Hacker News Reader

Comment by philfrasty | Hacker News Reader

Any idea why companies would choose a proprietary 2FA solution? I see this with European banks all the time.

Honestly, we seriously dropped the ball trying something new. It was a mistake on my part and a bad decision looking back. I posted about it on our blog here https://www.namecheap.com/blog/true-totp-2fa-and-u2f-are-com...

I want to let you know that your previous 2FA was so awful that I had to turn it off. I had Project FI service, and ported my number back to google voice, which permanently locked me out of my namecheap account. I contacted support for help, but by the time they had responded, I had already lost my opportunity on responding to a gig.

This is probably the worst place to air a grievance like this, but it seemed like my frustrations had fallen on deaf ears. I haven't bought a domain from namecheap since.

Thanks for the feedback I appreciate it and I am very sorry to hear about your experience. While I can't go back and change what happened, I want to let you know we recognize the mistakes we've made and I can assure you we are committed to learn from them going forward. I hope one day you'll make it back.

I was one of the people who wrote long support requests to you guys detailing how much I disliked the system you had in place. I really respect your forthrightness here.

Thank you, I need to explicitly call out our/my shortcomings if we want to improve as a company going forward. We are making big changes to the way we are doing things and a commitment to full transparency and having open and honest conversations with our customers are the biggest of those.

Thanks Richard for being honest, this is why I choose namecheap

Sorry for the thread hijack, but:

Let's Encrypt. Ever going to roll it out?

I plan to switch away from Namecheap soon unless it's implemented, it's really disappointing to me.

Hello Fej, to be honest, we signed an exclusive contract with Comodo before Let's Encrypt even existed. The length of that contract is ten years. It's put us in a tough situation as far as what we can offer out of the box to our customers. While our customers can still install LE on our hosting services on their own, we can't actively do this for them. The only other option here is to break that contract which will cost us millions of dollars and it's something that I continue to consider.

Really appreciate the transparency shown in this comment. I recently moved away from Namecheap after 10 years of it being my primary registrar (mainly because of the crappy 2FA) but this is certainly making me reconsider.

Thank you and I'm sorry to hear that you left us. Please do try and check back with us at some point. I believe you'll see a difference in our approach to how we do things and the decisions we make going forward.

So we can expect it in 2024 then?

Sorry for the low quality comment but what a nice thing to say.

You guys are hosting my email and I couldn't be happier.

I requested this multiple times in surveys you presented me. Thank you for finally implementing it! I feel like my input was actually worth it!

I don't know about Namecheap, but I'd suspect the banks use proprietary solutions for the standard 2 reasons: 1) Something expensive feels more secure. The 50yo farts in suits are the ones making the decisions, not the devs who actually know why open standards are inherently more secure. 2) They have someone to blame when something goes wrong. If they implement TOTP insecurely and data gets stolen, they're on the hook. If RSA (or whoever else) screws up, the bank can point their finger at them since their programmers are usually the ones who do the integration.

Reply on news.ycombinator.com