Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My website was stolen by a hacker and I got it back

ramshackleglam.com

Post reply on HN
Print view View original

81–90 of 159 posts

Re: My website was stolen by a hacker and I got it back

#81

Post by DEinspanjer »

eli wrote: post #50
whileonebegin wrote: post #49

Isn't escrow.com supposed to prevent payments from being stopped after the domain is released? Obviously, in this case it's justified, but for regular customers, you don't want escrow releasing a domain and then the buyer stops payment.

I believe the thief demanded payment first, outside of escrow. Which seems odd considering they actually did return the name. Maybe they were afraid Escrow.com would determine the domain was stolen and simply return it to its owner?

Totally guessing, but it might be the thief was getting antsy and wanted to conclude a deal quickly. Maybe they did in fact have another buyer on the hook. Rather than spend all the extra time going through escrow and the potential risk of the buyer doing exactly what she intended to do (rely on raising the dispute of the domain after escrow had both halves of the transaction), the thief tried to pressure a quick sale through less regulated means.

From what I understand though, it isn't all that easy to actually stop a wire transfer once it is being processed. I wouldn't be at all surprised to hear that both sides might have actually gotten the money and the backing bank will be left trying to go after one or both of them for it.

Re: My website was stolen by a hacker and I got it back

#82

Post by notduncansmith »

Cenk wrote: post #9
mcherm wrote: post #2

I am curious: does anyone here on HN have a registrar to recommend who they know (preferably from experience) would actually be more helpful in this circumstance? Because from the sound of it, the unwillingness of the registrars (both of them) to take action here without being compelled to by a lawsuit is the root of the problem. The FBI's willingness to be helpful is nice, but doesn't solve the root problem, and as…

Namecheap offers two-factor-authentication.

I've used Namecheap for years and they've been great for me (never had a situation like this happen though).

Re: My website was stolen by a hacker and I got it back

#83

Post by Geekette »

shiftpgdn wrote: post #7
mcherm wrote: post #2

I am curious: does anyone here on HN have a registrar to recommend who they know (preferably from experience) would actually be more helpful in this circumstance? Because from the sound of it, the unwillingness of the registrars (both of them) to take action here without being compelled to by a lawsuit is the root of the problem. The FBI's willingness to be helpful is nice, but doesn't solve the root problem, and as…

Look at it from the GoDaddy's point of view: This woman is claiming she has rights to a domain in one of their customer's accounts. As far as they know it was legitimately transferred in by one of their paying customers. Her real issue rests with HostMonster and the ICANN dispute resolution system.

No, GoDaddy was never in doubt: "No one at either company questioned my statement (supported by written proof) that the website belonged to me. No one doubted that it had been transferred without my authority".

So GoDaddy's refusal to help was ridiculous. At the very least, they could have frozen control of the site for a day or two while investigating.

Re: My website was stolen by a hacker and I got it back

#84

Post by ezequiel-garzon »

astrodust wrote: post #13
thejosh wrote: post #10

So apart from the 4 pretty much "how not to happen", try using a host that supports 2FA.

Got a list? It seems like every day GoDaddy is leaking domains. I've been using Hover a lot, but I'm not sure what their exposure is like.

Name.com does. It uses Symantec's VIP Access app.

Re: My website was stolen by a hacker and I got it back

#85

Post by ezequiel-garzon »

zimbatm wrote: post #35
mcherm wrote: post #2

I am curious: does anyone here on HN have a registrar to recommend who they know (preferably from experience) would actually be more helpful in this circumstance? Because from the sound of it, the unwillingness of the registrars (both of them) to take action here without being compelled to by a lawsuit is the root of the problem. The FBI's willingness to be helpful is nice, but doesn't solve the root problem, and as…

http://gandi.net - I have never had my domain stolen but in general Gandi.net are good people and they care about their customers.

One aspect I found puzzling about Gandi is that until recently they published your "handle" in the WHOIS information, which in effect gave away your username. Now, some may tell me hiding that is security through obscurity or some such, but in my mind it adds another protection layer.

Re: My website was stolen by a hacker and I got it back

#86

Post by lingben »

rafaelm wrote: post #11
mcherm wrote: post #2

I am curious: does anyone here on HN have a registrar to recommend who they know (preferably from experience) would actually be more helpful in this circumstance? Because from the sound of it, the unwillingness of the registrars (both of them) to take action here without being compelled to by a lawsuit is the root of the problem. The FBI's willingness to be helpful is nice, but doesn't solve the root problem, and as…

Moniker claims that they have never lost a domain. I've got several domains (over 50) registered with them and never had a problem in almost 8 years. Many of them belonged to high traffic sites that might be desirable to thieves. I also have many with Name cheap right now and haven't had a problem them either.

moniker is not the domain registrar you want:

http://www.dnforum.com/f208/warning-privacy-whois-issues-fai...

Re: My website was stolen by a hacker and I got it back

#87

Post by TazeTSchnitzel »

lelandbatey wrote: post #64
euphemize wrote: post #60

> 1. Have a really, really good password, and change it often. Your password should not contain “real” words (and definitely not more than one real word in immediate proximity, like “whitecat” or “angrybird”), and should contain capital letters, numbers and symbols. The best passwords of all look like total nonsense. http://xkcd.com/936/ But really, I'm a bit puzzled by her 5 "recommendations". Turn off your devices…

To follow up, I will say that my favorite way to create a password is to use sayings from two or more of your favorite books or other sources. So, if you like Harry Potter and Enders Game, what are the phrases that come to mind? Harry Potter - expelliarmus Enders Game - win all the future fights Now you have a great password: "winallthefuturefightsexpelliarmus" Nice and long (33 chars), with some made up stuff. Maybe…

More modern guessing methods might try that one.

Re: My website was stolen by a hacker and I got it back

#88

Post by pkfrank »

phreanix wrote: post #32
coldcode wrote: post #23

Earlier quoted context omitted.

I use them as well and have had no issues; however just because two of us have had no issues, it's not much of a data point.

True, I'd be more interested in their actual resolution process and the steps they take to safeguard domain owners. It works both ways though I think, the same steps they take to secure your domain are the same ones that will make it hard for you to get it back.

I use Moniker as well. I pay for their "Portfolio MaxLock" (https://www.moniker.com/domainnames/domainsecurity.jsp) service. Whenever I want to make a change (even DNS), I'm forced to answer the security questions that only I would know. In order to get around that, I'd have to contact their security team directly and provide a substantial amount of identification.

Aside from the security features, Moniker's site and technology seems to be fairly unimpressive.

I'd definitely be open to exploring other options if people have suggestions for truly-safer registrars.

Re: My website was stolen by a hacker and I got it back

#89

Post by pjbrunet »

Welcome to 1999. This reminds me of when sex.com was stolen with fake stationary. I see the "unauthorized transfer" in the blog post but I wonder if she forgot to renew the domain? Happens to good people all the time. I'm not a lawyer, but in that case, unless she's incorporated as "ramshackleglam" there's no cybersquatting argument. That's why it's helpful to use your real name--then a thief has no leg to stand on.

Re: My website was stolen by a hacker and I got it back

#90

Post by shiftpgdn »

dsrguru wrote: post #74
philbarr wrote: post #42

Earlier quoted context omitted.

They only need to freeze the account if the domain was moved very recently.

This. I want to upvote this comment a hundred times. If there's a dispute with probable cause , temporarily freezing the domain while launching an immediate investigation seems by far the best balance of thwarting domain theft and minimizing fraudulent claims.

By ICANN policy domains can only be moved once every 60 days. Did you want the domain name taken offline?
Post reply on HN