7 ms·

This isn't a microblogging service or pet social network. A domain registrar is storing your password in plaintext? Really? Didn't we go over this a thousand ti

by markbao 15y ago

This isn't a microblogging service or pet social network. A domain registrar is storing your password in plaintext? Really? Didn't we go over this a thousand times? If I was on Hover (which I considered), I'd transfer my domains immediately. Moving to a plaintext password system to get fewer support requests is like removing the door from your house so you don't have to keep fumbling for the key.

mmahemoff 15y ago
Precisely. Doing something like this is always a trade-off, and yes, it might make sense for something like a blogging service (the same way Posterous inbound mail has the small potential to go wrong), so I can see where Hover is coming from. But really, in the case of a domain registrar, wow. If you're administering a domain, you're no longer in "mainstream user" territory. There should really be some minimal set of conditions for domain registrars, with one of them specifying a reasonable security model for password retrieval.
mishmash 15y ago
After some positive research, I just purchased two domains from Hover. This is unacceptable however and I will be moving them away. What registrar would anyone say is the most security focused and/or government resistant? Maybe it should be a 2011 AskHN?
- AdamGibbins 15y ago
  I can't vouch for "security focused" - but Gandi.net have so far never let me down. They're based in France, so not susceptible to US law (dependent on the TLD you use of course) and have a huge variety of TLDs. Can't recommend Gandi enough, they do exactly what they say on the tin - "no bullshit".
  - jarin 15y ago
    Gandi is pretty awesome, but just be aware that your credit card company might freeze your card the first time you buy from them (apparently buying domain names in other countries is a fraud trigger) :D
    - Maxious 15y ago
      Never had that problem with Gandi but buying digital goods from Facebook froze my card. Apparently they were a hive for credit card thief testing at that point in time because of the low value of virtual gifts (1 US cent?).
    - christefano 15y ago
      This happened to me, too (twice!), but I now use PayPal instead of my credit card and my bank no longer freezes my account.
  - geocar 15y ago
    I've had other positive experiences with Gandi.net: They hooked one of their VPS servers up with a BGP feed so I could announce my AS there for testing a new Anycast service.
  - gregsadetsky 15y ago
    Gandi is great and resilient. I know from personal communication with them that the Yes Men recommend using their domain services (they also favor joker.com, which is based in Germany -- I've had a good experience there as well, although Joker doesn't offer VPS services like Gandi).
  - AdamGibbins 15y ago
    Gandi also have excellent free DNS hosting services. With an excellent control panel including grouping and raw BIND config.
  - stfp 15y ago
    Gandi is super awesome ! One quick thing though: since last year they have a US subsidiary (see http://en.wikipedia.org/wiki/Gandi http://en.wikipedia.org/wiki/Gandi), which might or might not make them more susceptible to US law.
- shantanubala 15y ago
  I absolutely love NearlyFreeSpeech.net for domain registration (and also cheap hosting). I wouldn't say they're security focused, but they allow you to be totally anonymous in your registration, and have a policy of hosting anything that isn't illegal.
- clobber 15y ago
  Moniker
- jjcm 15y ago
  Name.com is great. They don't try to obfuscate the UI to make it more user friendly. Straight access to the DNS records, simple clean design. Here's an old link to a comment I had discussing them: http://news.ycombinator.com/item?id=1766590 http://news.ycombinator.com/item?id=1766590
  - brodd 15y ago
    That very thread convinced me to switch to name.com six months ago. They're great.
    - dmit 15y ago
      Switched to Name.com around that time too. The website stripped special characters from my password during registration and I couldn't understand why it wouldn't let me log in since the limitation wasn't mentioned anywhere. Had to confirm with customer support. Take that as you will. But I like how they send you an email on every failed auth attempt.
- jjcm 15y ago
  Here's a thread discussing DNS registrars from last year: http://news.ycombinator.com/item?id=1766439 http://news.ycombinator.com/item?id=1766439
- yawniek 15y ago
  007names.com is doing good here
mmatants 15y ago
Companies like Hover have a user/password scenario unlike e.g. an email provider: users only visit their site one/two times a year (to renew a domain or whatever). So I wonder if they should instead allow "authentication-by-email". Basically, make it work just like current reset emails (with an embedded randomized link that allows access), but prevent the link from expiring. Obviously that suggestion has a lot of holes in it, too, but it's something to consider, especially since it's not a new idea. Either way, it's a real amateur move to do away with hashing.
- Cushman 15y ago
  I love this idea. 90% of the time when I use a forgot password link, I'm really trying to auth-by-email. I'm not sure how it would work for reusable links, since that becomes auth-by-URL, which seems significantly less secure— maybe putting HTTP auth in the url would be less likely to be logged at any point?
  - makmanalp 15y ago
    Isn't this basically the same thing as e-mailing yourself your password?
    - woodall 15y ago
      Not if the link can time-out or expire after X [days, minutes, seconds, ect]. When I think of emailing my self the password, I think of storing it in plain text in my email account. When I think of authentication via email I think of a one time use link that allows me to log into a session.
      - repsilat 15y ago
        Email is sent in plaintext. It'd be easy enough for an attacker to request an email authentication (which it then sniffs in transit). Expiry time doesn't help much. Email auth really should be done as Joakal says - your public key stored on their server when you sign up, email auth is encrypted. Trouble is, it's "too hard" for "normal people". If gmail/outlook etc supported it, though, it could catch on.
NiekvdMaas 15y ago
It's not just domain registrars, I reset the password of my basecamphq.com account (which stores very confidential project information) last week, and received this email: Hi -name-, Can't remember your password? Don't worry about it — it happens. We can help. Username: -username- Password: -password in plain text- Please keep your password safe to prevent unauthorized access. It blows my mind that even 37signals falls for this trap. There should be a website showing a blacklist of services that store passwords plaintext.
- alexmuller 15y ago
  Not exactly a list, but: http://plaintextoffenders.com/ http://plaintextoffenders.com/
  - robtoo 15y ago
    As I'm sure you noticed, many of those sites are putting the password in the welcome/verification email, but this is not the same as actually storing it as plaintext in their database. The thing to look out for is your old password in password reset emails, not welcome emails. And another one to add to the list: my brother's small business uses British Telecom for email hosting. Their control panel stores the password in plaintext.
    - alinajaf 15y ago
      > The thing to look out for is your old password in password reset emails, not welcome emails. What's the use of encrypting your passwords when you're broadcasting them to every mail server between your and your customer?
- mcobrien 15y ago
  I'm surprised you haven't been prompted to upgrade your account. 37signals switched to a new login system 18 months ago which doesn't store passwords in the clear. With a new login you get a regular password reset email.
  - 15y ago

by markbao 15y ago

mmahemoff 15y ago

Precisely. Doing something like this is always a trade-off, and yes, it might make sense for something like a blogging service (the same way Posterous inbound mail has the small potential to go wrong), so I can see where Hover is coming from. But really, in the case of a domain registrar, wow. If you're administering a domain, you're no longer in "mainstream user" territory. There should really be some minimal set of conditions for domain registrars, with one of them specifying a reasonable security model for password retrieval.

mishmash 15y ago

After some positive research, I just purchased two domains from Hover. This is unacceptable however and I will be moving them away. What registrar would anyone say is the most security focused and/or government resistant? Maybe it should be a 2011 AskHN?

AdamGibbins 15y ago
I can't vouch for "security focused" - but Gandi.net have so far never let me down. They're based in France, so not susceptible to US law (dependent on the TLD you use of course) and have a huge variety of TLDs. Can't recommend Gandi enough, they do exactly what they say on the tin - "no bullshit".
- jarin 15y ago
  Gandi is pretty awesome, but just be aware that your credit card company might freeze your card the first time you buy from them (apparently buying domain names in other countries is a fraud trigger) :D
  - Maxious 15y ago
    Never had that problem with Gandi but buying digital goods from Facebook froze my card. Apparently they were a hive for credit card thief testing at that point in time because of the low value of virtual gifts (1 US cent?).
  - christefano 15y ago
    This happened to me, too (twice!), but I now use PayPal instead of my credit card and my bank no longer freezes my account.
- geocar 15y ago
  I've had other positive experiences with Gandi.net: They hooked one of their VPS servers up with a BGP feed so I could announce my AS there for testing a new Anycast service.
- gregsadetsky 15y ago
  Gandi is great and resilient. I know from personal communication with them that the Yes Men recommend using their domain services (they also favor joker.com, which is based in Germany -- I've had a good experience there as well, although Joker doesn't offer VPS services like Gandi).
- AdamGibbins 15y ago
  Gandi also have excellent free DNS hosting services. With an excellent control panel including grouping and raw BIND config.
- stfp 15y ago
  Gandi is super awesome ! One quick thing though: since last year they have a US subsidiary (see http://en.wikipedia.org/wiki/Gandi http://en.wikipedia.org/wiki/Gandi), which might or might not make them more susceptible to US law.
shantanubala 15y ago
I absolutely love NearlyFreeSpeech.net for domain registration (and also cheap hosting). I wouldn't say they're security focused, but they allow you to be totally anonymous in your registration, and have a policy of hosting anything that isn't illegal.
clobber 15y ago
Moniker
jjcm 15y ago
Name.com is great. They don't try to obfuscate the UI to make it more user friendly. Straight access to the DNS records, simple clean design. Here's an old link to a comment I had discussing them: http://news.ycombinator.com/item?id=1766590 http://news.ycombinator.com/item?id=1766590
- brodd 15y ago
  That very thread convinced me to switch to name.com six months ago. They're great.
  - dmit 15y ago
    Switched to Name.com around that time too. The website stripped special characters from my password during registration and I couldn't understand why it wouldn't let me log in since the limitation wasn't mentioned anywhere. Had to confirm with customer support. Take that as you will. But I like how they send you an email on every failed auth attempt.
jjcm 15y ago
Here's a thread discussing DNS registrars from last year: http://news.ycombinator.com/item?id=1766439 http://news.ycombinator.com/item?id=1766439
yawniek 15y ago
007names.com is doing good here

mmatants 15y ago

Companies like Hover have a user/password scenario unlike e.g. an email provider: users only visit their site one/two times a year (to renew a domain or whatever). So I wonder if they should instead allow "authentication-by-email". Basically, make it work just like current reset emails (with an embedded randomized link that allows access), but prevent the link from expiring. Obviously that suggestion has a lot of holes in it, too, but it's something to consider, especially since it's not a new idea. Either way, it's a real amateur move to do away with hashing.

Cushman 15y ago
I love this idea. 90% of the time when I use a forgot password link, I'm really trying to auth-by-email. I'm not sure how it would work for reusable links, since that becomes auth-by-URL, which seems significantly less secure— maybe putting HTTP auth in the url would be less likely to be logged at any point?
- makmanalp 15y ago
  Isn't this basically the same thing as e-mailing yourself your password?
  - woodall 15y ago
    Not if the link can time-out or expire after X [days, minutes, seconds, ect]. When I think of emailing my self the password, I think of storing it in plain text in my email account. When I think of authentication via email I think of a one time use link that allows me to log into a session.
    - repsilat 15y ago
      Email is sent in plaintext. It'd be easy enough for an attacker to request an email authentication (which it then sniffs in transit). Expiry time doesn't help much. Email auth really should be done as Joakal says - your public key stored on their server when you sign up, email auth is encrypted. Trouble is, it's "too hard" for "normal people". If gmail/outlook etc supported it, though, it could catch on.

NiekvdMaas 15y ago

It's not just domain registrars, I reset the password of my basecamphq.com account (which stores very confidential project information) last week, and received this email: Hi -name-, Can't remember your password? Don't worry about it — it happens. We can help. Username: -username- Password: -password in plain text- Please keep your password safe to prevent unauthorized access. It blows my mind that even 37signals falls for this trap. There should be a website showing a blacklist of services that store passwords plaintext.

alexmuller 15y ago
Not exactly a list, but: http://plaintextoffenders.com/ http://plaintextoffenders.com/
- robtoo 15y ago
  As I'm sure you noticed, many of those sites are putting the password in the welcome/verification email, but this is not the same as actually storing it as plaintext in their database. The thing to look out for is your old password in password reset emails, not welcome emails. And another one to add to the list: my brother's small business uses British Telecom for email hosting. Their control panel stores the password in plaintext.
  - alinajaf 15y ago
    > The thing to look out for is your old password in password reset emails, not welcome emails. What's the use of encrypting your passwords when you're broadcasting them to every mail server between your and your customer?
mcobrien 15y ago
I'm surprised you haven't been prompted to upgrade your account. 37signals switched to a new login system 18 months ago which doesn't store passwords in the clear. With a new login you get a regular password reset email.
- 15y ago