Hacker News Reader

This really boils down to who is a better sysadmin-- you or the Google SREs. Choose reliable and paranoid providers that actually verify your identity before shenanigans and you can mitigate the entry vector.

Yeah, I disagree with Naoki's conclusion. I'm pretty sure he just didn't have 2FA turned on with GoDaddy (which I understand - I didn't think to turn 2FA on with my provider until I read his story).

The admonition to use a @gmail.com address was annoying enough to me that I responded with a blog post: https://konklone.com/post/protect-your-domain-name-with-two-...

The real solution is to use a DNS registrar and DNS hosting that properly verifies your identity before allowing changes. Google Apps has nothing to do with it, and in fact has enabled 2-factor auth for a long time. Everyone should be using it.