Hacker News Reader

Comment by diggan | Hacker News Reader

> Taylor Monahan, lead product manager at Metamask, said Squarespace never accounted for the possibility that a threat actor might sign up for an account using an email associated with a recently-migrated domain before the legitimate email holder created the account themselves.

> “Thus nothing actually stops them from trying to login with an email,” Monahan told KrebsOnSecurity. “And since there’s no password on the account, it just shoots them to the ‘create password for your new account’ flow. And since the account is half-initialized on the backend, they now have access to the domain in question.”

This sounds like gross security negligence, and should probably be considered a crime when you're at the size of Squarespace with (assuming) a dedicated security team. Hopefully executives/management can be held responsible for whatever damage was done because of this.

View on HN

Squarespace is directly responsible, my irrational instinct is to blame Google even more, in that their role involved active abdication of responsibility for purely self-interested reasons and involved more employees than just their security engineering team.

Domains are critical infrastructure, wasn't any reason to sell them other than Wall Street puffery. Obvious downside was leaving business customers who got them via Cloud exposed. Per my uninformed intuition at the time, there wasn't a secure way to do this sort of switchover without a lot of manual reaching out neither of them were going to do.

Additionally, Google went out of their way to sweeten the deal by A) making Squarespace the reseller for any associated Google Workspace records which B) greatly widened the vulnerability surface. [1]

This sounded uninformed to me, until it happened, so [2] quotes the retrospective at length to show there was no secure and automated choice.

both via Security Alliance's "A Squarespace Retrospective": https://securityalliance.notion.site/A-Squarespace-Retrospec...

[1] "Furthermore, as Squarespace is an authorized Google Workspace reseller, any teams who had purchased Google Workspace through Google Domains had their license transferred to Squarespace. This allows the threat actor to create new administrators in Google Workspace via the hijacked Squarespace account."

[2] "However, what happens for [domain owner] emails which are not already registered to an [Squarespace] account? Well, you could preemptively create a new account for that email and send them a temporary password, but sending passwords in plain text is not a good practice, it would be pretty complicated to create millions of users with temporary passwords, and most people migrating probably want to use their Google account to sign in, not a password. Maybe your systems don’t even support creating temporary users like this."

This entire transition has made me HATE Google.

yeah wierd as hell, can google not afford any sort of technical help with their problems? makes me feel shaky relying on gmail like I do.

Ex-googler, left in October:

It's the Hunger Games inside, for a 1000 reasons. tl;dr: MBAs won, thoroughly.

The Great Game* is figuring out how to cut people without seeming cruel. Easiest way to do this is cut whole teams at once. This almost assuredly was seen as a massive victory inside: made money to cut people that no one will miss because it was a political orphan.

* i.e. "What does my boss' boss' boss' boss think their marching orders are?" -- the MBAs won, so it's a non-sequitor for them to think it is about products, quality, consumers, or simply doing the right thing. In order its spend less $, AI, get more $.

I'm yet another person who used google domains specifically because it was google and their security engineering is extremely good. I can't believe they sold it to squarespace.

Porkbun seems extremely competent, and they allowed me to register two yubikeys, reinforcing that. Hopefully we won't be back here in 2 years discussing where to hop to next.

The way you deal with this is tort law.

It is already criminal for people to hijack websites like this. It is also criminal to defraud people.

If you are damaged by a company's negligence in this way you just sue them.

This isn't as hard as seems. I've known people that make it a practice to take corporations to small claims court every time there is a data breach or some other problem with a company that has a account with them. It is usually pretty easy to win those sorts of cases as Judges have little sympathy for these mega corporations.

If you are lucky and the company involved is actually incompetent then chances are they won't respond to the small claims lawsuit and you win by default. Get whatever you asked for.

Why aren't you doing this?

The problem with making it a crime (it probably already is a crime) is that the blame will be placed on the developer when it probably was not the fault of the developer.

In these types of situations I’ve been in, usually the developers already complained, and it’s really not the fault of the developers.

This creates this weird situation where developers have to do more and more to protect themselves from situations like this.

It doesn’t take more than a few seconds of thinking to realise that google should have made some kind of way for authentication to be transitioned over. Even something as simple as sending out a “transfer” email link or even just an api that squat space could have called to allow customer transfer verification.

It doesn't matter what Google did or wanted to do if Squarespace wasn't going to actually support it.

If the developer agreed to implement it then it is the fault of the developer. Making the developer liable both motivates the developer to not agree to things that are illegal and provides them with an argument for pushing back.

Simply making something illegal does not change culture. The lowest guy on the payroll has no leverage beyond leaving. Companies have no reason to change what they are doing.

> Simply making something illegal does not change culture.

Correct, you also need enforcement.

> The lowest guy on the payroll has no leverage beyond leaving. Companies have no reason to change what they are doing.

Leaving is a huge leverage. Even easily replacable corporate drones cost a lot to replace. If a company needs to find someone willing to risk going to prison they will are much less likely to be successful.

If it's illegal, the lowest guy has the leverage of putting his boss in jail. The boss has the leverage of putting his boss in jail, and so on.

Reply on news.ycombinator.com