4 ms·
The most significant security problem with Namecheap is really this: It only takes a 4 digit PIN to perform any action on an account through live chat (which se
by tshtf 10y ago
The most significant security problem with Namecheap is really this: It only takes a 4 digit PIN to perform any action on an account through live chat (which seems to be outsorced to Eastern Europe), even if the account is protected with a 2FA... All you need is the PIN, and an attacker can do anything to the account.
Sometimes you get what you pay for.
- castis 10y agoIf I wanted more security on my account, is there a different service I should be using?
- boredpudding 10y agoAmazon Web Services is great, and as far as I experienced, their support knows more than average.
- infinite8s 10y agoYou can get AWS customer support to reset your password if you know the last 4 digits of the credit card used to pay for the account. This is the same info that's printed on any credit card receipt.
- nommm-nommm 10y agoIf they have your bank account number for whatever reason you can also use last 4 of the bank account number. Your bank account number is not secret by design and most people only have one.
- infinite8s 10y agoNot only is it not secret, it's printed on every single check for that account.
- dorfsmay 10y agoI once lost my gandi.net password. It took sending copies of 2 photo id, and answering the phone listed in the who is database before they reset it. I just wish that their DNS updates were push through faster.
- ryanlol 10y agoThat's not good verification. It takes a couple of minutes to produce convincing fake ID scans, and they aren't going to have anything to verify them against. And presumably they wanted you to send those photos to them as an unencrypted email attachment, right?
- celticninja 10y agoits better verification than most will require.
- ryanl0l 10y agoMost will require a password reset email, I'd say that's significantly better than asking for ID scans. Edit: Since I'm getting some downvotes I'd really like to know how one could possibly argue that asking for ID scans is better than email resets. You can't really forge the ability to receive email at an address, but you can very easily replace the name on an ID scan.
- celticninja 10y agoDid you read the article? I ask because one of the problems was a compromised email account.
- ryanlol 10y agoI did. It doesn't change anything, email is still a way better verification method than ID scans that the company will be unable to authenticate.
- matthewdrussell 10y agoUse 2FA on your Email Accounts Use 2FA on your Namecheap account Maintain a sensible backup policy Store your passwords in something secure like KeePass
- roywiggins 10y agoNearlyFreeSpeech seems pretty serious about this sort of thing: https://www.nearlyfreespeech.net/about/faq#LostEverything https://www.nearlyfreespeech.net/about/faq#LostEverything
- mholt 10y ago> Sometimes you get what you pay for. So what expensive provider do you recommend instead?
- simonsarris 10y agohttps://www.gandi.net/ https://www.gandi.net/
- ryanlol 10y agoThey're cool until they start holding your domains hostage and demanding that you email them a scan of your passport.
- ProAm 10y ago> email them a scan of your passport What? Why do they do this?
- smarx007 10y agoApparently, OP wanted to transfer the domain from Gandi.
- Spoom 10y agoFWIW I painlessly transferred five domains away from Gandi (ironically, to Namecheap), and I was never prompted for anything like a scan of my passport.
- pmlnr 10y agoSome country tlds require copies of legal documents.
- ryanlol 10y agoIn my case there was absolutely no legitimate reason for them to request that. And no, it wasn't related to registry rules or transfers as other users have suggested.
- deleted 10y ago[deleted]