So Tuesday night nytimes.com just stops loading. Not "server error" not loading, but weird-redirect-to-a-political-message not loading. Twitter's image domain got hit too, so for a few hours a bunch of embedded images across the web were just broken or replaced. Everyone's already written the "SEA hacks the Times" post this week so I'm not going to rehash the whole timeline. What I actually want to talk about is the part that stuck with me, which is that nobody broke into the New York Times. They broke into a reseller of MelbourneIT, the company that manages the DNS records for nytimes.com, and just... pointed the domain somewhere else for a while.
That's the bit that made me go check my own stuff, because I realized I genuinely didn't know how secure the account is that controls where techpad points on the internet.
Here's the thing people don't think about: your registrar login is arguably more important than your email password. If someone gets into your email you're having a very bad day. If someone gets into your registrar, they can point your entire domain at a server they control, and depending on your TTL settings that can stick around, cached, for hours or days after you notice and fix it. DNS changes don't get "undone" instantly. They propagate back out slowly, the exact same way they propagated in.
So I spent about forty minutes this afternoon actually auditing this instead of just assuming it was fine, and here's what I'd tell anyone else running a personal site to go check right now:
Does your registrar even offer two-factor? Mine, embarrassingly, did not have it turned on. It was available, buried three menus deep under account settings, and I'd just never bothered. Took five minutes with Google Authenticator on my phone. If your registrar doesn't support 2FA at all, that's worth factoring into whether you stay with them.
Is your registrar email actually secure? A lot of account recovery flows just fall back to "click the link we emailed you," which means your DNS security is only as good as your email security. If your email password is reused anywhere, fix that first. I use LastPass for this stuff and I'll be honest, I resisted a password manager for years because I didn't want to trust one company with everything, and then I realized I was reusing three passwords across forty sites, which is objectively dumber.
Registry lock. Some registrars offer this and most people have never heard of it. It requires an extra manual verification step (sometimes a phone call) before DNS records can change at all, which is obviously more friction, but for a domain that matters to you, that friction is the whole point.
Check who your registrar actually is. This one surprised me a little. A lot of us don't register directly, we go through a reseller because it's five dollars cheaper, and then we have no idea who's actually holding the keys upstream, or what their security practices look like. MelbourneIT is a legitimately large, well known registrar and this still happened to them through a reseller account. Cheaper isn't always cheaper.
None of this is exotic advice. It's the stuff that's been sitting in "get to it eventually" folders for most of us, mine included, since I set this domain up back in 2011 and never touched the security settings again. I run a small personal blog nobody's going to phish a nation-state actor over, and I still felt a little sick realizing how easy it would've been for someone to just take it.
One petty complaint while I'm in here: GoDaddy's account settings UI, which I have to deal with for a different domain I manage for a friend's small business, is genuinely one of the worst admin panels I've used, cluttered with upsells at every single step where you're trying to find a security toggle. I don't understand how that's still the experience in 2013.
Anyway. Go check your registrar settings this week. It takes less time than reading the six other posts about this hack did.