Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My website was stolen by a hacker and I got it back

ramshackleglam.com

Post reply on HN
Print view View original

51–60 of 159 posts

Re: My website was stolen by a hacker and I got it back

#51

Post by the_ancient »

poopsintub wrote: post #29
noonespecial wrote: post #27

I feel for her but I do need to point out that some of the suggestions she makes for making it easier to get her stolen domain back would also make it easier for bad actors to cause mischief in the first place. But GoDaddy sucks. True dat.

GoDaddy has two-step authentication. If you make any type of money off of a website or other account, you should use two-factor authentication. Facebook, email, and godaddy would be a decent start. A similar incident occurred when the man lost his $50k? twitter account because he didn't use two-factor anywhere.

Godaddy also has proven their Phone Support personell are easy victims to social hacking, which negates any electronic security. If I can call up godaddy and have them change account details or the mobile number on the 2 factor settings then your 2 factor security is pointless.

GoDaddy may have great electronic protections, but I do not trust their phone support personnel at all

Re: My website was stolen by a hacker and I got it back

#52

Post by the_ancient »

r1ch wrote: post #24
potench wrote: post #21

Earlier quoted context omitted.

Curious why this is being down voted? Is it because namecheap does not offer 2FA? Seems to simply be answering the question above.

For me, their 2FA is essentially unusable. It uses a UK SMS gateway (no Authy / Google Authenticator support) and out of the 20 or so times I've tried to set it up, only once has the code actually come through to my phone. I've had an open support ticket for 6 months, 3 months since the last reply.

NameSilo supports both Authy and Google Authenticator

Re: My website was stolen by a hacker and I got it back

#53

Post by eli »

astrodust wrote: post #13
thejosh wrote: post #10

So apart from the 4 pretty much "how not to happen", try using a host that supports 2FA.

Got a list? It seems like every day GoDaddy is leaking domains. I've been using Hover a lot, but I'm not sure what their exposure is like.

GoDaddy was the recipient registrar of the stolen domain, not the one who allowed it to be stolen.

Re: My website was stolen by a hacker and I got it back

#54

Post by zacinbusiness »

I am absolutely shocked at how simple it is for this sort of fraud to take place. If someone calls GoDaddy, for instance, and says "Hi, I'd like to transfer a domain name. Here's all of my proof that I am who I say that I am." I understand that GoDaddy, ever dutifully obliged to their customers, will transfer the domain with haste. However, should there not be some sort of probationary period? 45 days or so where both GoDaddy and the new "owner" of the domain both have full, master control? It seems to me that an account manager in GoDaddy could handle this task easily enough. Simply coordinate with the new owner, notify that there's a dispute, and lock everything down until a resolution has been completed. Am I missing something here or are these companies simply lazy and unmotivated?

Re: My website was stolen by a hacker and I got it back

#55

Post by soulshake »

jellicle wrote: post #45
zimbatm wrote: post #35

Earlier quoted context omitted.

http://gandi.net - I have never had my domain stolen but in general Gandi.net are good people and they care about their customers.

I lost a domain because Gandi refused to do anything about it; although I was well within the renewal period and tried to contact them many times Gandi refused to process any sort of renewal until it expired and was deleted by their system. Gandi ONLY accepts support requests through their web form (no email, no phone), and generally ignores those or provides nonsense answers several days later. As long as you never…

@jellicle, that doesn't sound like us. Can I look into your case further? If we messed up, we'll make it right.

Re: My website was stolen by a hacker and I got it back

#56

Post by chomp »

shiftpgdn wrote: post #14
chomp wrote: post #8

Earlier quoted context omitted.

"I remembered the notification from YouTube that someone had accessed my account from a different location – a notification I had ignored, assuming that I had logged in on a mobile device or that my husband had accidentally logged into my account instead of his own." All of her accounts were compromised - seems more likely to be malware than social engineering. Also the hosts you mentioned use in-house support.

Actually many of their support staff are outsourced through GlowTouch which is an Indian based support firm. It's in the EIGI S1 filing here: http://secfilings.nasdaq.com/filingFrameset.asp?FileName=000...

Yeah, they are in charge of Hostgator India. They have no reach into the US based brands.

Source: I work at one of the aforementioned brands.

Re: My website was stolen by a hacker and I got it back

#57

Post by jypepin »

mcherm wrote: post #2

I am curious: does anyone here on HN have a registrar to recommend who they know (preferably from experience) would actually be more helpful in this circumstance? Because from the sound of it, the unwillingness of the registrars (both of them) to take action here without being compelled to by a lawsuit is the root of the problem. The FBI's willingness to be helpful is nice, but doesn't solve the root problem, and as…

I use iwantmyname.com and their service is amazingly good and fast. I never got my domain name stolen, but I'm confident they would do anything they could for me to recover it!

Re: My website was stolen by a hacker and I got it back

#58

Post by harvestmoon »

The author did not mention that you can pay extra money to lock down a domain.

If it is locked down, it can not be transferred without, iirc, a picture of your driver's license or something like that. There may also be time delays. For my valuable sites, I pay for this service.

Re: My website was stolen by a hacker and I got it back

#59

Post by ShaneOG »

jstalin wrote: post #41

I don't see how much she paid to get it back. A civil suit filing with a demand for a temporary restraining order and preliminary injunction could be filed in a few hours and since godaddy and hostmonster are US companies, they would have had to comply. She'd have her domain back in a matter of hours for maybe a couple grand.

She didn't pay anything. She stopped/cancelled the wire transfer

Re: My website was stolen by a hacker and I got it back

#60

Post by euphemize »

> 1. Have a really, really good password, and change it often. Your password should not contain “real” words (and definitely not more than one real word in immediate proximity, like “whitecat” or “angrybird”), and should contain capital letters, numbers and symbols. The best passwords of all look like total nonsense.

http://xkcd.com/936/

But really, I'm a bit puzzled by her 5 "recommendations". Turn off your devices while you're not using them? I feel like the most important one is missing - don't use HostMonster or Godaddy, their representatives are not paid enough to care about the implications of you losing your domain name.

Post reply on HN