Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks
Weak security defaults at Squarespace allegedly allowed attackers to hijack domains that had been migrated from Google Domains, by creating accounts tied to unverified email addresses and then taking control of associated DNS and Google Workspace settings. Commenters argue this reflects serious negligence in account and email verification design, and criticize Google for selling a security-sensitive, well-regarded registrar to a less capable buyer without a robust migration path. The incident has renewed broader distrust of consumer registrars, prompted recommendations for alternatives like Cloudflare, Porkbun, and others, and raised calls for stronger legal or market pressure to prioritize basic security practices.
Squarespace Vulnerability & Impact
- Core flaw: migrated Google Domains accounts landed in a “half-initialized” state; anyone who knew the email could sign up, set a password, and gain control without proving email ownership.
- Commenters describe this as gross negligence, especially for a large provider handling critical infrastructure (domains, Workspace reseller access).
- Concern that hijacked Squarespace accounts could create new Google Workspace admins for affected domains.
- Squarespace’s lack of a clear, official postmortem is criticized; users are unsure if the issue is fully fixed.
Google Domains Sale & Trust
- Many used Google Domains explicitly for perceived security and longevity; the sale to Squarespace is seen as a major breach of trust.
- Several argue domains fit Google’s core strengths and supported its cloud/PAAS ambitions, making the divestiture baffling.
- Internal-culture anecdotes depict Google as dominated by MBAs and cost-cutting, with products cut to enable layoffs and satisfy financial goals.
- Some moved domains elsewhere immediately upon hearing of the sale to avoid a forced bulk migration.
Registrar Choices & Migration Strategies
- Recommended registrars include Namecheap, Porkbun, Cloudflare, Dynadot, Joker, iwantmyname, infomaniak, OpenSRS/Hover, AWS (as reseller), NameISP.
- Experiences vary: praise for Porkbun support and security (e.g., hardware keys), criticism of Namecheap communications, and skepticism toward Cloudflare’s at-cost model and upsell pressure.
- Widespread distrust of the registrar industry overall; some fear any provider can be acquired or shut down.
- Best practice suggested: decouple DNS hosting from registrar to make registrar moves safer and less disruptive.
Email Verification & Security Practices
- Strong consensus that attaching unverified emails to accounts is dangerous; many products skip verification to improve conversion funnels.
- Suggestions include: legally requiring verification, strict separation of verified/unverified emails in databases, and making it hard for non-auth teams to rely on unverified addresses.
- Debate over how market forces and imperfect consumer information undermine security-focused choices.
Liability, Regulation & Organizational Dynamics
- Some want such security failures criminalized at the organizational level; others argue civil liability (tort/small claims) is the realistic lever.
- Dispute over whether developers or management should bear legal responsibility; concern that laws without enforcement just push risk downward.
- Advice to document security concerns in writing to create accountability, though there’s debate over motives and effectiveness.
Broader Industry & Career Reflections
- Defense-side cybersecurity roles are portrayed as frustrating: constant vendor noise, management penny-pinching, uncooperative users, and blame whether incidents happen or not.
- This resonates with those considering or already adjacent to security work.
- Squarespace is also criticized for product decisions (no backups, constrained DNS/MX control, simplistic workflows) seen as favoring marketing and design over robustness for less technical users.