DNS hijacked on GoDaddy? | Hacker News Reader

DNS hijacked on GoDaddy?

twitter.com

75 pointszigzaggy66 comments

I thought GoDaddy was an industry pariah, avoided by anyone who knows anything. What's the motivation to use them beyond saving a few dollars? Do they have a monopoly on certain domains?

> avoided by anyone who knows anything

Most people don't know anything. The 99.9% of people buying domains don't browse Hacker News or stay privy of news regarding domain registrars.

They do a lot of marketing, which makes them the default choice for many.

Fwiw you don't save a few dollars with GD, they have terrible pricing.

The only - only - thing they have is a big advertising budget. Their services, support, pricing, ... all bad

I use GD simply because their advertising worked. When I registered my first domain I didn't know where else to start and just haven't bothered to transfer to another provider.

According to the Twitter thread, Microsoft made a deal with Godaddy that makes them the default domain registrar for Office360.

Not just the default..you can't use O365 Premium with your own domain name at all unless you transfer it to GoDaddy.

Many non-technical founders go to them for the domain. By the time technical people (who know better) are involved the domain is already purchased and presumably transferring it out isn't prioritized.

I personally use NameCheap, but my company uses GoDaddy and has since before I got there...and the company we bought? Also uses GoDaddy. In total that is about 2000 domains. Transferring them would cost a lot of money and time and in the end is not worth it to save over the long run.

Potentially getting their DNS redirected would cost even more. (Also there are no "transfer fees" - although maybe GD unscrupulously does that?) So it's only a time consideration.

You actually pay a years domain fee typically upon transfer. So it is best to transfer near your regular renewal time.

I just went through this transferring a domain from GD to namecheap.

GoDaddy has been caught registering domains that users search for on their site. Search to see if wowlolkittenseatingpizzaarecool.com is available. It is available and you dont buy it. Check tomorrow. It is not available but you can buy it drom the owner for $99 instead of $8.

Dirty

This is known as Domain Name Front Running and I think their evidence/excuse was that they publicize what gets searched and others buy them.

http://en.wikipedia.org/wiki/Domain_name_front_running

So what’s the best alternative to GD? I use moniker for some domains and I am happy.

I don't think there is a best one but better ones.

Personally I use Gandi when I want to pay a bit more to have a user friendly interface and support. When I just need a domain for myself I use bookmyname because it can't be cheaper and the old interface is fine for me.

If you are already sending your money to Amazon, AWS Route 53 is also a good alternative.

AWS Route 53 is a Gandi reseller for most TLDs. As far as I can tell[0], only .com, .net and .org are registered directly with Amazon.

[0] https://www.google.com/search?q=%22The+registrar+for+this+TL...

I've been really happy with EasyDNS over the past 10-20 years... definitely not the cheapest registrar but well worth it in my opinion. They offer several pricing plans, but I like the $40/year registration and backup mail spool. If your main MX server goes down, I believe they hold your email on the secondary for up to a week? Cheap insurance at $3/month. Been very happy with support (live person picks up the phone, and generally is an engineer). Web interface is nice, they support standard privacy screen functions for whois, and generally seem to be good people.

My only affiliation with them is as a happy customer.

I had the least problems with porkbun so far.

I have been using joker.com for ~20 years for several dozen domains, and have never had a problem. Based in Germany, works very well.

In a lot of my experience, tech people first hear about a new domain when someone in marketing says "we're launching a new x. I've already done a lot of work by going to GoDaddy and buying the domain. You should be able to finish the web and services from here now that all the hard works done". You can't transfer a domain within 60 days of purchase so I usually end up going live with services there.

Probably because people just complain about Godaddy but don't recommend alternatives and explain why they are trustworthy/better.

Who do you use and why?

NearlyFreeSpeech.net is great. They don’t upsell you, there are no ads, whois privacy is easy, and everything just works.

There's a common list of providers mentioned every time on similar articles. Gandi, namecheap, dnssimple, and a few others. + all the usual cloud providers and CloudFlare.

Porkbun is also recommended usually.

I see recommendation very regularly here. I use Gandi.net and they are great, but I also regularly see namecheap being recommended (I never used them though, in my book "cheap" means low quality ^^ I'm French and the English word is often used that way :) )

Back when I was a college student, my popular video game wiki's domain [1] was stolen by a former associate of mine while I was overseas.

Godaddy did nothing to help the situation, and the thief had substantial monetary resources and threatened to get me tied up in court. He was ten years older, had an engineering income, and came from a family of lawyers. I was just a college student and felt powerless to do anything about it.

I assume it was social engineering. He had access to the server and database, but was never supposed to have domain name access.

Godaddy sucks.

Also, their founder kills elephants for sport. So there's that too.

[1] strategywiki.org

Honestly, it seems like this headline pops up at least once per year. I switched to another registrar close to a decade ago because of security concerns.

Something doesn't add up here.

His nameservers have been set to DigitalOcean servers for well over a year. A GoDaddy rep wouldn't be able to change MX records on those nameservers. They would have to change the nameservers on his domain to GoDaddy servers and then add new MX records. That's more than just a simple MX record change and seems more unlikely to me.

Perhaps his DigitalOcean account was compromised?

They could change the NS to point to the attacker's server. That one would respond to the MX queries with the new hostname and forward everything else to the original DNS server, ensuring no other differences are noticed.

Wonder if this is any way related to the 13 hour outage[1] at Wasabi storage related to GoDaddy?

[1] https://news.ycombinator.com/item?id=25567294

No, not according to Wasabi’s incident page. It’s pretty funny though to see GoDaddy suspending domains for abuse when they can’t get their own house in order.

Also, who made GoDaddy the content police? I didn’t think domains were that easy to suspend. Is that just a GoDaddy thing?

What registrar do people recommend these days for domain registration that's (more?) secure against domain theft attack vectors? Namecheap? Gandi? MarkMonitor? One of the cloud providers?

I don't think MarkMonitor is for casual domain owners.

Namecheap is excellent and they have solid YubiKey support. Plus whois privacy proxy service included for free.

I've been concerned about NameCheap since this alleged incident occurred

https://news.ycombinator.com/item?id=18063667

I use and like Gandi. If you're worried about social engineering though, I'd probably go Google since they would be the hardest for someone to get ahold of.

I had my domain taken over while on Gandi. Interestingly they didn't do it via customer support, but instead were directly in contact with Gandi's legal department. Their legal guys approved the request/order without thinking to actually verify anything at all. Funnily enough, I had way more trouble getting my domain back than the people who stole it.

As far as I can tell, Google, Cloudflare and Namecheap are really the only guys in town that don't fall for stupid shit.

How long ago was this, roughly?

I've heard of past concerns about some of Gandi's internal procedures and even ignoring that, they've been acquired by a venture capital firm of sorts.

> I'd probably go Google since they would be the hardest for someone to get ahold of.

If customers can't reach the support centre, neither can scammers.

I can vouch for Gandi.

> I'd probably go Google since they would be the hardest for someone to get ahold of

An excellent case of "it's a feature, not a bug".

I heard google's lack of customer support is a feature when it comes to security.

It's a meme, but not exactly true. Google has terrible customer support. And has great security. But the great security actually comes from actually very good policies, and have a fantastic "advanced protection" service for people who are targeted.

I was targeted extensively and purely from social engineering they managed to trick: A) Apple B) Amazon (AWS) C) Gandi

Into handing over my accounts. Companies that stood up fine and were targeted:

A) Google B) Namecheap C) Cloudflare D) Facebook

Cloudflare has the best domain prices. They sell domains at wholesale rates.

“Only domains Active at Cloudflare via a Full setup (Cloudflare hosts the authoritative DNS) are eligible for Cloudflare Registrar”[0]

[0] https://support.cloudflare.com/hc/en-us/articles/36001991067...

Do you consider that a negative?

They don't say it's negative, but it's certainly a limitation.

Currently using Porkbun, no complaints thus far.

iwantmyname is solid, been using them for over 5 years.

50:50 split between Porkbun and Gandi.

I like NameSilo.

Cheap prices, simple non bloated interface, free privacy, and 2FA.

MarkMonitor for businesses and large organizations. They have a lot of resources that can work with your legal team if domain legal issues crop up. They also have a legal presence in multiple countries that require you to have a local presence to get their ccTLD. They can super-lock domains so that if someone manages to change the root servers, they can instantly change it back unless a processes that you define is followed.

> They can super-lock domains so that if someone manages to change the root servers, they can instantly change it back unless a processes that you define is followed.

If you're referring to registry lock, that's not exactly how it works. It prevents said changes in the first place rather than merely reverting them; all changes have to go through an enhanced, manually verified, known-human-to-known-human change process. This is what e.g. google.com uses.

They sell a service that goes beyond registry lock.

Do you have a link with more info?

You can use mark monitor if you want to spend a bajillion dollars. They are meant for big brands with big budgets.

I think it boils down to a shitty employee at the end of the day.

If you have someone who decides to cut even 1 corner, it can be devastating to a domain owner.

I have hundreds of clients who have used them, and I've never been on the phone with GoDaddy and had them do any less than tell me to bug off if I don't have a pin or get the 2-factor auth code to verify myself.

Reading the Twitter thread, what's the current best security practices for email addresses? Because I thought getting your own domain was the better thing to do but it seemed in this case using a Gmail address would have been better?

If you want your domain to be safe from compromise via social engineering of the registrar, then use a registrar with a strong security policy. GoDaddy is a mass market registrar with tens of millions of customers for whom security is not their top concern.

Cloudflare offers a security-oriented registrar service that is also extremely affordable. I would recommend using them.

https://www.cloudflare.com/en-ca/products/registrar/

Will 2FA and having a customer support PIN set up prevent this hijacking with GoDaddy?

2FA reduces the changes of someone logging into your registrars web interface as you. It does not prevent actual hacking, an inept or malicious employee or someone operating a compromised registrar.

So the big shots in crypto still don't understand how to secure their coins?

I only have a few dollars, but I keep mine offline gpg encrypted... when I don't need them

What gave you the impression that coins were stolen? The twitter thread only mentioned that a few people's domains were hijacked, and that the victims all had their emails (and hence domains) exposed in a recent hack/leak of Ledger. It's conceivable that after hijacking a domain, you can gain access to the victim's cryptocurrency exchange account via password reset email and steal coins that way, but most exchange I know require multiple factors (eg. passport scans, phone/sms verification, waiting periods, security questions, etc.) so a hijacked email isn't going to do much.

There is a security solution that is much stronger than 2FA, passport, etc. It's called a hardware wallet.

That's true, but where in my comment does it suggest that keeping coins on an exchange account is a good idea? If you're a bitcoin whale, there's invariably going to be a decent amount of coins worth stealing on an exchange account somewhere. The only reason exchange accounts were brought up is that's the only conceivable way a domain compromise can lead to coins being stolen.

Reply on news.ycombinator.com