Namecheap still doesn't support 2FA in 2017 (update: they do now!)

Namecheap supports an outdated form of 2FA, namely SMS-based authentication. It doesn’t support the modern crypto-based 2FA you probably know from using Google Authenticator (or Authy). Namecheap instead send you a numeric code by SMS that you enter. This sounds like a good idea, but it’s not anymore:

It’s been proven repeatedly over the last few years that SMS is insecure and easily hijackable. Just this week someone’s Verizon phone got socially engineered and hacked:

He recommends to disable SMS 2FA on all your accounts:

In Namecheap’s case that means no 2FA at all, because SMS 2FA is all they offer in 2017.

Now, people run million dollar businesses with Namecheap domains that are literally secured by a single SMS code. Domains are a great attack vector: take control over someone’s domains, and you can deface or impersonate them copying their website or receive ALL the domain’s email coming in. As well as sending email impersonating them. From there you can get request Forget Password on people’s user accounts on any platform and in turn break in to those accounts. That means potentially access to people’s private email, social media accounts, badly secured bitcoin wallets (e.g. on Bitstamp) and any service where you have auto-payment enabled, which means they can just buy a lot of stuff and you’ll pay for it. We know this. Namecheap knows this.

And we knew this 4 years ago already, so we asked them to add Google 2FA:

I asked them about it 3 years ago:

Even Matt Cuts from Google asked:

Then 2 years ago:

1 year ago:

Today:

That’s an awfully long time to “build” 2-factor authentication isn’t it?

Implementing 2FA is not trivial at the level of Namecheap. It’s a giant company, with probably millions of users accounts. It needs to be developed and tested. You don’t want to make security WORSE if you implement it badly. I get it.

But it shouldn’t take 4 years. It should take maybe 4 months or a bit longer. Something else is going on and Namecheap isn’t talking.

This isn’t just “annoying” anymore, this is now a solid attack vector for any and all Namecheap customers.

Namecheap, 2017 is calling, are you going to pickup?

Update: Yes, after 3 years Namecheap finally picked up. I received a Twitter DM after this post from one of their amazing support reps with more details why 2FA wasn’t ready yet:

We made the difficult decision to pause all new integrations and features until we could build and deliver a new platform that would set our technology development free. Finally, we are approaching the end of that process.

TL;DR it was a big engineering struggle. I told them to just tell that instead of beating around the bush. People are okay, but please just be transparent. So they did:

2FA was the most urgent priority that had to be sidelined while we built that capability. It is now first in the queue to be addressed. As CEO of Namecheap, I give you my commitment that we will deliver true 2FA within the next 60 days.

— Richard Kirkendall NameCheap blog

That means, in 60 days, that’s ~ 10 July 2017, Namecheap supports 2FA. Let’s hope they can make it! If not, cue Twitter Outrage II…

Update 2017-07-12: We did it! All our pressure worked. Namecheap has introduced true 2FA. Not via Google Authenticator, but via their iOS app to approve or deny log in attempts with fingerprint authentication: