5 ms·

Update from Godaddy's CSO (Chief Security officer): http://blog.sucuri.net/2010/02/godaddy-security-update.html http://blog.sucuri.net/2010/02/godaddy-security

by sucuri2 17y ago

Update from Godaddy's CSO (Chief Security officer): http://blog.sucuri.net/2010/02/godaddy-security-update.html http://blog.sucuri.net/2010/02/godaddy-security-update.html

stanleydrew 17y ago
Wow, you're letting them off the hook pretty easily don't you think? Seems like this is a major breach of trust, worthy of a little more sustained anger no?
- sucuri2 17y ago
  Not off the hook, no. The issue still stands that they store the passwords in a retrievable format. About them accessing the servers, he said that they will change their policy to communicate first with the client, which is a big PLUS for me. If anyone wants their malware removal service, it is fine for me. But just for calling back and talking about improvements, gives them a +1 (they are famous for ignoring their users). Plus, that happened almost two months ago (see the date in the logs) and this post was on my draft for a while... So the sustained anger had time to pass.
  - stanleydrew 17y ago
    Ah, didn't catch the date. I understand your anger may have subsided by now :) But to me this still seems like letting GoDaddy off the hook. I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password. The question is, if you are concerned about security at all, and you're not interested in taking advantage of that service, why would you continue to do business with a company that openly stores your password and makes it retrievable? Seems like you shouldn't care if they have some sort of "procedure" in place for password retrieval. That's almost irrelevant. It's time to move your business elsewhere.
    - nfnaaron 17y ago
      "I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password." This is so unusual, and so unexpected that it should have been in the TOS, at the top. This should NOT have been a surprise, with proper description of the REAL TOS, rather than just the written TOS. (I am assuming this isn't in the TOS, I'm not a GD customer.)
callahad 17y ago
Accompanied by a flood of damage control tweets: http://twitter.com/GoDaddy http://twitter.com/GoDaddy
sev 17y ago
They store all the passwords encrypted (not one-way hashed which is the recommended), and they can only be retrieved and reversed after a member of the security team opens a ticket and explains the reason for using the password (like to investigate malware) They got root access (at least most hosts I know do), why would they need to reverse an encrypted password that would give them less access than what they already should have? Seems like BS.
- andfarm 17y ago
  Customer writes in, asks "I forgot my [FTP/mail/panel/etc] password, what is it?". Changing the password isn't necessarily an option, as the password may be saved in their FTP/mail client, or on their web designer's computer, or whatnot.
  - sev 17y ago
    GoDaddy store your passwords in clear-text and may try to SSH to your VPS without permission That's the title of the post. without permission -- what you're saying could be true; however, permission is granted in that case.
DavidSJ 17y ago
The encryption and process surrounding accessing passwords is meaningless. Who guards the encryption key, and how is this any better than storing passwords in the clear in some password-protected database? The point is, the person with this key can view -- and possibly lose -- your password (which you may, but shouldn't, use in other places). And once someone goes through this process, they can take it home with them. The choice to do this, rather than to use an SSH key, is indefensible, and their explanation shows that they haven't got a clue.

by sucuri2 17y ago

Update from Godaddy's CSO (Chief Security officer): http://blog.sucuri.net/2010/02/godaddy-security-update.html http://blog.sucuri.net/2010/02/godaddy-security-update.html

stanleydrew 17y ago

Wow, you're letting them off the hook pretty easily don't you think? Seems like this is a major breach of trust, worthy of a little more sustained anger no?

sucuri2 17y ago
Not off the hook, no. The issue still stands that they store the passwords in a retrievable format. About them accessing the servers, he said that they will change their policy to communicate first with the client, which is a big PLUS for me. If anyone wants their malware removal service, it is fine for me. But just for calling back and talking about improvements, gives them a +1 (they are famous for ignoring their users). Plus, that happened almost two months ago (see the date in the logs) and this post was on my draft for a while... So the sustained anger had time to pass.
- stanleydrew 17y ago
  Ah, didn't catch the date. I understand your anger may have subsided by now :) But to me this still seems like letting GoDaddy off the hook. I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password. The question is, if you are concerned about security at all, and you're not interested in taking advantage of that service, why would you continue to do business with a company that openly stores your password and makes it retrievable? Seems like you shouldn't care if they have some sort of "procedure" in place for password retrieval. That's almost irrelevant. It's time to move your business elsewhere.
  - nfnaaron 17y ago
    "I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password." This is so unusual, and so unexpected that it should have been in the TOS, at the top. This should NOT have been a surprise, with proper description of the REAL TOS, rather than just the written TOS. (I am assuming this isn't in the TOS, I'm not a GD customer.)

callahad 17y ago

Accompanied by a flood of damage control tweets: http://twitter.com/GoDaddy http://twitter.com/GoDaddy

sev 17y ago

They store all the passwords encrypted (not one-way hashed which is the recommended), and they can only be retrieved and reversed after a member of the security team opens a ticket and explains the reason for using the password (like to investigate malware) They got root access (at least most hosts I know do), why would they need to reverse an encrypted password that would give them less access than what they already should have? Seems like BS.

andfarm 17y ago
Customer writes in, asks "I forgot my [FTP/mail/panel/etc] password, what is it?". Changing the password isn't necessarily an option, as the password may be saved in their FTP/mail client, or on their web designer's computer, or whatnot.
- sev 17y ago
  GoDaddy store your passwords in clear-text and may try to SSH to your VPS without permission That's the title of the post. without permission -- what you're saying could be true; however, permission is granted in that case.

DavidSJ 17y ago

The encryption and process surrounding accessing passwords is meaningless. Who guards the encryption key, and how is this any better than storing passwords in the clear in some password-protected database? The point is, the person with this key can view -- and possibly lose -- your password (which you may, but shouldn't, use in other places). And once someone goes through this process, they can take it home with them. The choice to do this, rather than to use an SSH key, is indefensible, and their explanation shows that they haven't got a clue.