5 ms·

How did that happen and why did it take weeks to resolve?

warrenm 5y ago
Someone created a bogus account using my email trying to claim DNS administrative rights for all domains associated with that email (yeah, yeah, yeah - I should have had domain privacy for everything ... but some didn't) Cloudflare ended up getting listed as authoritative DNS in its own DNS resolver (even though the registrar's records were supposed to be authoritative) The only reason they couldn't fully steal DNS settings was I had 2FA enabled with my registrars and on my email account Took nearly 3 days to claim the malicious Cloudflare account via password resets to my actual email address and enable 2FA on it to my authentication tools Took another week+ to delete all attempted DNS registries and get Cloudflare to not recognize themselves as authoritative DNS resolution for the domains And over a month for tech "support" and "legal" to finally get around to responding to my complaints basically saying, "you should have created an account with us with that email so no one else could try to steal it"
- remram 5y ago
  > The only reason they couldn't fully steal DNS settings was I had 2FA enabled with my registrars and on my email account This sounds like they had your password?
  - crummybowley 5y ago
    Also seems like CF jumped the gun on letting their servers serve content to their own servers -- seems like CF fucked up too. Like, when you are CF big you can't just start resolving domains however you feel because folks use your DNS service.
    - remram 5y ago
      If their 8.8.8.8 resolver was returning results from customer accounts that weren't verified, like the GP seems to imply, that seems like a huge security problem.
      - warrenm 5y ago
        1.1.1.1 ... 8.8.8.8 is google :)
    - warrenm 5y ago
      but ... but ... but! free markets! /s
      - crummybowley 5y ago
        This is not a free market issue. Free market does not mean companies can do what they want.
        warrenm 5y ago
        Hence the "/s" :)
  - warrenm 5y ago
    Nope - they didn't change anything with the registrars But Cloudflare still let them start making DNS entries
- StavrosK 5y ago
  Wow, that's a lot of bad. How did they manage to create an account with your email address? Doesn't it require verification?
  - warrenm 5y ago
    You'd think, right? Cloudflare (at least at the time) would let you create an account and start doing stuff without verifying you actually owned the email address Fat-finger? bob[at]bob[dot]com to bon[dot]com? No worries Enter my email instead of yours? Go for it It's just a login...right?

Someone created a bogus account using my email trying to claim DNS administrative rights for all domains associated with that email (yeah, yeah, yeah - I should have had domain privacy for everything ... but some didn't) Cloudflare ended up getting listed as authoritative DNS in its own DNS resolver (even though the registrar's records were supposed to be authoritative) The only reason they couldn't fully steal DNS settings was I had 2FA enabled with my registrars and on my email account Took nearly 3 days to claim the malicious Cloudflare account via password resets to my actual email address and enable 2FA on it to my authentication tools Took another week+ to delete all attempted DNS registries and get Cloudflare to not recognize themselves as authoritative DNS resolution for the domains And over a month for tech "support" and "legal" to finally get around to responding to my complaints basically saying, "you should have created an account with us with that email so no one else could try to steal it"

remram 5y ago
> The only reason they couldn't fully steal DNS settings was I had 2FA enabled with my registrars and on my email account This sounds like they had your password?
- crummybowley 5y ago
  Also seems like CF jumped the gun on letting their servers serve content to their own servers -- seems like CF fucked up too. Like, when you are CF big you can't just start resolving domains however you feel because folks use your DNS service.
  - remram 5y ago
    If their 8.8.8.8 resolver was returning results from customer accounts that weren't verified, like the GP seems to imply, that seems like a huge security problem.
    - warrenm 5y ago
      1.1.1.1 ... 8.8.8.8 is google :)
  - warrenm 5y ago
    but ... but ... but! free markets! /s
    - crummybowley 5y ago
      This is not a free market issue. Free market does not mean companies can do what they want.
      - warrenm 5y ago
        Hence the "/s" :)
- warrenm 5y ago
  Nope - they didn't change anything with the registrars But Cloudflare still let them start making DNS entries
StavrosK 5y ago
Wow, that's a lot of bad. How did they manage to create an account with your email address? Doesn't it require verification?
- warrenm 5y ago
  You'd think, right? Cloudflare (at least at the time) would let you create an account and start doing stuff without verifying you actually owned the email address Fat-finger? bob[at]bob[dot]com to bon[dot]com? No worries Enter my email instead of yours? Go for it It's just a login...right?