News for hackers. Stuff that matters.

A comment on Namecheap live chat social engineering leads to loss of 2 VPS. Parent comment

Re:Namecheap live chat social engineering leads to loss of 2... by chinathrow on Tuesday April 12, 2016 @10:51AM (#11480045)
3. Established procedure was not followed

Wouldn't it make sense that support staff can only generate and send out password reset mails if the PIN/password has been entered into a form? I don't know the term for this - like "coded procedure".

In this case, the support staff wouldn't even needed to be trusted in the first case.

[ Parent | on HN ]
Re:Namecheap live chat social engineering leads to loss of 2... by vblord on Tuesday April 12, 2016 @11:25AM (#11480366)
This is a great point. The software should be modified to not allow the employee to even make any modifications to the account without the correct credentials.
[ Parent | on HN ]
Re:Namecheap live chat social engineering leads to loss of 2... by matthewdrussell on Tuesday April 12, 2016 @12:56PM (#11481240)
Agreed, and we're looking to improve this area too.
[ Parent | on HN ]