6 ms·

GoDaddy store your passwords in clear and may access your VPS without permission

288 points by sucuri2 17y ago

howcool 17y ago
Gone Daddy! Who in their right mind would work with this funky company in the first place? They seem to be hiring morons. Or maybe they have the Superbowl models doing their Security.
fseek 17y ago
Way to go, godaddy!
- dasil003 17y ago
  I bet if you had said "Way to godaddy!" you would be sitting at -2 instead of -3 right now
hypermatt 17y ago
Thats really scary, trust is always a concern when your in a managed hosting solution. How do we know that people from their company aren't taking advantage, even if the Godaddy isn't trying to.
bshep 17y ago
Thats REALLY scary, I wonder how many passwords they store? just the previous? your whole password history?
andrewvc 17y ago
Sadly, I can't say I'm really surprised, this is GoDaddy after all. This is a company that has been shown to be consistently anti-customer time after time. Their founder's latest blog post, on the GoDaddy homepage, is titled '5 things I wish I learned in Business School. Plus ... a smoking HOT blonde.' That pretty much sums up their cynical view of their customers as sheep to me.
patio11 17y ago
This kind of freaks me out. If you told me somebody had cleaned out either my brokerage account or my GoDaddy account, I'd pray it was the brokerage account. There are much easier options for recovery from that. It's not that I don't trust GoDaddy. They've been good to me. It is just that I don't trust every person who might happen to see their data base in the next decade. Crikey, now I have to treat every password I've ever used there as compromised. Bleeeeeeech. [Edit: It occurs to me that I probably lose consistency points for this since I've previously argued that plain text passwords are "not that big of a deal." Thomas, I owe you a drink.]
- tptacek 17y ago
  As 'regularfry ably pointed out, you gave up your root password when you opted for a VPS. It's also standard operating procedure at hosting providers to escrow root access to systems. Some are better than others, but there are even colo providers that do this. My advice on this issue is simple: no matter who your hosting provider is, your password should be random and system-specific. You shouldn't be using a Unix password so often that you need to remember it. You don't use GoDaddy itself enough to justify a memorable password either. If you lose a random password, who cares?
  - patio11 17y ago
    As 'regularfry ably pointed out, you gave up your root password when you opted for a VPS. I don't have a VPS at GoDaddy. However, if their customer service reps can try his GoDaddy account passwords to attempt to log into his VPS, that means that GoDaddy is holding those in the clear somewhere, and that makes it very, very likely they are holding my passwords in the clear, too. That scares me because the prospect of a compromise of my GoDaddy account is really bad. It would allow an attacker to: 1) Compromise my DNS settings. Such as, e.g., MX records. So that they can compromise anything attached to my email address(es) without ever having to actually compromise my email provider. (Change MX record to point from Google Apps to L33t Hacker Krue, ask for password reset, watch as Internet obligingly delivers the email straight to their server.) 2) Compromise my SSL certificate. 3) My real nightmare: authorize transfer of my domains from my account at GoDaddy to their account at a disreputable registrar. They could either commercially exploit them or hold my business for ransom.
vinhboy 17y ago
Argh that really sucks. We should make a website that keeps track of these 'clear text' password people.
- CoryMathews 17y ago
  there is one that I found a while back but cannot seem to find for the life of me..
  - deleted 17y ago
    [deleted]
    - sparky 17y ago
      I think he means that he found a site that maintained a list of sites of NameCheap.
  - aw3c2 17y ago
    I don't get why you are downvoted. I too remember seeing that site.
- xs 17y ago
  this is why i use http://prq.se http://prq.se for hosting
  - blhack 17y ago
    Why, that's pretty impressive. It's too bad they don't offer VPS, :(.
  - sailormoon 17y ago
    Thanks a lot for that suggestion/link. I'm looking for new dedi hosting and I really love those guys. I'll be seriously thinking about moving to them. The most expensive combo package there is less than I pay right now. Plus, they're committed to privacy. Very very compelling. How has your uptime been? Had any problems?
callahad 17y ago
Would anyone be willing to skim their terms of service and see if they mention requiring access to your server?
- patio11 17y ago
  You acknowledge and agree that Go Daddy has the right to carry out a forensics examination in the event of a compromise to Your server or account.
  - sucuri2 17y ago
    I agree with that (and I also confess that I didn't read it before signing up). However, it doesn't say that they will do that WITHOUT your permission (or even asking first).
    - stingraycharles 17y ago
      Aren't you giving them permission when you agree with their terms?
      - Avenger42 17y ago
        I think that sentence should put the onus on them to prove "the event of a compromise to Your server or account".
        nitrogen 17y ago
        It doesn't say who has to compromise it.
memoryfault 17y ago
Hostmonster.com also stores your password in plaintext. When I called customer support once they asked me for the last 4 characters of my password. So, I asked the support guy "Can you see just the last 4 or can you see my whole password?" He told me he could see my whole password. W. T. F.
budu 17y ago
I've filled a complaint to GoDaddy support and I'm now looking for an alternative. What are your suggestions?
- cstejerean 17y ago
  If you want a VPS you should check out SliceHost.
  - ahi 17y ago
    RackSpace has turned SliceHost into a dead man walking. Linode has better pricing and a real future.
    - masomenos 17y ago
      Do you have any specifics, or is this just mud slinging? Longtime slicehost customer here, haven't seen any negative impact from the acquisition.
      - danieldon 17y ago
        See these for reference: http://news.ycombinator.com/item?id=1132138 http://news.ycombinator.com/item?id=1132138 http://journal.uggedal.com/vps-performance-comparison http://journal.uggedal.com/vps-performance-comparison http://news.ycombinator.com/item?id=966555 http://news.ycombinator.com/item?id=966555 http://journal.dedasys.com/2008/11/24/slicehost-vs-linode http://journal.dedasys.com/2008/11/24/slicehost-vs-linode Still, Slicehost is certainly one of the best VPS providers.
        nitrogen 17y ago
        Thanks for that list. The second link was particularly useful.
      - pavs 17y ago
        Not negative impact. I think his comment "dead man walking" was referring to the fact that they are less likely to innovate or make big changes to improve. There is always room for improve. Simple put, there are not the best VPS solution any more. But they are definitely one of the best. Others have caught up and in some cases surpassed slicehost, while Slicehost more or less stayed the same, they don't feel compelled to innovate or compete in terms of price and features. Rackspace dictates the terms. I am a former Slicehost customer. It was simply put the best hosting solution I ever had. If I were looking for a VPS solution now, there are other good or even better solution out there.
undefined_user 17y ago
One thing people should be aware of is that almost no VPS hosting solution is secure. The worst offender is Parallels/Virtuozzo(which I think godaddy uses). On the linux side. A root user on the host node can simply run the command vzctl enter 1111 and enter your vps without a password. To make things even scarier, when an admin enters your container this way. It doesnt leave a bash history file. You have a very small chance of ever knowing they entered the container at all. Even if they dont want to enter your container. They still have full access to all of your files which are located in in the /vz folder on the host node. Other vps solutions are slightly more secure. But it seems like %50 of the vps hosting industry is using virttozzo and most of them probably have no issue entering your container with or with out your permission.
- axod 17y ago
  If you don't trust your hosting provider, I think you have bigger issues.
  - sailormoon 17y ago
    Exactly right. Your hosting provider has physical access to the machine. There is no such thing as security under those circumstances.
    - olefoo 17y ago
      It's essentially DRM, except that you would be the media provider and the hosting company is the pirate. For your stuff to function you need to provide the cryptext, the decryption device and the key. So of course they have access.
- regularfry 17y ago
  It's simply not possible for a virtualised system to be secure from its host. Even if your filesystem is encrypted inside your slice, the kernel which decrypts it is an ordinary process running under their control. It's as well to assume that it can and will leak, and plan accordingly.
mbreese 17y ago
This is a little different than just a registrar having access to your passwords. I don't have a server with them, so I must admit, I'm more concerned with whether or not they have my domain account password in cleartext. If they do, I'll switch registrars immediately, just on the principle of the thing. That being said, I don't really care about them having your root password for your VPS. I really don't. Why? Because it's their server (physically). So, if they wanted access to it, they could just pull the hard drive and mount it in another computer. Your expectation of privacy just goes out the window if you don't own the hardware.
swombat 17y ago
Worth repeating for the nth time: just because they have access to your password doesn't mean it's stored in clear. They could simply be using a reversible encryption algorithm. This does not excuse them from accessing your VPS without your permission, of course, but the only thing you know about their password storage mechanism is it allows them to access your password when they need it. You have no idea what the procedure for this access is, or how exactly it's stored.
- sucuri2 17y ago
  Reversible encryption algorithm that an admin can use to get my password and access my servers == same as clear-text to me... The problem is not that they can get hacked and someone steal all their data, the problem is a malicious employee acessing my private server and my passwords. That's the issue.. unless they trust all their employees.
  - swombat 17y ago
    As others have pointed out, if you don't trust your host, you're hosed right from the start. If you want a private server, keep it in your closet. Having the password reversibly encrypted means that if someone gets their hands on a dump of the db, they will at least not be able to automatically gain access to millions of accounts with no effort. Depending on the encryption scheme used, it may even be extremely secure - for example, decryption could require sending the encrypted string to a different, extremely secure server off the WAN that answers with the password.
    - tptacek 17y ago
      In 15 years as a security professional and over 5 years directly consulting for big companies, little companies, locked down companies and lunatic companies, selling operating systems, browsers, parts of the power grid, cores of financial exchanges, retail banking applications, email management applications and to-do lists, I have never once seen the "extremely secure" system you allude to. I have seen lots of "reversable encryption", though. Maybe I've just gotten lucky in my career, and I just get the fun applications where people do this wrong. But there's no way GoDaddy did it right.
jbyers 17y ago
GoDaddy's business practices are awful. Their view of the rights of domain owners alone was reason enough for us to move all of our domains to Gandi. More expensive, fewer features, but at least they respect their customers.
agentq 17y ago
I found out the other day that DreamHost also stores control panel passwords in the clear.
- nfriedly 17y ago
  They also store ftp and database user passwords in clear text. In fact, the used to show the ftp user passwords in their control panel. Now it's hidden, but you can still access ftp user passwords via their api and you can get MySQL user passwords by doing a "one-click install" of something and then opening the config file.
  - andfarm 17y ago
    Correct. If having user service passwords stored in our database bothers you, log into a shell account and change the password with "passwd". We'll pick up the new password hash on our next user config and store the password internally as "changedbypasswd". You can also view MySQL user passwords by clicking on the username in the panel (https://panel.dreamhost.com/index.cgi?tree=goodies.mysql https://panel.dreamhost.com/index.cgi?tree=goodies.mysql). This shouldn't be a big deal, though, as you have to store the passwords in the clear in config files anyway.
- intranation 17y ago
  Citation...?
- samdk 17y ago
  Network Solutions also stores FTP passwords in cleartext, and anyone with access to the overall account can easily look them up.
- andfarm 17y ago
  We do not store control panel passwords "in the clear". They are stored as a hash and in a reversibly encrypted form; access to the plaintext passwords is heavily logged. We are considering removing it entirely -- the only reason we currently store panel passwords in any reversible format is because we frequently get emails from users who have forgotten their panel password and want us to email it to them.
holdenc 17y ago
There's a difference between storing passwords in clear text and not storing passwords as a one-way hash.
- epochwolf 17y ago
  If hundreds of people within the company can reverse the encryption on a password it might as well be in plain text.
regularfry 17y ago
This needs repeating: there is no way for a VPS provider not to have access to the internals of your VM; it is unrealistic to have such an expectation. It might not be unrealistic to expect them to ask before looking, but if your concern is "one bad apple" then you've already lost.
- peterwwillis 17y ago
  the important part is the difference between a compromised authentication secret and having local control over hardware/software. the password is now out in the open. there is now one more way for someone to root the slice other than getting control over the node(s) running the slice.
  - tptacek 17y ago
    If they have root on your VM, they have your root password too. We're talking about maybe a couple hundred lines of code, tops. It's clearly easier to get root passwords out of a database, but in the unlikely scenario where an internal employee sets out to sabotage the whole operation, a couple hundred lines of C code doesn't make the effort that much more unlikely. Don't get me wrong; storing the passwords in the clear is very bad. The thing that is really going to go wrong? Someone's going to commit a change to their web app that coughs up everyone's password to an outsider.
    - staunch 17y ago
      I think there's a pretty huge difference in the risk of a bad apple writing code and inserting it into the system vs a bad apple looking up a password and logging in normally. One requires significant sophistication and risk (of colleagues knowing your intentions are malicious), the other requires virtually no knowledge and low risk.
    - swolchok 17y ago
      > If they have root on your VM, they have your root password too. We're talking about maybe a couple hundred lines of code, tops. The default hash for crypt(3) (and thus /etc/shadow) in newer Linux distributions is salted SHA-512. Shouldn't that be significantly more difficult to crack than the old MD5 hashes? john didn't even support it when I checked a few months ago.
mcotton 17y ago
I know that when I worked for a major hosting company in 2001, we had our own SSH keys added to every VPS. This gave us access without needing their password. Right or wrong, it is very common at hosting companies.
rmk 17y ago
We use godaddy in our company for email and webpage hosting. It's not been a great experience. Storing passwords in the clear sucks. Why would they do that, unless their audience is primarily 'non-technical' people?
- stanleydrew 17y ago
  Because their audience is primarily 'non-technical' people. Have you seen their ads?!
  - rmk 17y ago
    Ha ha ha... well then, storing passwords in the clear? who cares :-)
sucuri2 17y ago
Update from Godaddy's CSO (Chief Security officer): http://blog.sucuri.net/2010/02/godaddy-security-update.html http://blog.sucuri.net/2010/02/godaddy-security-update.html
- stanleydrew 17y ago
  Wow, you're letting them off the hook pretty easily don't you think? Seems like this is a major breach of trust, worthy of a little more sustained anger no?
  - sucuri2 17y ago
    Not off the hook, no. The issue still stands that they store the passwords in a retrievable format. About them accessing the servers, he said that they will change their policy to communicate first with the client, which is a big PLUS for me. If anyone wants their malware removal service, it is fine for me. But just for calling back and talking about improvements, gives them a +1 (they are famous for ignoring their users). Plus, that happened almost two months ago (see the date in the logs) and this post was on my draft for a while... So the sustained anger had time to pass.
    - stanleydrew 17y ago
      Ah, didn't catch the date. I understand your anger may have subsided by now :) But to me this still seems like letting GoDaddy off the hook. I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password. The question is, if you are concerned about security at all, and you're not interested in taking advantage of that service, why would you continue to do business with a company that openly stores your password and makes it retrievable? Seems like you shouldn't care if they have some sort of "procedure" in place for password retrieval. That's almost irrelevant. It's time to move your business elsewhere.
      - nfnaaron 17y ago
        "I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password." This is so unusual, and so unexpected that it should have been in the TOS, at the top. This should NOT have been a surprise, with proper description of the REAL TOS, rather than just the written TOS. (I am assuming this isn't in the TOS, I'm not a GD customer.)
tensafefrogs 17y ago
I just checked directnic.com, and they seem to store passwords in clear text as well (if you retreive your password, they email it to you(!))
jcapote 17y ago
And here I thought that GoDaddy was the bastion of perfection in our technology landscape </sarcasm>
IgorPartola 17y ago
The real question here is, who do you recommend as an alternative. Thankfully, the domain name registrar market is not monopolized by GoDaddy, but I have never used anybody else.
- pavs 17y ago
  Godaddy is one of the worst choice for hosting. Also, avoid media temple. So, basically most well known hosts, other than these two, are good choices.
  - IgorPartola 17y ago
    Thanks for the advice. Currently I put my faith into the following list of companies: * GoDaddy - registrar * Tocici/BuildYourVPS.com - VPS server * EveryDNS GoDaddy is by far the biggest pain in the @$$ to use out of these.
st3fan 17y ago
Automatic malware removal on Linux systems? Get real.
olefoo 17y ago
Not really surprised by this. GoDaddy is horrible on so many levels, selling chained certificates without telling you what that implies until after you purchase; ganking peoples domains at the behest of third parties without going through UDRP. And if you've ever had to deal with them you may agree with me when I say that their website constitutes criminal negligence on the part of the UI/UX designer. Deceptive and high-pressure sales tactics are a bad sign; especially in a company that wants so much of your trust.
coverband 17y ago
I think the standard practice with other providers is to have a separate admin account that can login to the VPS and whose actions are easily audited. Using the VPS owner's account and password is ridiculous and could cause a legal liability for the VPS owner.
Periodic 17y ago
A tool that I wish more people would use is PwdHash (https://www.pwdhash.com/ https://www.pwdhash.com/). It's a system for generating psudo-random passwords for the web. Basically, it will take some input from you (a password) and then hash that with the domain name of the site you're accessing and supply that when you actually submit the form. This means that my GoDaddy password would be "O0ErvdwEiy" instead of "asdfasdf". It helps protect you against sites that may store your password in plain text because a compromise of one system does not mean a compromise of all systems. It's fairly painless to use, but is only supported as a Firefox extension or through their website. There are some issues with sites that use different domains for their login servers or that use flash for their login dialog (yes, they exist).
pibefision 17y ago
How could someone expect a minimum serious service of a provider named "Go Daddy". Really, this is not ironic.
- froo 17y ago
  What a bizarre statement. I really don't see the correlation between a memorable (and thus brandable) business name and business performance. Some of the web's biggest and most respected properties have almost whimsical names, but that doesn't reduce their "street cred" so to speak.
rogermugs 17y ago
people always say they're such a great domain registrar... its the least navigable site i've ever used in my life. i will always use enom via google.
yameighty 17y ago
ffdsfds
deleted 17y ago
[deleted]
sidbatra 17y ago
It makes sense if they need to do maintenance but there has to be some code of conduct / guidelines for a VPS provider. Either way, I stopped using Godaddy a while back - slicehost is amazing for developers and hackers.

288 points by sucuri2 17y ago

Gone Daddy! Who in their right mind would work with this funky company in the first place? They seem to be hiring morons. Or maybe they have the Superbowl models doing their Security.

fseek 17y ago

Way to go, godaddy!

dasil003 17y ago
I bet if you had said "Way to godaddy!" you would be sitting at -2 instead of -3 right now

hypermatt 17y ago

Thats really scary, trust is always a concern when your in a managed hosting solution. How do we know that people from their company aren't taking advantage, even if the Godaddy isn't trying to.

bshep 17y ago

Thats REALLY scary, I wonder how many passwords they store? just the previous? your whole password history?

andrewvc 17y ago

Sadly, I can't say I'm really surprised, this is GoDaddy after all. This is a company that has been shown to be consistently anti-customer time after time. Their founder's latest blog post, on the GoDaddy homepage, is titled '5 things I wish I learned in Business School. Plus ... a smoking HOT blonde.' That pretty much sums up their cynical view of their customers as sheep to me.

patio11 17y ago

This kind of freaks me out. If you told me somebody had cleaned out either my brokerage account or my GoDaddy account, I'd pray it was the brokerage account. There are much easier options for recovery from that. It's not that I don't trust GoDaddy. They've been good to me. It is just that I don't trust every person who might happen to see their data base in the next decade. Crikey, now I have to treat every password I've ever used there as compromised. Bleeeeeeech. [Edit: It occurs to me that I probably lose consistency points for this since I've previously argued that plain text passwords are "not that big of a deal." Thomas, I owe you a drink.]

tptacek 17y ago
As 'regularfry ably pointed out, you gave up your root password when you opted for a VPS. It's also standard operating procedure at hosting providers to escrow root access to systems. Some are better than others, but there are even colo providers that do this. My advice on this issue is simple: no matter who your hosting provider is, your password should be random and system-specific. You shouldn't be using a Unix password so often that you need to remember it. You don't use GoDaddy itself enough to justify a memorable password either. If you lose a random password, who cares?
- patio11 17y ago
  As 'regularfry ably pointed out, you gave up your root password when you opted for a VPS. I don't have a VPS at GoDaddy. However, if their customer service reps can try his GoDaddy account passwords to attempt to log into his VPS, that means that GoDaddy is holding those in the clear somewhere, and that makes it very, very likely they are holding my passwords in the clear, too. That scares me because the prospect of a compromise of my GoDaddy account is really bad. It would allow an attacker to: 1) Compromise my DNS settings. Such as, e.g., MX records. So that they can compromise anything attached to my email address(es) without ever having to actually compromise my email provider. (Change MX record to point from Google Apps to L33t Hacker Krue, ask for password reset, watch as Internet obligingly delivers the email straight to their server.) 2) Compromise my SSL certificate. 3) My real nightmare: authorize transfer of my domains from my account at GoDaddy to their account at a disreputable registrar. They could either commercially exploit them or hold my business for ransom.

vinhboy 17y ago

Argh that really sucks. We should make a website that keeps track of these 'clear text' password people.

CoryMathews 17y ago
there is one that I found a while back but cannot seem to find for the life of me..
- deleted 17y ago
  [deleted]
  - sparky 17y ago
    I think he means that he found a site that maintained a list of sites of NameCheap.
- aw3c2 17y ago
  I don't get why you are downvoted. I too remember seeing that site.
xs 17y ago
this is why i use http://prq.se http://prq.se for hosting
- blhack 17y ago
  Why, that's pretty impressive. It's too bad they don't offer VPS, :(.
- sailormoon 17y ago
  Thanks a lot for that suggestion/link. I'm looking for new dedi hosting and I really love those guys. I'll be seriously thinking about moving to them. The most expensive combo package there is less than I pay right now. Plus, they're committed to privacy. Very very compelling. How has your uptime been? Had any problems?

callahad 17y ago

Would anyone be willing to skim their terms of service and see if they mention requiring access to your server?

patio11 17y ago
You acknowledge and agree that Go Daddy has the right to carry out a forensics examination in the event of a compromise to Your server or account.
- sucuri2 17y ago
  I agree with that (and I also confess that I didn't read it before signing up). However, it doesn't say that they will do that WITHOUT your permission (or even asking first).
  - stingraycharles 17y ago
    Aren't you giving them permission when you agree with their terms?
    - Avenger42 17y ago
      I think that sentence should put the onus on them to prove "the event of a compromise to Your server or account".
      - nitrogen 17y ago
        It doesn't say who has to compromise it.

memoryfault 17y ago

Hostmonster.com also stores your password in plaintext. When I called customer support once they asked me for the last 4 characters of my password. So, I asked the support guy "Can you see just the last 4 or can you see my whole password?" He told me he could see my whole password. W. T. F.

budu 17y ago

I've filled a complaint to GoDaddy support and I'm now looking for an alternative. What are your suggestions?

cstejerean 17y ago
If you want a VPS you should check out SliceHost.
- ahi 17y ago
  RackSpace has turned SliceHost into a dead man walking. Linode has better pricing and a real future.
  - masomenos 17y ago
    Do you have any specifics, or is this just mud slinging? Longtime slicehost customer here, haven't seen any negative impact from the acquisition.
    - danieldon 17y ago
      See these for reference: http://news.ycombinator.com/item?id=1132138 http://news.ycombinator.com/item?id=1132138 http://journal.uggedal.com/vps-performance-comparison http://journal.uggedal.com/vps-performance-comparison http://news.ycombinator.com/item?id=966555 http://news.ycombinator.com/item?id=966555 http://journal.dedasys.com/2008/11/24/slicehost-vs-linode http://journal.dedasys.com/2008/11/24/slicehost-vs-linode Still, Slicehost is certainly one of the best VPS providers.
      - nitrogen 17y ago
        Thanks for that list. The second link was particularly useful.
    - pavs 17y ago
      Not negative impact. I think his comment "dead man walking" was referring to the fact that they are less likely to innovate or make big changes to improve. There is always room for improve. Simple put, there are not the best VPS solution any more. But they are definitely one of the best. Others have caught up and in some cases surpassed slicehost, while Slicehost more or less stayed the same, they don't feel compelled to innovate or compete in terms of price and features. Rackspace dictates the terms. I am a former Slicehost customer. It was simply put the best hosting solution I ever had. If I were looking for a VPS solution now, there are other good or even better solution out there.

undefined_user 17y ago

One thing people should be aware of is that almost no VPS hosting solution is secure. The worst offender is Parallels/Virtuozzo(which I think godaddy uses). On the linux side. A root user on the host node can simply run the command vzctl enter 1111 and enter your vps without a password. To make things even scarier, when an admin enters your container this way. It doesnt leave a bash history file. You have a very small chance of ever knowing they entered the container at all. Even if they dont want to enter your container. They still have full access to all of your files which are located in in the /vz folder on the host node. Other vps solutions are slightly more secure. But it seems like %50 of the vps hosting industry is using virttozzo and most of them probably have no issue entering your container with or with out your permission.

axod 17y ago
If you don't trust your hosting provider, I think you have bigger issues.
- sailormoon 17y ago
  Exactly right. Your hosting provider has physical access to the machine. There is no such thing as security under those circumstances.
  - olefoo 17y ago
    It's essentially DRM, except that you would be the media provider and the hosting company is the pirate. For your stuff to function you need to provide the cryptext, the decryption device and the key. So of course they have access.
regularfry 17y ago
It's simply not possible for a virtualised system to be secure from its host. Even if your filesystem is encrypted inside your slice, the kernel which decrypts it is an ordinary process running under their control. It's as well to assume that it can and will leak, and plan accordingly.

mbreese 17y ago

This is a little different than just a registrar having access to your passwords. I don't have a server with them, so I must admit, I'm more concerned with whether or not they have my domain account password in cleartext. If they do, I'll switch registrars immediately, just on the principle of the thing. That being said, I don't really care about them having your root password for your VPS. I really don't. Why? Because it's their server (physically). So, if they wanted access to it, they could just pull the hard drive and mount it in another computer. Your expectation of privacy just goes out the window if you don't own the hardware.

swombat 17y ago

Worth repeating for the nth time: just because they have access to your password doesn't mean it's stored in clear. They could simply be using a reversible encryption algorithm. This does not excuse them from accessing your VPS without your permission, of course, but the only thing you know about their password storage mechanism is it allows them to access your password when they need it. You have no idea what the procedure for this access is, or how exactly it's stored.

sucuri2 17y ago
Reversible encryption algorithm that an admin can use to get my password and access my servers == same as clear-text to me... The problem is not that they can get hacked and someone steal all their data, the problem is a malicious employee acessing my private server and my passwords. That's the issue.. unless they trust all their employees.
- swombat 17y ago
  As others have pointed out, if you don't trust your host, you're hosed right from the start. If you want a private server, keep it in your closet. Having the password reversibly encrypted means that if someone gets their hands on a dump of the db, they will at least not be able to automatically gain access to millions of accounts with no effort. Depending on the encryption scheme used, it may even be extremely secure - for example, decryption could require sending the encrypted string to a different, extremely secure server off the WAN that answers with the password.
  - tptacek 17y ago
    In 15 years as a security professional and over 5 years directly consulting for big companies, little companies, locked down companies and lunatic companies, selling operating systems, browsers, parts of the power grid, cores of financial exchanges, retail banking applications, email management applications and to-do lists, I have never once seen the "extremely secure" system you allude to. I have seen lots of "reversable encryption", though. Maybe I've just gotten lucky in my career, and I just get the fun applications where people do this wrong. But there's no way GoDaddy did it right.

jbyers 17y ago

GoDaddy's business practices are awful. Their view of the rights of domain owners alone was reason enough for us to move all of our domains to Gandi. More expensive, fewer features, but at least they respect their customers.

agentq 17y ago

I found out the other day that DreamHost also stores control panel passwords in the clear.

nfriedly 17y ago
They also store ftp and database user passwords in clear text. In fact, the used to show the ftp user passwords in their control panel. Now it's hidden, but you can still access ftp user passwords via their api and you can get MySQL user passwords by doing a "one-click install" of something and then opening the config file.
- andfarm 17y ago
  Correct. If having user service passwords stored in our database bothers you, log into a shell account and change the password with "passwd". We'll pick up the new password hash on our next user config and store the password internally as "changedbypasswd". You can also view MySQL user passwords by clicking on the username in the panel (https://panel.dreamhost.com/index.cgi?tree=goodies.mysql https://panel.dreamhost.com/index.cgi?tree=goodies.mysql). This shouldn't be a big deal, though, as you have to store the passwords in the clear in config files anyway.
intranation 17y ago
Citation...?
samdk 17y ago
Network Solutions also stores FTP passwords in cleartext, and anyone with access to the overall account can easily look them up.
andfarm 17y ago
We do not store control panel passwords "in the clear". They are stored as a hash and in a reversibly encrypted form; access to the plaintext passwords is heavily logged. We are considering removing it entirely -- the only reason we currently store panel passwords in any reversible format is because we frequently get emails from users who have forgotten their panel password and want us to email it to them.

holdenc 17y ago

There's a difference between storing passwords in clear text and not storing passwords as a one-way hash.

epochwolf 17y ago
If hundreds of people within the company can reverse the encryption on a password it might as well be in plain text.

regularfry 17y ago

This needs repeating: there is no way for a VPS provider not to have access to the internals of your VM; it is unrealistic to have such an expectation. It might not be unrealistic to expect them to ask before looking, but if your concern is "one bad apple" then you've already lost.

peterwwillis 17y ago
the important part is the difference between a compromised authentication secret and having local control over hardware/software. the password is now out in the open. there is now one more way for someone to root the slice other than getting control over the node(s) running the slice.
- tptacek 17y ago
  If they have root on your VM, they have your root password too. We're talking about maybe a couple hundred lines of code, tops. It's clearly easier to get root passwords out of a database, but in the unlikely scenario where an internal employee sets out to sabotage the whole operation, a couple hundred lines of C code doesn't make the effort that much more unlikely. Don't get me wrong; storing the passwords in the clear is very bad. The thing that is really going to go wrong? Someone's going to commit a change to their web app that coughs up everyone's password to an outsider.
  - staunch 17y ago
    I think there's a pretty huge difference in the risk of a bad apple writing code and inserting it into the system vs a bad apple looking up a password and logging in normally. One requires significant sophistication and risk (of colleagues knowing your intentions are malicious), the other requires virtually no knowledge and low risk.
  - swolchok 17y ago
    > If they have root on your VM, they have your root password too. We're talking about maybe a couple hundred lines of code, tops. The default hash for crypt(3) (and thus /etc/shadow) in newer Linux distributions is salted SHA-512. Shouldn't that be significantly more difficult to crack than the old MD5 hashes? john didn't even support it when I checked a few months ago.

mcotton 17y ago

I know that when I worked for a major hosting company in 2001, we had our own SSH keys added to every VPS. This gave us access without needing their password. Right or wrong, it is very common at hosting companies.

rmk 17y ago

We use godaddy in our company for email and webpage hosting. It's not been a great experience. Storing passwords in the clear sucks. Why would they do that, unless their audience is primarily 'non-technical' people?

stanleydrew 17y ago
Because their audience is primarily 'non-technical' people. Have you seen their ads?!
- rmk 17y ago
  Ha ha ha... well then, storing passwords in the clear? who cares :-)

sucuri2 17y ago

Update from Godaddy's CSO (Chief Security officer): http://blog.sucuri.net/2010/02/godaddy-security-update.html http://blog.sucuri.net/2010/02/godaddy-security-update.html

stanleydrew 17y ago
Wow, you're letting them off the hook pretty easily don't you think? Seems like this is a major breach of trust, worthy of a little more sustained anger no?
- sucuri2 17y ago
  Not off the hook, no. The issue still stands that they store the passwords in a retrievable format. About them accessing the servers, he said that they will change their policy to communicate first with the client, which is a big PLUS for me. If anyone wants their malware removal service, it is fine for me. But just for calling back and talking about improvements, gives them a +1 (they are famous for ignoring their users). Plus, that happened almost two months ago (see the date in the logs) and this post was on my draft for a while... So the sustained anger had time to pass.
  - stanleydrew 17y ago
    Ah, didn't catch the date. I understand your anger may have subsided by now :) But to me this still seems like letting GoDaddy off the hook. I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password. The question is, if you are concerned about security at all, and you're not interested in taking advantage of that service, why would you continue to do business with a company that openly stores your password and makes it retrievable? Seems like you shouldn't care if they have some sort of "procedure" in place for password retrieval. That's almost irrelevant. It's time to move your business elsewhere.
    - nfnaaron 17y ago
      "I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password." This is so unusual, and so unexpected that it should have been in the TOS, at the top. This should NOT have been a surprise, with proper description of the REAL TOS, rather than just the written TOS. (I am assuming this isn't in the TOS, I'm not a GD customer.)

tensafefrogs 17y ago

I just checked directnic.com, and they seem to store passwords in clear text as well (if you retreive your password, they email it to you(!))

jcapote 17y ago

And here I thought that GoDaddy was the bastion of perfection in our technology landscape </sarcasm>

IgorPartola 17y ago

The real question here is, who do you recommend as an alternative. Thankfully, the domain name registrar market is not monopolized by GoDaddy, but I have never used anybody else.

pavs 17y ago
Godaddy is one of the worst choice for hosting. Also, avoid media temple. So, basically most well known hosts, other than these two, are good choices.
- IgorPartola 17y ago
  Thanks for the advice. Currently I put my faith into the following list of companies: * GoDaddy - registrar * Tocici/BuildYourVPS.com - VPS server * EveryDNS GoDaddy is by far the biggest pain in the @$$ to use out of these.

st3fan 17y ago

Automatic malware removal on Linux systems? Get real.

olefoo 17y ago

Not really surprised by this. GoDaddy is horrible on so many levels, selling chained certificates without telling you what that implies until after you purchase; ganking peoples domains at the behest of third parties without going through UDRP. And if you've ever had to deal with them you may agree with me when I say that their website constitutes criminal negligence on the part of the UI/UX designer. Deceptive and high-pressure sales tactics are a bad sign; especially in a company that wants so much of your trust.

coverband 17y ago

I think the standard practice with other providers is to have a separate admin account that can login to the VPS and whose actions are easily audited. Using the VPS owner's account and password is ridiculous and could cause a legal liability for the VPS owner.

Periodic 17y ago

A tool that I wish more people would use is PwdHash (https://www.pwdhash.com/ https://www.pwdhash.com/). It's a system for generating psudo-random passwords for the web. Basically, it will take some input from you (a password) and then hash that with the domain name of the site you're accessing and supply that when you actually submit the form. This means that my GoDaddy password would be "O0ErvdwEiy" instead of "asdfasdf". It helps protect you against sites that may store your password in plain text because a compromise of one system does not mean a compromise of all systems. It's fairly painless to use, but is only supported as a Firefox extension or through their website. There are some issues with sites that use different domains for their login servers or that use flash for their login dialog (yes, they exist).

pibefision 17y ago

How could someone expect a minimum serious service of a provider named "Go Daddy". Really, this is not ironic.

froo 17y ago
What a bizarre statement. I really don't see the correlation between a memorable (and thus brandable) business name and business performance. Some of the web's biggest and most respected properties have almost whimsical names, but that doesn't reduce their "street cred" so to speak.

rogermugs 17y ago

people always say they're such a great domain registrar... its the least navigable site i've ever used in my life. i will always use enom via google.

yameighty 17y ago

ffdsfds

deleted 17y ago

[deleted]

sidbatra 17y ago

It makes sense if they need to do maintenance but there has to be some code of conduct / guidelines for a VPS provider. Either way, I stopped using Godaddy a while back - slicehost is amazing for developers and hackers.