Namecheap live chat social engineering leads to loss of 2 VPS

Post by coalescence » Tue, Apr 12, 2016, 10:00 PM UTC

drostie wrote: post #162

coalescence wrote: post #127

Earlier quoted context omitted.

Low end hosting doesn't generally have backups, because it's well, cheap. Extra overheads make the price increase, then you're not cheap and can't compete at that end. Usually there are backup options included in the plan for upsell possibilities with these kinds of providers. Really, you should not expect a service that has 'cheap' in the name to offer any kind of backup.

Furthermore, is Namecheap authorized to copy their clients' data by their terms of service? If not, automatic backups may bypass totally-reasonable expectations that other users have. Backups can potentially be a threat vector, for example. There might be many reasons why one of Namecheap's clients might say "you copied this data?! and now I have no control of the environment the backup lives in?!"... An example woul…

Post by kbenson » Tue, Apr 12, 2016, 10:04 PM UTC

raverbashing wrote: post #343

uxp wrote: post #319

Earlier quoted context omitted.

I've just started filling them with randomly generated strings that my password manager helpfully creates for me. Though, apparently my bank uses those answers for phone verification also, which makes answering questions like "What's your Significant Other's nickname?" awkward when the answer is "F9-#g7a2<qj"

Use a random but user friendly value #$%&+@ is going to be hard to type or speak, just say their nickname is "the frozen one", same entropy, easier to handle

Post by [deleted] » Tue, Apr 12, 2016, 10:09 PM UTC

tamar wrote: post #338

kelukelugames wrote: post #331

Earlier quoted context omitted.

It's a common practice. I don't see how it is personally offensive to you. My description was for the CIO and execs in general, yet you insisted they were for you. So maybe you should stop making tongue-in-cheek comments. In fact, I am moving my domains off of Namecheap because I don't think Namecheap is very good at handling customer relations, particularly on social media.

(the reply link didn't show up before, so I don't know if you saw my response posted right after this) To be fair, your third edit was only for me. And that was the only comment I was replying to. As I said, we are working to respond to hundreds of comments across dozens of platforms. I certainly respect your distaste in the more rushed responses in order to address all of the deluge, and that is why we were also sim…

Post by [deleted] » Tue, Apr 12, 2016, 10:12 PM UTC

ludamad wrote: post #322

8_hours_ago wrote: post #308

Earlier quoted context omitted.

Until someone says "I know my dad was born in Minneapolis, what does it say??" and the customer service representative replies "Huh, it looks like the answer is just gibberish...", "Ah! I must have just mashed on my keyboard when I made the account, sorry about that!!", "No problem, your password is now reset to foobar".

While avoidable with training, that brings up its own issue: What if what's being asked of the people taking these calls is outside their pay range?

Post by proactivesvcs » Tue, Apr 12, 2016, 10:20 PM UTC

uxp wrote: post #319

ymse wrote: post #300

Earlier quoted context omitted.

I can't reply to the sister comment for some reason, so I'll piggyback on the parent. I always fill these with awkward or absurd questions/anwers that would be amusing if a human operator ever needs to verify them. E.g. Would you like to go on a date with me? What color pants am I wearing? What is the square root of insanity? Obviously you need to store these in a password database in order to remember them, which ki…

I've just started filling them with randomly generated strings that my password manager helpfully creates for me. Though, apparently my bank uses those answers for phone verification also, which makes answering questions like "What's your Significant Other's nickname?" awkward when the answer is "F9-#g7a2<qj"