Guess How Ridiculously Insecure 1and1 Is…

[Shane]

I called up 1and1 to ensure a transfer would be accepted. I had absolutely no information regarding my account other than the domain name that was registered with them. So they looked up my account by domain and had me "confirm" my account by asking my full name! This means anyone who knows how to use WHOIS can gain access to your account. Don't trust them.

 

[amplify]

Let me social engineer a domain name transfer from your account to mine. Then, for certain they need to get their shit together.

 

[Shane]

Would love to test that out but I only have the one domain there, which has already been sold.

 

[amplify]

I'll get them to cancel the transfer, because I'm the real Shane B!

 

[atomic]

Look's like you just created the problem Shane by telling everybody.. I bet there are some guys calling up 1&1 as we speak, getting some nice names transferred

 

[amplify]

Way to go Shane. Way to go. Everyone is now scraping the whois databases to find LLL.com's with 1and1 as a registrar. Up next on DomainGang, 542 LLL.com's hijacked.

 

[Shane]

I'll get them to cancel the transfer, because I'm the real Shane B!

LOL. It's amazing how easy it is to get the personal information of fellow domainers. Just the other day I randomly received a call from Focus about a domain I sold him. It tripped me out.

 

[Shane]

Look's like you just created the problem Shane by telling everybody.. I bet there are some guys calling up 1&1 as we speak, getting some nice names transferred

Hah, probably true. Still, everyone needs to know so they can secure their domains. The only thing they won't do is unlock the domain for you. So providing all your domains are locked it shouldn't be a huge problem. Unfortunately, if you're selling a domain or in the process of transferring it you're at risk.

 

[Shane]

Way to go Shane. Way to go. Everyone is now scraping the whois databases to find LLL.com's with 1and1 as a registrar. Up next on DomainGang, 542 LLL.com's hijacked.

If you're keeping domains at 1and1 you deserve to be hijacked. They are absolutely awful.

 

[amplify]

Was @Focus on his superyacht or chillin in his Cayman Islands mansion when he called?

 

[Shane]

I believe he was with his super model girlfriend's best friend.

 

[draggar]

The largest surprise to me from this thread is that people still use 1&1?

But this is a serious issue, though.

 

[domainoid]

I called up 1and1 to ensure a transfer would be accepted. I had absolutely no information regarding my account other than the domain name that was registered with them. So they looked up my account by domain and had me "confirm" my account by asking my full name! This means anyone who knows how to use WHOIS can gain access to your account. Don't trust them.

are you kidding me? a scammer gives them your full name and that's enough for those morons? never had a name there and never will.