6 ms·

As soon as I saw the text "Your root password will be emailed to you" on the bottom of the droplet create page I opened a ticket, here's how it went: "Your roo

As soon as I saw the text "Your root password will be emailed to you" on the bottom of the droplet create page I opened a ticket, here's how it went: "Your root password will be emailed to you" -- start -- Me Just seen this at the bottom of the "Create a droplet" page. You're kidding right? Them The root password is sent via email because it is the easiest and fastest way to get a user online and running a virtual server. We strongly recommend updating the root password after you login for the first time. We also have SSH keys support so you can add your SSH key to the server during creation in which case no email is sent and instead the SSH keys are added under the root user for more secure access. Thanks, Me Just added an SSH key and you're quite right, I retract my blunt reaction. I must say however that I still think emailing them is a fairly terrible idea and I'm surprised your not worried about being found liable for a subsequent server hack. That aside, thank you for your swift response and for pointing out I can use my SSH key. I look forward to using DO more -- end -- N.B. I actually received their response twice from different agents suggesting it was a canned response Frankly I don't even think passwords should be an option, as on AWS (not that they're perfect)

goodwink 14y ago
But if you reset the root password it's still emailed, regardless of ssh key.
danielweber 14y ago
For lots of users, they have to send _something_. And while they could build a PGP-whatzits system for the small fraction of their people who use PGP, those people are already going to be immediately changing their passwords anyway. Heuristics like "keys are better than passwords" or "don't email passwords" are good heuristics, but they shouldn't become absolute rules.
- viraptor 14y ago
  They don't have to send the password. Allowing users to submit their password over https and storing only the hashed version is another option.
  - danielweber 14y ago
    Then you fall back to needing to send some kind of login token to the user when they forget how to log in to the HTTPS site. Onerous security policies can make things worse as people work around them behind your back. You can require certificates but there's nothing you can do to make sure that people don't put their keys in their dropbox for "safety" because they don't want to get yelled at for losing their keys when a machine crashes. People shop for VPSs partially based on convenience of management. If you make your system secure but inconvenient, you can lose the people who would would most benefit from a "good enough to stop the automated SSH bot" policy.

goodwink 14y ago

But if you reset the root password it's still emailed, regardless of ssh key.

danielweber 14y ago

For lots of users, they have to send _something_. And while they could build a PGP-whatzits system for the small fraction of their people who use PGP, those people are already going to be immediately changing their passwords anyway. Heuristics like "keys are better than passwords" or "don't email passwords" are good heuristics, but they shouldn't become absolute rules.

viraptor 14y ago
They don't have to send the password. Allowing users to submit their password over https and storing only the hashed version is another option.
- danielweber 14y ago
  Then you fall back to needing to send some kind of login token to the user when they forget how to log in to the HTTPS site. Onerous security policies can make things worse as people work around them behind your back. You can require certificates but there's nothing you can do to make sure that people don't put their keys in their dropbox for "safety" because they don't want to get yelled at for losing their keys when a machine crashes. People shop for VPSs partially based on convenience of management. If you make your system secure but inconvenient, you can lose the people who would would most benefit from a "good enough to stop the automated SSH bot" policy.