4 ms·
"GoDaddy was storing sFTP credentials either as plaintext, or in a format that could be reversed into plaintext." Goddamn, anyone else, feeling a deep anger ri
by keyle 5y ago
"GoDaddy was storing sFTP credentials either as plaintext, or in a format that could be reversed into plaintext."
Goddamn, anyone else, feeling a deep anger rising, when reading this in 2021?
"According to the report filed by GoDaddy with the SEC..."
In 2021, everyone has to be pissed off by javascript popups about cookie storage, but your passwords safety, screw that. Storing SFTP passwords reversible to plaintext, that's still fine, right?
As long as there is a SEC report... We look professional!
- ttybird 5y agoI don't really see the issue. It's not like some sort of deadly sin. If the users re-use passwords then that's on them.
- jjeaff 5y agoAs far as security goes, I would definitely include storing passwords in plaintext in a list of deadly sins.
- djbusby 5y agoI'll bet on base64 "encryption"
- keyle 5y agoVGhhdCdzIGEgc2FmZSBiZXQhIFRoZXknbGwgbmV2ZXIgZmluZCBvdXQhIFRoZSA9IGF0IHRoZSBlbmQgaXMgbmV2ZXIgYSB0ZWxsIHRhbGU=
- ironSkillet 5y agoTranslation: "That's a safe bet! They'll never find out! The = at the end is never a tell tale"
- smolder 5y agoAh yes, be sure to base64 encode your secrets before commiting them to the git repository, everyone!
- slivanes 5y agoI would rot13() it twice to be extra safe. /jk
- keyle 5y agoThank you, I jokingly wrote rot26() expert once in a resume and got asked about it during an interview.
- coldcode 5y agoAs long as companies view security as a worthless expense, and the only penalty is some monitoring (that no one uses) and a brief story everyone will forget, nothing will change. I doubt the stock will even be affected. Maybe the CEO should be required to be put in stocks in the town square or something. With no real penalty, there is no change.
- mmaunder 5y agoStock is down 9% since announcement. It’s an interesting case study because you get clear arithmetic on how much this breach cost shareholders. Almost exactly one billion dollars. May be short lived but useful data nonetheless. Will inform infosec budgets going forward. https://ibb.co/QMy8pZb https://ibb.co/QMy8pZb
- Fckd 5y agoBack in 2006 as a college student, i had a sense of hashing passwords with salt.
- geoduck14 5y agoWhat a visionary!
- steve_adams_86 5y agoNo, the point is that even newcomers can learn to do better than the team at godaddy did. They aren’t trying to brag, they’re pointing out that the team behind this compromise was negligent in their practices.
- geoduck14 5y agoI get that. His idea was to implement rudimentary security practices. Practices that EVERYONE, even GoDaddy, should implement. I was being sarcastic.
- steve_adams_86 5y agoMy bad, I inferred that as less humorous and more condescending when I shouldn't have.
- dreyfan 5y ago> anyone else, feeling a deep anger rising, when reading this in 2021? Look at most of the stories on the front-page of HN these days. Often some shiny tool to allow front-end JS devs to write and deploy full-stack applications automatically upon commit. I guarantee you they’re making similar newbie mistakes. Instead of SFTP it’ll be a serverless endpoint that returns entire User records, unhashed password and all, without any sort of auth check.
- tinco 5y agoThis has nothing to do with newbie mistakes. GoDaddy has been a household name for decades. This was not a newbie mistake, this was negligence and refusal to invest in modern technologies. I'd rather risk it with the newbies, modern stacks usually have good tutorials and standard solutions to most security sensitive problems. Last time I dodged a product because its website looked like it was designed in the early 2000's it was SolarWinds just over a year ago..
- acdha 5y agoAnd they’ve been this bad continuously since the 90s, too, so clearly the market does not have a positive feedback loop for security. I’m feeling nostalgic remembering helping clients migrate away from their breached shared hosting around the turn of the century, especially how this ended up being cheaper because GoDaddy was way over market rates.
- sombremesa 5y agoYep, just left a company where the contractors building out a core solution had just such an endpoint where you could get anyone's data, and worse, personal photos. And of course, every API key and secret was just hanging out in the repo as well.