Namecheap CEO offers $10k bounty for changing someone else's domain via helpdesk

For example, they'll inspect traffic and nab a session cookie. Then they'll use that session cookie on another internal API request to change a setting, and claim they were able to modify a setting by reverse engineering things.

They seem really scary at first, and then you dig into it and you're like "oh...".

I think the majority is just ignorance rather than malice though.

You do realize that many companies will prosecute people just "following through and testing it", right?

Though the person you did say it to very likely has an international warrant out for them anyway for pissing off the DoD, so I guess it's all water under the bridge.

ha. Did anything "good" (or bad) come of this?

> Responsible Disclosure Programme needs to explicitly state that access to other users data is illegal and test/self owned accounts need to be used for security testing.

Why do you think so? You don’t lose out on any legal protections without explicitly stating that.

You will still be in trouble if you deface some random Namecheap customers website to claim this bounty.

Cutting off Russia on it's own already subjects a bunch of probably already very stressed out Ukranians to the stress of dealing with angry Russians, most of whom have nothing to do with the war in Ukraine. These customers mind you, used Namecheap to host content the Russian regime disapproves of; they were pretty much the only reputable registrar offering domains to Russian customers that wasn't ran by the state. Getting rid of those customers pushes those people to Russian state registrars, who will gladly come knocking for contact details if someone hosts something that the Kremlin disapproves of.

Adding to that, the actual methodology used was basically the dumbest method. It seems they targeted everyone who ever had Russian bank details in their account, anyone who ever accessed the site over a Russian IP address and anyone who had a Russian last name. This included hitting several thousands of people who fled the regime over a decade ago, who upon contacting Namecheap support were told to hand over proof of their permanent housing outside of Russia, people who used their account over a VPN, people in neighboring countries because GeoIP isn't an accurate science and people who have Russian roots but haven't even set foot in the country.

The only way to prove this was to send fairly specific details of your housing to Namecheap support (reports at the time even indicated that affected customers had to send photographs of their own house to remain a client), something which can be very sensitive for some people, wrt OPSEC and it's also data they could easily verify with existing KYC data, but they categorically refused to do that.

Like, the methods employed and the complete lack of perspective on what Russians used Namecheaps domains for are what make it racial discrimination, the decision itself is justifiable enough, many companies dropped Russia after the invasion.