4 ms·
They are a fully managed service for these services, so I'm assuming they store their own set of credentials separately to maintain access.
by Closi 6y ago
They are a fully managed service for these services, so I'm assuming they store their own set of credentials separately to maintain access.
- lioeters 6y agoThat's what I'm guessing too. Magento and WordPress both store only the hashed passwords in the database; however, a screenshot from the article shows that the hosting company had stored plain-text passwords for an admin user, which were likely generated automatically, and stored in a separate (and publicly accessible) database.
- josefresco 6y agoMy hosting provider (to remain nameless) also offers a global login bypass for WP and it gives me the willies.
- duckmysick 6y agoWhat would be a proper way to handle it?
- part1of2 6y agoThey have access to the DB users. You can craft a new user & password-hash pair and insert it into the DB to create your own Wordpress user to manage on their behalf, or the lazy way is to just update the user’s password hash with your own. Then when you fix the issue, revert it. Worked for me years ago, not sure if something fundamental changed
- dboreham 6y agoImplement a proxy authentication scheme for the hosted services (WP, etc). Now an admin working for the hosting provider can log in using a password checked against a hash stored in their hosting system. No plaintext passwords stored.
- Closi 6y ago> the hosting provider can log in using a password checked Hmm, but where is this password stored? This sounds like exactly what they were doing!
- rograndom 6y agoThere are a few hosting billing system -> account creation products that will generate the login information at purchase time so they can be presented to the user in plain text before being sent over to the provisioned server. It could be being logged accidentally at that point.