I switched to Namecheap based on recommendations here, and their previous stance on certain privacy issues, but I'm running out of alternatives.
Example weird feature: all domains are shown, even ones that you've let expire/sold years ago, and there is no way to hide them.
[1] https://community.namecheap.com/forums/viewtopic.php?f=10&t=...
[2] https://community.namecheap.com/forums/viewtopic.php?f=10&t=...
[3] https://community.namecheap.com/forums/viewtopic.php?f=10&t=...
[4] https://community.namecheap.com/forums/viewtopic.php?f=10&t=...
TL;DR: Credit card was stolen, Namecheap penalized me for that and then blackmailed by locking all domains.
This isn't about blackmail as jewsin writes in the comments, it's about the reputation a business suffers with a chargeback. All you would need to do is reverse the chargeback and the full charge would go away.
Disclosure: I work for Namecheap.
Still, I think my original points stand. I find Namecheap locking out unrelated domains and redirecting traffic unethical and in bad faith of the service provider / customer relationship. Not to mention that the domains continued to point to parking pages even after I paid up.
I'm sorry as well for the parking page situation - my guess is it didn't immediately propagate, but I'd have to investigate further as to why that happened. Usually, it's not about redirecting traffic but just not letting you get into your account. This does not sound like it should have happened at all. I sincerely apologize that this is what you encountered.
p.s. I love how trying to genuinely be helpful has resulted in an onslaught of downvotes. I'm going to assume you helped balance that out with an upvote. So thanks :)
I wish people wouldn't do that. It does appear that Namecheap has behaved very poorly in this case, intentionally or otherwise. Sadly, downvoting a person who works for an organisation has become a proxy for downvoting the organisation itself on HN recently, which doesn't seem constructive, particularly if that person is trying to share relevant information and/or improve the situation.
Sent my ticket number via the contact form on the website from your profile. I see that you spearheaded the SOPA membership surge - it's what got me to join in the first place.
Please write a blog post about this.
Also, $240 because of one chargeback, and doing the above while the customer is trying to sort out a fraud issue? Neither of those sounds like normal practice for a responsible domain registrar either.
Obviously there are two sides to every story and we're only seeing one here, but that one does look pretty bad for Namecheap.
I must say that I have never verified this myself, mostly because I've never needed it that bad. At least something worth looking into if that problem arises.
(Can actually confirm that from this month's experience, so it's even freshly verified :)
(Full disclosure: I work at Namecheap)
They're a bit more expensive when it comes to domains but we're talking single dollars a year here.
Many pluses: predictable, can be administered using the AWS CLI, consolidated billing with other AWS services. Heck, can even register domains from the CLI.
Only downside as others have pointed out is that Gandi doesn't make it at all easy to hide your name or company contact information.
So you are recommending someone switch over privacy concerns from namecheap to Amazon in story about how Amazon is leaking private Customer data.....
Really...
Also, the issue with all domains being shown is a bug. If you have a ticket number regarding this, please let me know and I'll investigate this further because it should be resolved.
But their "redesign" and presumably the backend changes tied to it (or lack of them, whatever the real case is) resulted in the worst experience I've ever had with this kind of service in years, culminating in what was the last straw - one of my domains getting shut down five times in a single month due to bogus "domain contacts verification" procedures, which their support wasn't able to solve from early December to when I finally decided to move away in mid-January (from a short exchange after I moved away I assume it's still broken today as they were apparently "investigating it" even after I was gone. That after having it in some or some other way "fixed" for about three times during the previous support exchanges.) Honestly though during that time my tickets mostly kept bouncing back and forth through customer reps that insisted on politely suggesting things like "to check my spam folder", even though I specifically explained every time that I was in full control of my mail servers and that it is them who don't deliver any kind of verification emails to those servers, so there was really nothing that could even end up in "a spam folder" and that yes, I actually thoroughly checked that, several times over. Yet my requests for them to check their own mail logs because I'm here actually losing access to my domains without being able to do anything about it were each time politely swept under the rug with generic assurances like "they're working on it and will keep me informed"... Then quickly closed the ticket as fixed. Every time after the one particular domain went dark (and with another domain randomly flipping into bogus unverified states in the frontend interface, clearly lingering on the edge of the same fate), the domain was reactivated either by me or the customer support, was either set to have its contacts covered by WhoisGuard (which doesn't even use the contacts verification process at all), or at a later point even manually set back to fully verified by their techs (and one time completely having all my zone data wiped without explanation or apparently without whoever caused it having a backup at hand to restore it from) - only to again and again end up suspended as "unverified" several days later, losing me access to its emails, websites, everything...
Now I could still go on and on about how clunky the entire new interface compared to the old one is (yes, the original was lackluster, but not even remotely this level bad and in fact I've never had a single technical issue with it, other than being somewhat hard to navigate) and that ever since the redesign the new frontend frequently displays outdated or plain wrong information, crashes with cryptic errors, sometimes just decides to log you out five times in five minutes for no reason, but I think this is getting too long as it is anyway, so enough.
When I finally grew tired of running through their customer support in a neverending circle (to their credit, they were always very polite and nice, but it felt like that's all that Namecheap support was really trained for. And that clearly doesn't make my domains magically work there), I moved to Gandi just basing on their overall popularity and good reputation with a few people. Already in a week time I had two great support experiences with them and got my issues resolved each time in literally a single step of exchange. In the first case I've received about a page-length of actual technical reply from their support rep that not only bothered to carefully read through several issues that I ran into when trying to run a Python app on their web hosting platform that I ordered for the domains moved there, they even included a how-to custom tailored to my specific use case that was way beyond what I originally asked for and that ended up saving me quite some time discovering it on my own, and also acknowledged that they had a major issue in their documentation system and that they had it quickly fixed in meantime. Now second time was less technical, as I accidentally burned a discount code while customizing and re-customizing some orders in what was probably an unexpected way for their interface, that ended in the code never being applied to any order but still ended up as used and lost... I wrote down the problem in a few sentences, customer support quickly verified it and issued me a new replacement code right with the initial reply in what had to be less than an hour. Can't really say I'll be missing Namecheap any time soon.
I have used them since they opened (2002) and never used anybody else after that, because I have never been dissatisfied. (I don't remember if the box is checked by default, but they definitely offer whois privacy, along with services like custom/dynamic DNS and some other stuff, at no extra charge).
Their site is kinda barebones and old-school, but there are real humans in the rare case you actually need one, and they've never done me wrong.
So for whatever that's worth: another recommendation on HN.
They have a very strong privacy stance and take security seriously
And relying on what looks like secret data (changing the SSH port) where the number of bits of entropy is low enough that it's plausible to try them all (16) probably still counts as security by obscurity -- it might hide you from many attackers, but it's not enough to make you secure.
Relying on data that's not actually secret, just hard to find, is just insecure.
That's not why you change the ssh port at all.
You change the ssh port to filter out false positives, if someone is attacking you on your weirdo ssh port, it's likely an actual attack that you need to pay attention to. You still need to do the rest of the security stuff.
When your SSH port is something like 53148 and you see password brute-force activity in logs it's almost always mean that somebody intentionally scanning your server.
https://www.shodan.io/report/uMZDnWfT
This is a long-running problem and one with various popular solutions: restrict the source networks which you accept traffic for, disable password authentication entirely, and add some sort of rate limiting (e.g. 2004's fail2ban) for failures. Trying to reduce log volume by obscurity is futile - you really need to address the root problem and use tools which allow you to filter and aggregate effectively.
Do you actually have untrusted users on the box?
Why would you not secure the custom port to root-only?
If you click-through the checkout with the 'Confirm Order' button at the top right away you can miss that detail - as I have twice.
One of the reasons I switched to Namecheap in the first place is because they were a registrar that didn't rely on bundling tricks. I'm considering moving all of my domains away.
I registered a new domain with Namecheap just last Thursday and it had whoisguard automatically turned on.
I've recently purchased a domain from namecheap, with whoisguard, and if I recall correctly I didn't have to turn it on. I whois'd myself and found that it didn't leak anything. It didn't occur to me that scrapers can get at the info before you protect it.
Perhaps this has changed since your experience? Please could anybody else verify one way or another?
Cheers
Now, when you register a domain it tells you free Whoisguard is included, but it doesn't make it clear that it's disabled by default."
Previously it just worked. Now you have to check another box to turn it on.
This change makes no sense to me. (If you want free Whoisguard, why would you not want it turned on?)
I was white-hot furious* when I discovered that a handful of new domain regs had leaked my contact details, and I began getting the inevitable spam calls and texts.