Hacker News Reader

Comment by StavrosK | Hacker News Reader

I just consider them as not supporting 2FA. I'm looking at you, Namecheap. My domain registrar not having two-factor authentication in 2017 is preposterous.

View on HN

I have run into several occasions when I need to urgently sign into my NameCheap account only to discover that the SMS 2 factor auth is not working. (I hit the button to send the code and nothing comes through)

Very convenient!

Namecheap does have 2fa... https://www.namecheap.com/support/knowledgebase/article.aspx...

Do you mean because they only support SMS based 2fa?

Considering they have a drop down menu it's possible they just have not had time to develop the other options?

As of January, 2014 Namecheap said[1]: "Currently, we only accept SMS authentication but Google Authenticator, Authy, and TOTP authentication are planned."

More than three years seems to me a long development cycle to add TOTP support. Am I being disingenuous to think they just don't care?

[1] https://blog.namecheap.com/account-security/

It's not that they don't care. It's that $CARE_AMOUNT < $ESTIMATED_COST.

That formula would immediately shift if a high profile website registered on Namecheap encounters an SMS hijacking.

TOTP codes are straightforward to bootstrap. It's not rocket science.

I agree, I wrote an implementation in an afternoon for work, and that was back when there were no libraries to do this for me.

At scale the cost of implementing a feature as wide ranging as 2FA is well beyond the tech cost. A basic TOTP implementation can be coded from scratch in an afternoon[1].

The real cost is testing to make sure a code change like this doesn't break existing users and estimating the additional support overhead of dealing with users that lose their two-factor devices.

[1] Seriously the RFC is very straightforward and readable: https://tools.ietf.org/html/rfc6238

So what's the meaning of caring then? If they aren't implementing the feature, it means that they don't care. It doesn't make a difference to me that they care a bit, just not enough to actually implement it.

Yep, SMS 2FA just makes my account less secure, therefore it doesn't count as 2FA.

It only makes an account less secure if you can get into an account without knowing the password just by having the 2FA code (through customer support). Social engineering is also a problem with TOTP 2FA.

I'll take poor SMS based over none at all.

https://lolware.net/assets/images/netregistry.png

I won't, SMS is worse than nothing.

A quick question for someone who knows little about 2FA. If I were to use my Google Voice account as the SMS number does that make it any more secure since it's not tied to a SIM card?

It still goes through a bunch of providers, including Google, so it would not be as secure as TOTP. If the provider doesn't use it as a replacement for the password (ie you can't change your password using it), it may be more secure than just the password alone, but I don't trust it.

thank you

Reply on news.ycombinator.com