21–30 of 426 posts
1. The credentials were resent to an already compromised email account
2. This is an isolated case
3. Established procedure was not followed
4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved
5. Anyone with any self-managed server with ANY provider should always keep their own multiple backups
The most significant security problem with Namecheap is really this: It only takes a 4 digit PIN to perform any action on an account through live chat (which seems to be outsorced to Eastern Europe), even if the account is protected with a 2FA... All you need is the PIN, and an attacker can do anything to the account. Sometimes you get what you pay for.
> Sometimes you get what you pay for. So what expensive provider do you recommend instead?
I'd love to have an option on services where I define a X-hour wait period for manual password resets. That is, "oh, I've lost my email account and I need to reset a password so I have to access my account through pleading over Live Chat... they can do that but there's an X-hour wait period before you will gain access to the account."
$CUSTOMER calls in, their nameservers are down and nobody has the account password. Do you think the management at $CUSTOMER is going to accept "hey we need to wait 6 hours to get our site back up because namecheap wont allow us in"?
You could have just as easily lost all the data in an accidental way, with no malice or 3rd party involved.
That said, I do empathize, and it's disappointing that a major player like namecheap would be so easily socially engineered.
Disclaimer: I'm CIO @ Namecheap 1. The credentials were resent to an already compromised email account 2. This is an isolated case 3. Established procedure was not followed 4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved 5. Anyone with any self-managed server with ANY provider should always keep their own multiple backups
Why have a procedure if your support doesn't follow it? Even if you have a procedure, everything falls apart when it isn't followed. This is the same as having no procedure at all.
Earlier quoted context omitted.
If I wanted more security on my account, is there a different service I should be using?
I once lost my gandi.net password. It took sending copies of 2 photo id, and answering the phone listed in the who is database before they reset it. I just wish that their DNS updates were push through faster.
And presumably they wanted you to send those photos to them as an unencrypted email attachment, right?
That's bad, really bad. No 2auth can save you from humans who do support. I also had one of my VPS attacked recently, and I feel for you. But the name namecheap says "cheap". Maybe they are indeed cheap? I'm not sure the same would have happened with say HE. You pay, but you know what you pay for and get in return. Personally, I am thinking about moving from a "manually setup" distribution to a "no ssh but deploy", s…
Well, conceivably the second factor could be used to generate crypto key material which is used to decrypt/unlock one's record, so without the second factor even support couldn't read & edit one's record.
Nothing can stop support from deleting & recreating a record though.
Disclaimer: I'm CIO @ Namecheap 1. The credentials were resent to an already compromised email account 2. This is an isolated case 3. Established procedure was not followed 4. With thissaid, we've used this as a learning example and additional training has been provided to the individual involved 5. Anyone with any self-managed server with ANY provider should always keep their own multiple backups
> Established procedure was not followed Why have a procedure if your support doesn't follow it? Even if you have a procedure, everything falls apart when it isn't followed. This is the same as having no procedure at all.