3 ms·
> I've seen many people locked out of their hosting accounts because they have their primary account email address as one of the hosted email addresses on their
by bleepblorp 6y ago
> I've seen many people locked out of their hosting accounts because they have their primary account email address as one of the hosted email addresses on their accounts, and suddenly they've lost access to their web hosting control panel because their domain expired or their email was otherwise taken offline.
This is a surprisingly difficult risk to effectively mitigate.
If you have a domain and tie your domain registration and hosting accounts to an email address hosted by the domain, you could get locked out if something goes wrong with the domain registration.
If you tie your registration and hosting accounts to a third-party email account, you could get locked out if the third-party decides to nuke your account for any arbitrary reason (cough, cough, Gmail).
If you tie your registration and hosting accounts to a cell phone number, you could get locked out if someone attacks your phone account (unauthorized porting, SIM swap, etc) or if the cell phone network goes down (think California fire protection blackouts, or hurricanes).
If you tie your registration and hosting accounts to TOTP or Webauthn 2FA, you could get locked out if you lose or damage your 2FA device.
There's no good way to authenticate domain registration and hosting accounts unless your registrar and host have the foresight to allow multiple authentication paths.
- ValentineC 6y ago> If you tie your registration and hosting accounts to a third-party email account, you could get locked out if the third-party decides to nuke your account for any arbitrary reason (cough, cough, Gmail). This is interesting. I usually point all my WHOIS info to <something>@<other-domain>, but <other-domain>'s WHOIS goes to one of my personal Gmail accounts. I'm going to switch it to a domain where I control the DNS, so I can change the MX record if a provider decides to nuke my account. Now I'm wondering how this works with any registrar's domain privacy feature — technically, they're the "owner" of the domain in the WHOIS record.
- joveian 6y agoJust be careful that your DNS is sufficiently restricted; I've heard of DNS being the weak point for taking over accounts involving custom domains. I'm surprised there aren't more in person or by mail verification options available. I guess partly due to the "who pays for it" aspect (and people moving, etc., plus no verificaion method is completely accurate), but the current state of authenticating online accounts is rather worrying in general and allows anyone anywhere in the world to try to take over your accounts.
- bleepblorp 6y agoI'd personally tie a domain to a paid email account hosted by a provider that is in a sound market position (not e.g. Yahoo), doesn't have a reputation for arbitrarily revoking accounts (not Google), and doesn't have overly aggressive spam controls (not Microsoft). That doesn't leave many options.