Naoki Hiroshima

I would hesitate to recommend using a personal domain for email. It's more complex and worse for security. In addition to securing access to your email provider (Gmail for example), you now have to secure access to your domain provider too. And even if you do your best, they might fall for social engineering because they take phone calls--like in the famous @N hack: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

From ICANN's perspective though, doesn't that mean that the owner of the domain is the registrar? While most registrars would be perfectly fine, I worry about the one that is willing to take the domain for themselves (for a domain not worth going to court over). While not exactly what happened, I remember the case of the @N twitter account be stolen (https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026… and wonder if having your actual information on the registration would help or hurt a situation like that.

Reminds me of this story “How I lost my $50,000 Twitter username” from 2014. https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

I use AWS registrar, primarily because I trust in their security policies. I recall the plight of the owner of the N twitter handle[0] and I do not believe it should be possible to talk AWS into phishing a domain from an AWS account, which is my primary concern. I have always felt their security procedures to be top-notch whenever I have dealt with them in this way, having used AWS for over 10 years. With other registrars I do not know how good their policies are. [0] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

This is way worse than it seems. With name, address, and last four credit card digits, there’s a very real threat that your other accounts can be hacked either by forgot-my-password or social engineering. Naoki Hiroshima lost the extremely rare Twitter handle @N because someone called up GoDaddy and knew his last four: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

Related to your warning, the story of that guy who lost his @n Twitter account because of that[1] (even though I think it still reduces the impact radius because until your password gets reset you can still access the service) [1]: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

The trouble is that opens another attack vector. This story[1] (previously discussed on HN[2]) comes to the opposite conclusion. Who is right? Is there a consensus in the security community? [1] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026… [2] https://news.ycombinator.com/item?id=20927465

It reminds me of how the owner of the @N account on Twitter had it stolen from him [0] [0] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

One worry about tying your identity to your own domain, is the security of your identity (aka your domain) hinges on the security of your registrar. If a bad actor can socially engineer their way into controlling your domain, your entire identity is compromised. Here's a blog post about this nightmare happening to someone: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

Then again, that's potentially an additional attack surface that you need to be mindful of: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

It's also the weak point - do you trust your domain provider he won't allow a domain move / access based on parts of your personal information, like here [0]? Also is it only domain block and not ip block? [0] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

There was this one guy who lost a valuable Twitter handle due to him using his custom domain email (via GoDaddy) as a login email.[0] I'd like to think imagine Google is better than GoDaddy when it comes to security and fighting social-engineering attacks but who knows. But if Google is a weak link wouldn't that also mean all our gmails are not as safe as we think? [0] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

The "OG account" stuff is fascinating. ( see e.g. https://waypoint.vice.com/en_us/article/43ebpd/the-long-weird-story-ex… for screenshots of forum or https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026… ). Also fascinating is that the only functional support channel is "write a blog post and hope a lot of people upvote it on a news aggregator". Two really interesting trends there.

Reminds me of the time my friend lost his single character Twitter account due to Godaddy social engineering. https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

Reminds me of this blog post [0] about a guy who lost his Twitter @N. [0] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

what about someone social engineering the registrar [1] or hacking the TLD nameservers [2] and getting control of all your accounts using that email? [1] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026… [2] https://thehackerblog.com/the-io-error-taking-control-of-all-io-domain…

Leveraging an email to steal anything is nothing new. If this is arguably a revelation, I should start asking this as an interview question. Also, the author never explicitly mentions to secure your email address. In the 2000s, domain hijackings were very common (as tedunangst mentioned): http://www.metafilter.com/3789/Adobecom-gets-hijacked http://archive.wired.com/politics/law/news/2000/04/35674?currentPage=a… Later on, it became short Twitter accounts: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026… https://www.wired.com/2016/06/deray-twitter-hack-2-factor-isnt-enough/ If your metric is how informative an article is, the above two links about Twitter accounts being hijacked are much more educational than original blogpost.

The combined online persona of those accounts is only as strong as their combined security. aka: Why would services need to collude when they can get the job done by ineptitude? https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

Yes. Double yes. Came here to leave that exact comment. Here is a pretty bad war story: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

You should think about security though. An interesting article you should read before deciding to use your own mail domain: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

Likely @n: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

Yes, it's @n. This is linked from the article: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

You have to be careful with that. If an attacker can gain access to your DNS provider, then they have access to your email: à la https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

> Somehow, the attacker got KVM access credentials for the server. [...] After he got KVM access, the attacker convinced NFOrce that he was me (using his KVM access as part of his evidence) and said that he had locked himself out of the server. So NFOrce reset the server's root password for him, giving him complete access to the server and bypassing most of our carefully-designed security measures... Ugh. We need to remember that social engineering your ISP, hosting provider, etc. is a very real attack vector. Do not trust them. Reminds me of the "N" twitter username story: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

Surprised not to see Apple's Hide My Email mentioned. I was moving towards using my_email+short_company_name@my_domain when it was released. I found problems with the + syntax occasionally, where I could sign up with that address but wasn't able to log in because their code stripped the + or the + and anything after that. Now I do 3 levels: 1) use Hide My Email with most companies 2) use me@my_domain with people I want to talk to 3) use my gmail address with Advanced Protection for really important things. I was going to use my_domain for really important things but it has 2 attack surfaces (registrar and Apple (I use their MX service)) whereas Gmail only has one. And there was an old (2014) article [0] here posted recently about how someone lost their Instagram handle because somebody social engineered GoDaddy into giving the attacker control of the person's domain. [0] https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026…

I've read a number of stories on the topic - the basic technique is to identify the domain registrar or DNS provider and attempt to manually reset the password by spear-phishing with the customer service rep. Once you're in, MX can be redirected to a host of the attacker's choice, and then you can initiate password resets on any number of third-party services. One example of a DNS-based MX hijack is http://arstechnica.com/security/2015/02/attackers-take-control-of-leno… although i'm at a loss to come up with some more specific (and exciting!) examples that i can clearly remember. It's a vulnerability that simply doesn't exist with gmail/hotmail/outlook.com addresses. Do you know whether your domain registrar and DNS providers' CSRs mandate 2FA or allow multiple attempts at guessing security questions? EDIT: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026… used the same attack.