3 ms·
I've had Digital Ocean reset a VM on a different account (a client's) just by asking politely from my own account (not impersonation or anything alike on my par
by hobarrera 11y ago
I've had Digital Ocean reset a VM on a different account (a client's) just by asking politely from my own account (not impersonation or anything alike on my part).
While it was helpful on that occasion, it should probably go completely against policy to do stuff like this.
- cpach 11y agoOuch. That makes me wary of using DO.
- mzjs 11y agoThis is an issue with all providers, though. It's not specific to just DO.
- toxicFork 11y agoOf course. The weakest link seems to be customer support when it comes to security.
- cpach 11y agoYep. That’s why it’s so crucial that these companies try to adapt solid guidelines in order to minizime the risks of social engineering attempts.
- nadams 11y agoI wouldn't say all - but many. However, there is always more than one way to skin a cat. Gandi states that they won't reset it - but offers instructions on how to do it [1]. Which, presumably if you are spinning up VMs the owner of the account should get an email notification. [1] - https://wiki.gandi.net/en/hosting/gandi-expert/change-root-passwd-in-expert-mode https://wiki.gandi.net/en/hosting/gandi-expert/change-root-p...
- grubles 11y agoYou literally only asked politely? I feel like there was at least /some/ sort of info you had to provide.
- nadams 11y agoWhen he submitted the ticket or whatever he was probably logged into his account and to DO that is probably a "the user is logged in so we don't have to verify his identity".