give is that nobody really has an 11 character password compatible with it. The reality is that people have trouble remembering 11 truly random and unrelated things, so they try to simplify and group things - e.g. by taking a base word and changing the spelling, or adding numbers on. This is what leads to the easy to brute force passwords; the cracking techniques now cater for the most…

I think you're missing the point. I'm not arguing that passwords like "H$&v46S13^a" are actually better in practice than passwords like "TheCowSaysMoo". I'm providing one specific case where they are superior in terms of difficulty, i.e. the unlikely event of a directed dictionary attack, and a rough comparison of the level of security in that case as compared to a brute force attempt.

As far as "true randomness", it's irrelevant here since we are only counting permutations, meaning "Hello,2048" is just as difficult as "^6H9Ox#g`!" (i.e. their length and superset are both equivalent).

Re: My website was stolen by a hacker and I got it back

#158

Post by dbbolton »

Perdition wrote: post #111
dbbolton wrote: post #105

Earlier quoted context omitted.

The xkcd-style passwords may be less vulnerable to a brute-force attack, but they are more vulnerable to a dictionary attack. There are (very) roughly 2^17 words in the dictionary, so if you pick 4 there are 2^68 possibilities, or 2.95e20. There are 94 printable characters on a US keyboard. This means that an 11-character "hard to remember" password has over 16 times as many (~2^72, 5.06e21) combinations as a four-wo…

The issue with "random" passwords is trying to remember them. XKCD-style isn't perfect, but it is loads better than "Password91" and "Dragon" style passwords which are what most people actually use.

As I already said, I am not arguing that "random" passwords are better in practice.

Also, a password that uses a very large character space does not have to be random at all.

Re: My website was stolen by a hacker and I got it back

#159

Post by danielbarla »

dbbolton wrote: post #157
danielbarla wrote: post #125

Earlier quoted context omitted.

The issue with the numbers you give is that nobody really has an 11 character password compatible with it. The reality is that people have trouble remembering 11 truly random and unrelated things, so they try to simplify and group things - e.g. by taking a base word and changing the spelling, or adding numbers on. This is what leads to the easy to brute force passwords; the cracking techniques now cater for the most…

I think you're missing the point. I'm not arguing that passwords like "H$&v46S13^a" are actually better in practice than passwords like "TheCowSaysMoo". I'm providing one specific case where they are superior in terms of difficulty, i.e. the unlikely event of a directed dictionary attack, and a rough comparison of the level of security in that case as compared to a brute force attempt. As far as "true randomness", it…

I think we're mostly on the same page, but still talking past each other. In my opinion, the only _reasonable_ way to compare the two password styles is in a practical way, taking into consideration human memory limitations. In that sense, the equivalent to an 11 character "random character" password is NOT an 11 character sentence. It would be more like a 5 or 6 word sentence due to the way your brain works. When you compare these, the pass phrases do win out, even for directed dictionary attacks.

Essentially, what I'm saying is that your brain seems to have better memory (or compression?) for sentences than random character jumbles, allowing you to use longer / stronger ones. Even when you consider dictionary attacks. Again, the original XKCD article is fairly objective and accurate; what's shown there IS a dictionary attack.

Post reply on HN