Namecheap vulnerability they refuse to fix: no 2FA on support portal login

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by Lucent on Sunday August 28, 2022 @01:09AM (#32625946)

I once had a domain at Namecheap show "Ownership change pending approval" to another username with a cancel link beside it and I recognized the username as someone who made offers before out of band. Never got an email or saw any kind of notification, and I've been in the game 25 years and know those extremely long domain transfer emails and read them carefully. Started transferring domains away after that.

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by noname120 on Sunday August 28, 2022 @04:10AM (#32626649)

What alternative host would you recommend?

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by formerly_proven on Sunday August 28, 2022 @05:15AM (#32626910)

I can heartily recommend https://inwx.com - they have exceptionally good support.

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by fdcba on Sunday August 28, 2022 @06:29AM (#32627219)

Just signed up to say this, but I like https://www.zone.ee/en/

They aren't huge but they have operated for a few decades now. Nice customer support, 2FA, DNS API and DNSSEC.

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by sunaurus on Sunday August 28, 2022 @06:55AM (#32627349)

I've had a horrible experience with zone.ee (aka zone.eu) and will always caution clients against using them.

I had a client with a domain and some VPS hosted in zone.ee, and one day out of the blue with no prior communication, the client received a notice from a zone.ee employee that they had disabled a production service on a VPS, because apparently the Docker configuration of that service was causing some issues in their infrastructure, which was already quite strange.

The real scary part was that the they didn't just turn off the VPS - the employee had actually backdoored into the running VPS and had manually disabled docker.service. The fact that they would do this without any communication beforehand just left me stunned and we immediately migrated away from zone.ee after that.

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by fdcba on Sunday August 28, 2022 @07:07AM (#32627407)

That sounds unfortunate. I imagine it must've been time-critical, some side-effect of Docker being virtualised? I'd guess the hands-on approach was to avoid a full service disruption that a full shutdown would've caused.

That aside, shielded VM's are very rare, most providers have the ability to see inside VM's, issue commands in them.

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by homero on Sunday August 28, 2022 @04:17AM (#32626686)

Porkbun and Cloudflare are the best and cheap

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by LilBytes on Sunday August 28, 2022 @06:35AM (#32627252)

CloudFlare unfortunately still have a very limited subset of TLDs available.

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by mkl on Sunday August 28, 2022 @05:57AM (#32627085)

What's Porkbun's support like?

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by dsissitka on Sunday August 28, 2022 @06:37AM (#32627260)

I contacted them once before moving over and once after and they were good to me. I'm happy with them for domains but I wouldn't recommend them for email.

[ Parent | on HN ]

Re:Namecheap vulnerability they refuse to fix: no 2FA on sup... by sammax on Monday August 29, 2022 @01:06PM (#32640649)

I’m quite happy with Glauca [1], they’re not quite as cheap but their DNS stuff is pretty good and they are friendly and helpful. Only downside is their website being a bit slow sometimes.

[1] https://glauca.digital

[ Parent | on HN ]