8 ms·

Namecheap vulnerability they refuse to fix: no 2FA on support portal login

188 points by ajdude 4y ago

ajdude 4y ago
Not OP of this post, just came across it. I'm a heavy namecheap user, and will continue to use them, but this did make me a little concerned. From the post: > so, setting up 2fa on namecheap prevents anyone from just logging into your account if your credentials get leaked or stolen. great, they can't just manage your domains. HOWEVER, the namecheap support portal (at http://support.namecheap.com http://support.namecheap.com) uses the same credentials for login BUT it never asks for 2fa. if you get leaked credentials you can just sign in to the support portal. because of how badly designed it is you can even change the support email for the account with no confirmation and no info being sent out to the old email. > how is that a big deal? > well, you can just open domain transfer tickets from the support portal and hijack domains anyways, you can probably even pretend to not understand how anything works and ask them to change dns for you, etc...
- philliphaydon 4y ago
  I only used support once many many years ago and was asked for a one time support code from the main account. So I never worried about the lack of 2factor. But now I worry…
unknownaccount 4y ago
- WatchDog 4y ago
  > randomly cancelling thousands of peoples domains on short notice simply due to the country they are from Not wrong, but for more context, they made their Russian customers transfer their domains, when their Ukrainian offices started getting shelled by Russian invaders. It’s hard to stay politically neutral when your staff are literally being bombed
  - MerelyMortal 4y ago
    I doubt it was their customers bombing them. If anything, taking money out of the country should be a good thing if they don't want to support that country.
  - unknownaccount 4y ago
    Choosing not to allow renewals would have been been acceptable but they straight cancelled those domains prematurely before the term of registration had ended. Basically pulling the rug out from underneath people without giving them adequate time to migrate. Allowing domains to be sniped by unscrupulous parties who put malware on them which hurt many thousands of people (mostly foreigners who had nothing to do with Russia). Totally irresponsible and criminally negligent behavior for any registrar. I hope they get sued for for breaking their own contracts and causing widespread destruction via malware.
    - teclordphrack2 4y ago
    - ThunderSizzle 4y ago
      While I don't really care about the Ukraine crisis (its just being used as a political tool here), Namecheap offices were being blown up by an invading force. If Russia wants to have free commerce with Ukraine, including domain registration, then it shouldn't have invaded. As soon as war started, all trade requirements cease. In fact, I'm surprised it didn't become illegal immediately to have any commerce with Russia.
      - justsomehnguy 4y ago
        > I'm surprised it didn't become illegal immediately to have any commerce with Russia Because you mistake Russian citizens for Russian Federation. Also someone needs that chea^W not so cheap now gas.
      - philliphaydon 4y ago
        Where is “here” if you don’t mind me asking.
- thegeekpirate 4y ago
  > It’s one of those cheap bottom of the barrel vendors which of course takes shortcuts to make the price so cheap. NameCheap is only the cheapest for _one_ TLD in terms of renewal cost (https://tld-list.com/registrars https://tld-list.com/registrars). Love that site.
  - unknownaccount 4y ago
    Huh I guess they are just taking shortcuts to enrich themselves then - even less noble than I’d thought.
- nextaccountic 4y ago
  You seem knowledgeable, so, what do you think about Porkbun?
  - nishs 4y ago
    Not OP, I just took a look at Porkbun. They appear to take security seriously. You can choose to receive emails upon each successful and/or failed login. You can view a list of recent logins to your account on the website. You can force log out all sessions. Additional authentication methods include two-factor codes, WebAuthn w/ physical keys. You can download a set of backup, one-time-use codes. You can restrict IP addresses allowed for login. They also check if your email address is present in known password leaks, and prompt you to turn on 2FA for added security. The web interface is quick, has a simple design (Bootstrap/Foundation? for CSS), and doesn't feel flimsy.
MerelyMortal 4y ago
When switching away from DreamHost, I researched different domain registrars. I chose to try Namecheap and Dynadot, so I sent half of my domains to Namecheap, and the other half to Dynadot. After the transfer lock peroid, I moved my domains from Namecheap to Dynadot. The prices were pretty much the same, but the interface was better, and Dynadot also passes on "name tasting" to the user (users can request a refund if they change their mind after buying a domain name). I've also sinced used Dynadot's customer service one time, and it was good. My only gripe with Dynadot is at the login screen: I set up 2FA, and they call it a "Google code", when you can use any other 2FA manager besides Google.
- yaomtc 4y ago
  That's a pretty common problem. Nintendo also does this.
- pdonis 4y ago
  > When switching away from DreamHost Out of curiosity, was there any particular reason you switched away from Dreamhost?
  - MerelyMortal 4y ago
    Their domain name prices are higher, and I feel like their might have been something else, but I don't remember. I still have shared hosting with them because I haven't bothered to shop around on that yet (I have more domain names than sites I host).
    - pdonis 4y ago
      Thanks for the response. I have been a Dreamhost customer for about 20 years and have never had a significant problem with them. I don't find their domain name prices to be an issue, but I might be less price sensitive about that than others.
mkl 4y ago
Namecheap's support pages seem to be a completely different system to their main site. I've sometimes been unable to log into the support page even though I can get into the main site fine, and contacting support about it got nowhere. Maybe the support is outsourced? In my experience, the support people ask for a PIN which you can only see by logging in to the main site with 2FA, so while this problem is not great, I don't think it's as bad as this article suggests.
- kayodelycaon 4y ago
  At my company, our support portal isn’t run by the software engineering team, but by a different department. The integration is limited and doesn’t support 2FA. Changing this is very much not a priority, because we don’t want to be responsible and the point of contact for a dozen more services.
Lucent 4y ago
I once had a domain at Namecheap show "Ownership change pending approval" to another username with a cancel link beside it and I recognized the username as someone who made offers before out of band. Never got an email or saw any kind of notification, and I've been in the game 25 years and know those extremely long domain transfer emails and read them carefully. Started transferring domains away after that.
- noname120 4y ago
  What alternative host would you recommend?
  - sammax 4y ago
    I’m quite happy with Glauca [1], they’re not quite as cheap but their DNS stuff is pretty good and they are friendly and helpful. Only downside is their website being a bit slow sometimes. [1] https://glauca.digital https://glauca.digital
  - homero 4y ago
    Porkbun and Cloudflare are the best and cheap
    - mkl 4y ago
      What's Porkbun's support like?
      - dsissitka 4y ago
        I contacted them once before moving over and once after and they were good to me. I'm happy with them for domains but I wouldn't recommend them for email.
    - LilBytes 4y ago
      CloudFlare unfortunately still have a very limited subset of TLDs available.
  - 4y ago
tobinfekkes 4y ago
Why is NameCheap getting thrown under the bus across the board? I've used them for 10+ years without issue. In fact, it's been stellar. Sure, the interface is a little outdated. But does anyone honestly spend any amount of time there, other than pointing the nameservers to Cloudflare? After that, I rarely ever even log in.
- deleted 4y ago
  [deleted]
- rblatz 4y ago
  Why not just buy the domains directly from cloudflare then?
  - tobinfekkes 4y ago
    To avoid the "all eggs in one basket" issue with companies that have arbitrary rules and little to no support, on purpose. Same reason I don't use Stripe or Shopify or SendGrid.
    - rblatz 4y ago
      I’ve had excellent experience with support from Cloudflare, Stripe, and I don’t recall ever having issues with SendGrid over the 3+ years I used them.
  - LilBytes 4y ago
    There's a limited number of TLDs available on CloudFlare.
  - InGoodFaith 4y ago
    Cloudflare's domain management has sadly also had some questionable actions/decisions. 0: https://news.ycombinator.com/item?id=31573854 https://news.ycombinator.com/item?id=31573854 1: https://community.cloudflare.com/t/domain-not-working-after-domain-transfer-to-cloudflare/387695/3 https://community.cloudflare.com/t/domain-not-working-after-...
someotherperson 4y ago
Casual reminder that 9/10 phishing scam domains you come across will be hosted on NameCheap and the company couldn't care less, probably too valuable as revenue. This is so well known that blackhat discussions recommend NameCheap as the registrar of choice. Maybe they exploit vulnerabilities like this one. If the CTO or CEO or whatever C-level comes on here to do damage control every now and then tries to disagree (probably citing how big their $3/hour Eastern European legal team is) keep in mind it's all PR junk and the proof is in the pudding. It's been years -- no action, no change. Just more scams.
- hoffs 4y ago
  > couldn't care less They are usually praised for how fast they take down phishing domains though
  - deleted 4y ago
    [deleted]
  - someotherperson 4y ago
    They'll take down a single domain and pretend to not know how to take down the other 300 registered on the same user's account. The argument that NameCheap (and its supporters) provide is that this is a good thing that makes them stay because NameCheap shouldn't be policing domains or some other free speech nonsense ignoring that this is pure facilitation of crime. Ignoring that this is blatantly violating their own T&Cs and the ICANN guidelines.
    - AndriyKunitsyn 4y ago
      So they actually do care, huh. No, the argument is it's either this "free speech nonsense" or gestapo filtration like the Apple's/Google's app review process, where the big company is the judge and the jury, and I prefer the former.
      - desindol 4y ago
rawoke083600 4y ago
Next to Godaddy, Namecheap is one to avoid ! Ive actually had my dns settings lost ! And their response 'sorry.... blah blah'
Khaine 4y ago
So what is a good registrar that works with lego to do dns acme?
- evolve2k 4y ago
  Your paying for a more premium service but DNSimple take security and service fairly seriously. www.dnsimple.com Including recently. “Secure your account with WebAuthn & FIDO2 security keys.” You do need a subscription though: “A DNSimple subscription is required to register, transfer, or renew domain names. Domain registration, transfer, and renewal fees are not included in your subscription.“ That said I’m still currently a namecheap supporter, their backing for an open internet over the years has built my broader confidence in them, but I agree they need to be investing in pinging improvement especially when it comes to security practices.
  - asah 4y ago
    fwiw, namecheap also supports FIDO2.
throw55 4y ago
Symbioquine 4y ago
Their email service - Private Email - (which is otherwise pretty decent) also has a similar issue where they support 2FA and application passwords for the web interface, but don't enforce those rules via the IMAP/SMTP/POP/etc APIs - https://twitter.com/symbioquine/status/1362907237048479745 https://twitter.com/symbioquine/status/1362907237048479745
dawnerd 4y ago
I’m really glad I migrated off Namecheap. Was a long time customer but when they had that massive dnssec outage and their support had no idea what it was doing, that was the last straw for me. I moved everything over to google (I know I know) and haven’t had a single second of downtime. Would love ideas for better alternatives, preferably privacy oriented.
- conjuredbytes 4y ago
  I’ve been using gandi.net for years. They seem to care about playing by the rules and supporting privacy if their supported projects is anything to go by: https://www.gandi.net/en-US/gandi-supports https://www.gandi.net/en-US/gandi-supports
  - lucasverra 4y ago
    +1 for gandi.net's reputation. 10y straght of good service
- Ayesh 4y ago
  > dnssec outage DNSSEC signing happens at the nameservers run by the registry (verisign for .com, for example). Unless it was an issue with their API servers not properly calling the upstream APIs, I don't think namecheap is to blame here. I personally think namecheap is dangerously close to being the next Godaddy, but I wouldn't hold DNSSEC issues against Namecheap any other registrar.
  - dawnerd 4y ago
    It’s been a while but I recall it was a Namecheap issue. https://ianix.com/pub/dnssec-outages/20190221-namecheap/ https://ianix.com/pub/dnssec-outages/20190221-namecheap/
deleted 4y ago
[deleted]
newbieuser 4y ago
I really don't understand why people are still using this amateur site. Please don't give money to these idiots when they have better alternatives.
- llanowarelves 4y ago
  What are some of your favorite alternatives?
  - Ayesh 4y ago
    Porkbun has always been pretty solid. They support 2FA with TOTP and HOTP, the support is no bullshit email support that's reasonably fast, and the prices are quite low too. Not affiliated, just a happy customer paying about $500 a year for a bunch of domains at Porkbun.
    - llanowarelves 4y ago
      Thanks!
nikolay 4y ago
I was able to remove 2FA on one account without them verifying I'm the owner properly.
omegacharlie 4y ago
While this incident is certainly concerning a bigger question is which registrars can properly ward off attempts at social-engineering and other account access fraud and not sweep it under the rug. Even seemingly well intentioned companies utilize plain-text email for customer communication which is not exactly reassuring either. MarkMonitor used to be a thing. Trusted by big companies but even the act of attempting to get information about their services has been met with difficulty. Regardless they have been acquired by an investment firm and there has been some concerns of quality-of-service because of that.

188 points by ajdude 4y ago

Not OP of this post, just came across it. I'm a heavy namecheap user, and will continue to use them, but this did make me a little concerned. From the post: > so, setting up 2fa on namecheap prevents anyone from just logging into your account if your credentials get leaked or stolen. great, they can't just manage your domains. HOWEVER, the namecheap support portal (at http://support.namecheap.com http://support.namecheap.com) uses the same credentials for login BUT it never asks for 2fa. if you get leaked credentials you can just sign in to the support portal. because of how badly designed it is you can even change the support email for the account with no confirmation and no info being sent out to the old email. > how is that a big deal? > well, you can just open domain transfer tickets from the support portal and hijack domains anyways, you can probably even pretend to not understand how anything works and ask them to change dns for you, etc...

philliphaydon 4y ago
I only used support once many many years ago and was asked for a one time support code from the main account. So I never worried about the lack of 2factor. But now I worry…

unknownaccount 4y ago

WatchDog 4y ago
> randomly cancelling thousands of peoples domains on short notice simply due to the country they are from Not wrong, but for more context, they made their Russian customers transfer their domains, when their Ukrainian offices started getting shelled by Russian invaders. It’s hard to stay politically neutral when your staff are literally being bombed
- MerelyMortal 4y ago
  I doubt it was their customers bombing them. If anything, taking money out of the country should be a good thing if they don't want to support that country.
- unknownaccount 4y ago
  Choosing not to allow renewals would have been been acceptable but they straight cancelled those domains prematurely before the term of registration had ended. Basically pulling the rug out from underneath people without giving them adequate time to migrate. Allowing domains to be sniped by unscrupulous parties who put malware on them which hurt many thousands of people (mostly foreigners who had nothing to do with Russia). Totally irresponsible and criminally negligent behavior for any registrar. I hope they get sued for for breaking their own contracts and causing widespread destruction via malware.
  - teclordphrack2 4y ago
  - ThunderSizzle 4y ago
    While I don't really care about the Ukraine crisis (its just being used as a political tool here), Namecheap offices were being blown up by an invading force. If Russia wants to have free commerce with Ukraine, including domain registration, then it shouldn't have invaded. As soon as war started, all trade requirements cease. In fact, I'm surprised it didn't become illegal immediately to have any commerce with Russia.
    - justsomehnguy 4y ago
      > I'm surprised it didn't become illegal immediately to have any commerce with Russia Because you mistake Russian citizens for Russian Federation. Also someone needs that chea^W not so cheap now gas.
    - philliphaydon 4y ago
      Where is “here” if you don’t mind me asking.
thegeekpirate 4y ago
> It’s one of those cheap bottom of the barrel vendors which of course takes shortcuts to make the price so cheap. NameCheap is only the cheapest for _one_ TLD in terms of renewal cost (https://tld-list.com/registrars https://tld-list.com/registrars). Love that site.
- unknownaccount 4y ago
  Huh I guess they are just taking shortcuts to enrich themselves then - even less noble than I’d thought.
nextaccountic 4y ago
You seem knowledgeable, so, what do you think about Porkbun?
- nishs 4y ago
  Not OP, I just took a look at Porkbun. They appear to take security seriously. You can choose to receive emails upon each successful and/or failed login. You can view a list of recent logins to your account on the website. You can force log out all sessions. Additional authentication methods include two-factor codes, WebAuthn w/ physical keys. You can download a set of backup, one-time-use codes. You can restrict IP addresses allowed for login. They also check if your email address is present in known password leaks, and prompt you to turn on 2FA for added security. The web interface is quick, has a simple design (Bootstrap/Foundation? for CSS), and doesn't feel flimsy.

MerelyMortal 4y ago

When switching away from DreamHost, I researched different domain registrars. I chose to try Namecheap and Dynadot, so I sent half of my domains to Namecheap, and the other half to Dynadot. After the transfer lock peroid, I moved my domains from Namecheap to Dynadot. The prices were pretty much the same, but the interface was better, and Dynadot also passes on "name tasting" to the user (users can request a refund if they change their mind after buying a domain name). I've also sinced used Dynadot's customer service one time, and it was good. My only gripe with Dynadot is at the login screen: I set up 2FA, and they call it a "Google code", when you can use any other 2FA manager besides Google.

yaomtc 4y ago
That's a pretty common problem. Nintendo also does this.
pdonis 4y ago
> When switching away from DreamHost Out of curiosity, was there any particular reason you switched away from Dreamhost?
- MerelyMortal 4y ago
  Their domain name prices are higher, and I feel like their might have been something else, but I don't remember. I still have shared hosting with them because I haven't bothered to shop around on that yet (I have more domain names than sites I host).
  - pdonis 4y ago
    Thanks for the response. I have been a Dreamhost customer for about 20 years and have never had a significant problem with them. I don't find their domain name prices to be an issue, but I might be less price sensitive about that than others.

mkl 4y ago

Namecheap's support pages seem to be a completely different system to their main site. I've sometimes been unable to log into the support page even though I can get into the main site fine, and contacting support about it got nowhere. Maybe the support is outsourced? In my experience, the support people ask for a PIN which you can only see by logging in to the main site with 2FA, so while this problem is not great, I don't think it's as bad as this article suggests.

kayodelycaon 4y ago
At my company, our support portal isn’t run by the software engineering team, but by a different department. The integration is limited and doesn’t support 2FA. Changing this is very much not a priority, because we don’t want to be responsible and the point of contact for a dozen more services.

Lucent 4y ago

I once had a domain at Namecheap show "Ownership change pending approval" to another username with a cancel link beside it and I recognized the username as someone who made offers before out of band. Never got an email or saw any kind of notification, and I've been in the game 25 years and know those extremely long domain transfer emails and read them carefully. Started transferring domains away after that.

noname120 4y ago
What alternative host would you recommend?
- sammax 4y ago
  I’m quite happy with Glauca [1], they’re not quite as cheap but their DNS stuff is pretty good and they are friendly and helpful. Only downside is their website being a bit slow sometimes. [1] https://glauca.digital https://glauca.digital
- homero 4y ago
  Porkbun and Cloudflare are the best and cheap
  - mkl 4y ago
    What's Porkbun's support like?
    - dsissitka 4y ago
      I contacted them once before moving over and once after and they were good to me. I'm happy with them for domains but I wouldn't recommend them for email.
  - LilBytes 4y ago
    CloudFlare unfortunately still have a very limited subset of TLDs available.
- 4y ago

tobinfekkes 4y ago

Why is NameCheap getting thrown under the bus across the board? I've used them for 10+ years without issue. In fact, it's been stellar. Sure, the interface is a little outdated. But does anyone honestly spend any amount of time there, other than pointing the nameservers to Cloudflare? After that, I rarely ever even log in.

deleted 4y ago
[deleted]
rblatz 4y ago
Why not just buy the domains directly from cloudflare then?
- tobinfekkes 4y ago
  To avoid the "all eggs in one basket" issue with companies that have arbitrary rules and little to no support, on purpose. Same reason I don't use Stripe or Shopify or SendGrid.
  - rblatz 4y ago
    I’ve had excellent experience with support from Cloudflare, Stripe, and I don’t recall ever having issues with SendGrid over the 3+ years I used them.
- LilBytes 4y ago
  There's a limited number of TLDs available on CloudFlare.
- InGoodFaith 4y ago
  Cloudflare's domain management has sadly also had some questionable actions/decisions. 0: https://news.ycombinator.com/item?id=31573854 https://news.ycombinator.com/item?id=31573854 1: https://community.cloudflare.com/t/domain-not-working-after-domain-transfer-to-cloudflare/387695/3 https://community.cloudflare.com/t/domain-not-working-after-...

someotherperson 4y ago

Casual reminder that 9/10 phishing scam domains you come across will be hosted on NameCheap and the company couldn't care less, probably too valuable as revenue. This is so well known that blackhat discussions recommend NameCheap as the registrar of choice. Maybe they exploit vulnerabilities like this one. If the CTO or CEO or whatever C-level comes on here to do damage control every now and then tries to disagree (probably citing how big their $3/hour Eastern European legal team is) keep in mind it's all PR junk and the proof is in the pudding. It's been years -- no action, no change. Just more scams.

hoffs 4y ago
> couldn't care less They are usually praised for how fast they take down phishing domains though
- deleted 4y ago
  [deleted]
- someotherperson 4y ago
  They'll take down a single domain and pretend to not know how to take down the other 300 registered on the same user's account. The argument that NameCheap (and its supporters) provide is that this is a good thing that makes them stay because NameCheap shouldn't be policing domains or some other free speech nonsense ignoring that this is pure facilitation of crime. Ignoring that this is blatantly violating their own T&Cs and the ICANN guidelines.
  - AndriyKunitsyn 4y ago
    So they actually do care, huh. No, the argument is it's either this "free speech nonsense" or gestapo filtration like the Apple's/Google's app review process, where the big company is the judge and the jury, and I prefer the former.
    - desindol 4y ago

rawoke083600 4y ago

Next to Godaddy, Namecheap is one to avoid ! Ive actually had my dns settings lost ! And their response 'sorry.... blah blah'

Khaine 4y ago

So what is a good registrar that works with lego to do dns acme?

evolve2k 4y ago
Your paying for a more premium service but DNSimple take security and service fairly seriously. www.dnsimple.com Including recently. “Secure your account with WebAuthn & FIDO2 security keys.” You do need a subscription though: “A DNSimple subscription is required to register, transfer, or renew domain names. Domain registration, transfer, and renewal fees are not included in your subscription.“ That said I’m still currently a namecheap supporter, their backing for an open internet over the years has built my broader confidence in them, but I agree they need to be investing in pinging improvement especially when it comes to security practices.
- asah 4y ago
  fwiw, namecheap also supports FIDO2.

throw55 4y ago

Symbioquine 4y ago

Their email service - Private Email - (which is otherwise pretty decent) also has a similar issue where they support 2FA and application passwords for the web interface, but don't enforce those rules via the IMAP/SMTP/POP/etc APIs - https://twitter.com/symbioquine/status/1362907237048479745 https://twitter.com/symbioquine/status/1362907237048479745

dawnerd 4y ago

I’m really glad I migrated off Namecheap. Was a long time customer but when they had that massive dnssec outage and their support had no idea what it was doing, that was the last straw for me. I moved everything over to google (I know I know) and haven’t had a single second of downtime. Would love ideas for better alternatives, preferably privacy oriented.

conjuredbytes 4y ago
I’ve been using gandi.net for years. They seem to care about playing by the rules and supporting privacy if their supported projects is anything to go by: https://www.gandi.net/en-US/gandi-supports https://www.gandi.net/en-US/gandi-supports
- lucasverra 4y ago
  +1 for gandi.net's reputation. 10y straght of good service
Ayesh 4y ago
> dnssec outage DNSSEC signing happens at the nameservers run by the registry (verisign for .com, for example). Unless it was an issue with their API servers not properly calling the upstream APIs, I don't think namecheap is to blame here. I personally think namecheap is dangerously close to being the next Godaddy, but I wouldn't hold DNSSEC issues against Namecheap any other registrar.
- dawnerd 4y ago
  It’s been a while but I recall it was a Namecheap issue. https://ianix.com/pub/dnssec-outages/20190221-namecheap/ https://ianix.com/pub/dnssec-outages/20190221-namecheap/

deleted 4y ago

[deleted]

newbieuser 4y ago

I really don't understand why people are still using this amateur site. Please don't give money to these idiots when they have better alternatives.

llanowarelves 4y ago
What are some of your favorite alternatives?
- Ayesh 4y ago
  Porkbun has always been pretty solid. They support 2FA with TOTP and HOTP, the support is no bullshit email support that's reasonably fast, and the prices are quite low too. Not affiliated, just a happy customer paying about $500 a year for a bunch of domains at Porkbun.
  - llanowarelves 4y ago
    Thanks!

nikolay 4y ago

I was able to remove 2FA on one account without them verifying I'm the owner properly.

omegacharlie 4y ago

While this incident is certainly concerning a bigger question is which registrars can properly ward off attempts at social-engineering and other account access fraud and not sweep it under the rug. Even seemingly well intentioned companies utilize plain-text email for customer communication which is not exactly reassuring either. MarkMonitor used to be a thing. Trusted by big companies but even the act of attempting to get information about their services has been met with difficulty. Regardless they have been acquired by an investment firm and there has been some concerns of quality-of-service because of that.