Company said weakness in OAuth caused domain hijackings.
Squarespace (NYSE: SQSP) has posted a postmortem on a security incident that impacted mostly crypto/web3 company sites earlier this month.
Several web3 companies reported that their domain names, which were registered at Squarespace, were compromised and their DNS settings were hijacked.
The issue was detected on July 9. Squarespace suspended accounts with suspect behavior until it could isolate the issue.
Squarespace says the security weakness was related to OAuth logins, and it deployed a fix on July 12.
The security issue was not related to any changes to two-factor authentication when accounts migrated from Google Domains, the company stated:
During this incident, all compromised accounts were using third-party OAuth. Neither Squarespace nor any third-party authentication provider made any changes to authentication as part of our migration of Google Domains to Squarespace. To be clear, the migration of domains involved no changes to multi-factor authentication before, during or after.
This news is republished from another source. You can check the original article here
