3 ms·
> For active customers, sFTP and database usernames and passwords were exposed. We reset both passwords. > For a subset of active customers, the SSL private ke
by bilekas 5y ago
> For active customers, sFTP and database usernames and passwords were exposed. We reset both passwords.
> For a subset of active customers, the SSL private key was exposed. We are in the process of issuing and installing new certificates for those customers.
Wow.. That's quite severe.. From September 6th to November 17th.. I wonder will they do a full impact summary after they figure it out internally.
- busterarm 5y agoI've met Demetrius and he's a smart, capable security professional who has already done a lot to bring GoDaddy up to shape. This is a an unfortunate miss for them after years of hard work to rectify these kinds of issues.
- denton-scratch 5y agoUnfortunately, 20 years of treating customers like dirt can't be washed-away by hiring one capable security professional. For dirt customers like me, the best way of judging a service provider is past form. I don't buy from companies with a bad history. It's not some kind of behaviour-modification strategy; it's just self-preservation.
- deleted 5y ago[deleted]
- lvice 5y agoI hope they are talking about hashed passwords. There is no reason why in 2021 passwords can be recovered in clear text, even in a legacy code base...
- maccolgan 5y agoIt's about the database and SFTP usernames and passwords, how can you hash them?