How is domain privacy relevant here? That only hides your email from public records. What if the attacker already knows it (as they did in this case)? Email address is quite literally something you are meant to share publicly. It is not a password.

▲

Thrashed 2 hours ago | parent | next [-]

I think their point was that if WHOIS data were hidden, a password reset request that relied on providing the email address would've been impossible. But since NC's account management allows visitors to provide just a domain name to generate an unlock email, domain privacy wouldn't be a protective layer here.

▲

paxys an hour ago | parent [-]

I still don’t get the argument. Say I call your bank and convince them to give me full control of your account. Are you going to go “well the bank didn’t publish my account number anywhere, so they are in the clear”?

	▲	Thrashed an hour ago \| parent [-]
		I agree, it's not an excuse to hand over an account. I think that commenter was considering practical mitigations for a broken system, not necessarily absolving NC of responsibility had my WHOIS been public.

▲

vel0city 2 hours ago | parent | prev [-]

Registration info usually also includes a physical address and names.

▲

john_strinlai 2 hours ago | parent [-]

i agree that's important to hide, but also irrelevant to preventing what happened here.

▲

0x3f 2 hours ago | parent [-]

Seems pretty relevant to a social engineering attack to have more correct pieces of info to give to support.

	▲	john_strinlai 2 hours ago \| parent [-]
		by "what happened here" i mean this specific post. in this specific post, address information was not required.