5 ms·

By and large, Dreamhost is responsive, savvy, and competent. Lack of direct phone number for such situations is the only drawback I see to this story.

eel 17y ago
That's the only drawback? It's not at all bothersome that the reps gave out passwords over chat? Or that the reps changed the email address of a different account based on someone's request?
dminor 17y ago
Also the seeming inability to lock an account or communicate the hack attempt to other support people. But I do agree they are a quality company.
Frazzydee 17y ago
As of last month, they were still storing passwords in plaintext. They sent me my password over email when I forgot my password. That, to me, is not a good indication of a savvy & competent company. Edit: I haven't used them for hosting.
- jcl 17y ago
  There was someone, maybe a Dreamhost employee, posting on HN a month ago with justifications for this practice... He explained that there are customers who want passwords e-mailed to them, presumably even if you explain that it is not secure: http://news.ycombinator.com/item?id=1148848 http://news.ycombinator.com/item?id=1148848 And he mentioned that Dreamhost offers the (non-default) option of not storing the password text: http://news.ycombinator.com/item?id=1148732 http://news.ycombinator.com/item?id=1148732
  - Frazzydee 17y ago
    Thanks for that. I don't agree with their decision though, since most major websites will not email you back your password, by default. If facebook can get away with it, I'm sure dreamhost can too.
    - pyre 17y ago
      Facebook doesn't have paying customers. Also, most Facebook users access it for personal use. A lot of people access/use Dreamhost for business purposes. I'm sure there are a lot of PHBs that have access to Dreamhost accounts because they feel compelled to micromanage everything (or just PHBs that make the 'requirement' that the password is recoverable).
      - andfarm 17y ago
        Along with the PHBs, we've also got a lot of plain old non-tech-savvy customers who just want to run their [personal blog / small business homepage / church web page / etc], and don't know, nor want to learn, too much about computers. Requiring them to use semi-strong passwords for FTP and email logins is enough of a challenge; requiring them to change those passwords every time they forget them is often a real hassle.
        Frazzydee 17y ago
        Why don't they want to change their passwords when they forget them? Presumably the old password isn't much use anymore, since it's been forgotten. But unless there's something I'm missing, I suspect I'm just preaching to the choir right now ;)
        andfarm 17y ago
        One or both of: - They've forgotten the password, but it's still in the keychain (or equivalent) for their mail or FTP client, which will all stop working when they reset the password. - The password is shared with other employees, and it might be difficult to notify them all of the new password.
        Frazzydee 17y ago
        (1) Fair enough, I suppose some keychains might make it difficult to recover the password. (2) Why not just ask the other employees for the old password?
  - mikeryan 17y ago
    (he also mentions that they're not stored the clear "They are stored as a hash and in a reversibly encrypted form; access to the plaintext passwords is heavily logged.")
  - andfarm 17y ago
    That was me. Let me know if you've got any questions.

eel 17y ago

That's the only drawback? It's not at all bothersome that the reps gave out passwords over chat? Or that the reps changed the email address of a different account based on someone's request?

dminor 17y ago

Also the seeming inability to lock an account or communicate the hack attempt to other support people. But I do agree they are a quality company.

Frazzydee 17y ago

As of last month, they were still storing passwords in plaintext. They sent me my password over email when I forgot my password. That, to me, is not a good indication of a savvy & competent company. Edit: I haven't used them for hosting.

jcl 17y ago
There was someone, maybe a Dreamhost employee, posting on HN a month ago with justifications for this practice... He explained that there are customers who want passwords e-mailed to them, presumably even if you explain that it is not secure: http://news.ycombinator.com/item?id=1148848 http://news.ycombinator.com/item?id=1148848 And he mentioned that Dreamhost offers the (non-default) option of not storing the password text: http://news.ycombinator.com/item?id=1148732 http://news.ycombinator.com/item?id=1148732
- Frazzydee 17y ago
  Thanks for that. I don't agree with their decision though, since most major websites will not email you back your password, by default. If facebook can get away with it, I'm sure dreamhost can too.
  - pyre 17y ago
    Facebook doesn't have paying customers. Also, most Facebook users access it for personal use. A lot of people access/use Dreamhost for business purposes. I'm sure there are a lot of PHBs that have access to Dreamhost accounts because they feel compelled to micromanage everything (or just PHBs that make the 'requirement' that the password is recoverable).
    - andfarm 17y ago
      Along with the PHBs, we've also got a lot of plain old non-tech-savvy customers who just want to run their [personal blog / small business homepage / church web page / etc], and don't know, nor want to learn, too much about computers. Requiring them to use semi-strong passwords for FTP and email logins is enough of a challenge; requiring them to change those passwords every time they forget them is often a real hassle.
      - Frazzydee 17y ago
        Why don't they want to change their passwords when they forget them? Presumably the old password isn't much use anymore, since it's been forgotten. But unless there's something I'm missing, I suspect I'm just preaching to the choir right now ;)
        andfarm 17y ago
        One or both of: - They've forgotten the password, but it's still in the keychain (or equivalent) for their mail or FTP client, which will all stop working when they reset the password. - The password is shared with other employees, and it might be difficult to notify them all of the new password.
        Frazzydee 17y ago
        (1) Fair enough, I suppose some keychains might make it difficult to recover the password. (2) Why not just ask the other employees for the old password?
- mikeryan 17y ago
  (he also mentions that they're not stored the clear "They are stored as a hash and in a reversibly encrypted form; access to the plaintext passwords is heavily logged.")
- andfarm 17y ago
  That was me. Let me know if you've got any questions.