7 ms·
So he is using 2FA for all the important accounts but for the most important one (the email which he used to register an account at all these services) he's usi
by willyyr 11y ago
So he is using 2FA for all the important accounts but for the most important one (the email which he used to register an account at all these services) he's using a weak pw and no 2FA? Am i missing something here? Yes they did not follow protocol but why would one not use 2FA for such an important email addy?
- arturhoo 11y agoI thought the same thing! Although he is definitely right to complain about Namecheap, the biggest takeaway is, your email is the most important service you have on the internet: > I’m pretty careful to use 2FA for any service that I consider important
- matthewdrussell 11y agoCorrect. I'm surprised no one else has mentioned no 2FA for the email. The email being compromised opened the door to this happening.
- mbrameld 11y agoThe email being compromised opened the door to his email being compromised. The door to his Namecheap account being compromised was apparently already wide open.
- levemi 11y agoNo, OP didn't have 2FA enabled on their namecheap account. It was namecheap's fault for improper handling of the social engineering attack but OP could have protected themselves by having 2FA
- cname 11y agoThe article pretty clearly states 2FA was enabled for the Namecheap account in question. In fact, that is sort of the whole point of the article.
- levemi 11y agoOh this comment by CIO led me to think 2FA wasn't... https://news.ycombinator.com/item?id=11480221 https://news.ycombinator.com/item?id=11480221 You should not be able to overcome 2FA with social engineering wtf!