GoDaddy Wants Your Root Password 236
Johnny Fusion writes "The writer of the Securi Security Blog had an alarming awakening when a honeypot on port 22 on a GoDaddy-hosted VPS recorded login attempts using his GoDaddy username and password and even an attempt to login as root. It turns out the attempt was actually from within GoDaddy's network. Before he could 'alert' GoDaddy about the security breach, he got an email from GoDaddy Demanding his root login credentials.
There is an update where GoDaddy explains itself and says they will change policy."
They physically own the box (Score:5, Insightful)
Re: (Score:2)
Yep. Reminds me of when I tried to set up a firewall password for a software vendor, only to find my boss constantly deleting it. He wanted to make a big deal out of every time they wanted to log in... I had problems that only they could solve so I needed them in frequently. He was basically wasting my time.
Re: (Score:2)
Actually, since the boss was the one causing the delay, it was his time he was wasting.
It was company time he was wasting. Not every boss is automatically owner of the company.
Re:They physically own the box (Score:4, Funny)
I've said it before, i'll say it again.
Always use protection when VPS'ing.
Re:They physically own the box (Score:4, Insightful)
Re: (Score:2)
It's SAGAPO [youtube.com]
The question is if GoDaddy is trustworthy. (Score:5, Informative)
Judge for yourself. Here are some stories about GoDaddy on Slashdot, in order by date:
Go Daddy Usurps Network Solutions [slashdot.org] (2005-05-04)
GoDaddy Serves Blank Pages to Safari & Opera [slashdot.org] (2005-12-08)
GoDaddy.com Dumps Linux for Microsoft [slashdot.org] (2006-03-23)
GoDaddy Holds Domains Hostage [slashdot.org] (2006-06-17)
GoDaddy Caves To Irish Legal Threat [slashdot.org] (2006-09-16)
MySpace and GoDaddy Shut Down Security Site [slashdot.org] (2007-01-26) That incident prompted this web site:
Exposing the Many Reasons Not to Trust GoDaddy with Your Domain Names [nodaddy.com].
Alternative Registrars to GoDaddy? [slashdot.org] (2007-02-03)
GoDaddy Bobbles DST Changeover? [slashdot.org] (2007-03-11)
850K RegisterFly Domains Moved To GoDaddy [slashdot.org] (2007-05-29)
According to this March 11, 2008 story in Wired, GoDaddy shut down an entire web site of 250,000 pages because of one archived mailing list comment: GoDaddy Silences Police-Watchdog Site RateMyCop.com [wired.com]. See below for Slashdot's story about RateMyCop.com.
GoDaddy Silences RateMyCop.com [slashdot.org] (2008-03-12)
ICANN Moves Against GoDaddy Domain Lockdowns [slashdot.org] (2008-04-08)
GoDaddy VP Caught Bidding Against Customers [slashdot.org] (2008-06-29)
Those are just the stories until July of 2008.
GoDaddy's reputation is not just one of extremely negative stories. In my opinion, GoDaddy tries to confuse non-technical people by offering services they don't need and presenting them as valuable.
Here are some of the opinions of Bob Parsons, the owner of GoDaddy. He is pro-violence: Close Gitmo? No way!! [archive.org]
He uses women's bodies to advertise: Bob Parson's Video Blog [bobparsons.tv].
Another story, partly about GoDaddy. Chilling. (Score:5, Informative)
Another quote from that Slashdot story: "GoDaddy (and their reseller arm, Wild West Domains) have a different problem: They still block transfers for 60 days after a registrant's contact update, even after the ICANN update specifically prohibited doing so."
Re: (Score:2)
Sounds like a breach of contract between Godaddy and whoever gave them their "regisrar license", yes?
Or is it Verisign's job to police godaddy?
Re: (Score:2)
Re: (Score:2, Informative)
Another quote from that Slashdot story: "GoDaddy (and their reseller arm, Wild West Domains) have a different problem: They still block transfers for 60 days after a registrant's contact update, even after the ICANN update specifically prohibited doing so."
It gets worse. GoDaddy forces an update of 'invalid' contact details (which may have been inherited from a previous transfer) when trying to change an admin address (to transfer the domain out). GoDaddy then forces you to agree to a 60 day transfer hold via a checkbox because the said details were changed. Online support refuses to change just the admin email. This isn't just against the ICANN rules, this is thuggery.
Story about GoDaddy being spammer-friendly (Score:2)
Re:The question is if GoDaddy is trustworthy. (Score:5, Informative)
"GoDaddy's reputation is not just one of extremely negative stories. In my opinion, GoDaddy tries to confuse non-technical people by offering services they don't need and presenting them as valuable. "
This is quite an understatement. I do occasional web development on the side, and I recently had my first client in a while. I told her to go ahead and sign up for the domain with GoDaddy, but she said she couldn't figure out what to do. So I helped her out in person and I couldn't *believe* the amount of crap they try to push on you. Pages full of options and "upgrades" and packages on every step ... even after you finish your purchase! It's a tremendously confusing experience for someone who doesn't know how to filter out the signal from the noise.
As trustworthy as a Bernie Madoff (Score:5, Informative)
You pick the name, give them a credit card, press the button and get on with your life. They won't hijack it, hold it hostage, try to sell you anything (except DDNS if you want it). You pay, they register. As it should be.
I now have three (count'em 3) clients that have lost their domains to GoDaddy. However, for only $400 or so, GoDaddy will sell you back your own domain.
I wouldn't use GoDaddy if my ass was on fire and they had free water.
Re: (Score:2)
That's not the question. The question is if GoDaddy is trustworthy.
[Huge list of news, showing GoDaddy’s questionable trustworthiness]
I think you just answered that question. ;)
Also, (I know that looks are not really relevant) why does he look like a cross of Hannibal Lecter and a child molester? (I swear, looks can’t be that irrelevant, considering [statistically significantly] how often they fit. ;)
Re: (Score:2)
"GoDaddy tries to confuse non-technical people by offering services they don't need and presenting them as valuable."
I work nights. Sometimes, I'm actually in the shop to listen to the radio. It seems that every 15 minutes, one company or another is pitching some worthless product, trying to scare the dumb consumer into purchasing some "security" product.
"Hi, I'm former Police Chief Frazzle Brain. Did you know that online indentity theft is the fastest growing crime in America? Send me $100 and I'll pro
Re: (Score:2)
Re: (Score:3, Insightful)
Don't they know there are other hosts that don't use such tactics or resort to ridiculous tv commercials?
Chances are, they don't. For a middle-aged tech-illiterate person, seeing their commercials during a Super Bowl might be enough to make them wonder if they should have a website. And I don't see eNom, or Network Solutions making any prime-time ads.
Due to the relatively low cost of GoDaddy domains and plans at least to the average person, there seems to be no need for them to search around. Mix that with plans to appeal to the average person and you have a situation where no one really wants to shop ar
Marketing (Score:2)
to confuse non-technical people by offering services they don't need and presenting them as valuable.
Congratulations, you just described Marketing's purpose in life...
The truth is both funny and sad, a story of fakery (Score:5, Informative)
Another comment from someone who didn't bother to read the article or understand the issue.
Here's a quote from the Microsoft press release [microsoft.com]: "Upon completion of the migration, Go Daddy® will have moved all its parked domains from Linux to the Windows platform."
A "parked domain" is one with no real content, but just one small static web page that says something like "coming soon". The implication is that Microsoft Windows servers are fully capable of serving parked domains.
At the time, March 21, 2006, the story was that the Microsoft marketing department got GoDaddy to make the change by offering a lucrative deal. Why would Microsoft do that? This April 7, 2006 story explains: Microsoft Server gains 4.7% market share of hosted domains. [webmasterworld.com]
A parked domain, even though it is never visited except by accident, is a "hosted domain". Now it was possible for Microsoft sales people to talk about how Microsoft Windows server software was rapidly gaining market share. That would be entirely misleading, however.
Note that the press release misspelled GoDaddy as "Go Daddy", even though it was spelled correctly a few words earlier. That gives a picture of the level of competence involved at Microsoft's P.R. agency, Waggener Edstrom.
You may find it interesting that Pam Edstrom's daughter Jennifer and a former Microsoft manager wrote the book, Barbarians Led by Bill Gates. [amazon.com] (August 15, 1998, eight years earlier) The Amazon.com review says the book "... presents a harsher and messier history, sharply questioning Microsoft's ethics and corporate wisdom..." The book seems authoritative; the authors certainly had inside access to the facts. It's certainly unusual that the daughter of one of the heads of Microsoft's P.R. agency would write a book discussing Microsoft's abusiveness in detail.
Re:They physically own the box (Score:5, Insightful)
Yes and no. It’s like having an apartment. The landlord might own it. But it’s still highly illegal for him to go into your apartment without you allowing it. It’s the same thing as breaking it.
The question of trust was not the point. The point is, that the landlord is telling you, to give you a copy of keys of the apartment, or he’d throw you out.
In Germany, he would get dragged to court, and lose big time, when trying this on anyone.
The same should be true for GoDaddy. Everything else would be laws not keeping up with progress.
Re: (Score:2)
It's unethical and definitely borders on breach, not to mention access laws in many jurisdictions.
It's bad behavior, and given their track record, they'll pull something like this again. Just loved those cuties at CES this year....
Re: (Score:3, Insightful)
Interesting...maybe it varies from state to state, but pretty much every lease I've ever signed specifically states the landlord can enter your premise pretty much any time they wish for whatever reason....without notice.
You might wanna check your lease..or local state regulations, this certainly isn't a national thing that you stated.
Re:They physically own the box (Score:5, Informative)
You should get familiar with your rights, then. Landlords have to give 24 hour notice before entering your apartment. Failure to do this constitutes breaking and entering and I have taught one of my landlords this lesson the hard way.
Re:They physically own the box (Score:4, Insightful)
The "hard way" can be very hard in certain parts of the US where the intruder can face summery execution...
Re:They physically own the box (Score:4, Funny)
Re: (Score:2)
Landlords have to give 24 hour notice before entering your apartment.
24 hours? That's not much. Imagine you're on holiday, or even just away for the weekend...
Re: (Score:2)
Really? that is crazy. I am in california and there are fairly strong restrictions on when a landlord can enter property and a lease can't change that. you can apparently look them up by state here:
http://portal.hud.gov/portal/page/portal/HUD/topics/rental_assistance/tenantrights [hud.gov]
Re: (Score:2)
Yeahhhhhh.... that's not actually the case in any state I've ever lived in. It's your space. Your landlord can enter if they have reasonable belief that the property is in immediate danger (leaking pipe, smoke etc...) but otherwise they have to give you notice in advance.
Re: (Score:2)
Define "Your Box".
The guy was running "Virtual Private Servers". In effect, renting a virtual machine on a GoDaddy box.
That is slightly different than running his own box, because when malware is served or spam sent from that box it is GoDaddy that is on the hook.
His big mistake was assuming a VPS was HIS. Its really just a rented room, and just like a landlord can take steps to make sure meth is not brewed in his building, GoDaddy can protect their network.
Feature, not a bug. (Score:5, Interesting)
When my trivia game was hosted at EV1Servers (now part of The Planet company) I kept my root password on file with them at all times, and quite a few times support logged in and helped me with a problem, like telling me the reason my webserver went down was that the Warnings file in Apache had hit the Linux system limit.
This isn't GoDaddy the domain registrar looking for your passwords, this is GoDaddy the hosting provider wanting to log in to a customer's VPS that's running on their hardware, and most likely is calming down a paranoid admin if he's yelling at Slashdot about a "security breach" when support wanted to log in.
Nothing to see here... move along.
Re:Feature, not a bug. (Score:5, Insightful)
Why not just create an alternate account with sudo for them? Why give them root?
Re: (Score:2)
If you give them a non-root user with all of the privileges of root, there's no way for them to know if you've really given them root. You're trying rule-out possible problems, you don't want to give support a false answer they can hang their hat on.
Re: (Score:3, Informative)
If you give them a non-root user with all of the privileges of root, there's no way for them to know if you've really given them root.
sudo su
Re: (Score:3, Informative)
sudo su -
Re: (Score:2)
sudo -i
Why waste characters?
Re: (Score:3, Informative)
Don't you mean "sudo -i". That will launch a root login shell. Using "sudo su -" just makes it look like you never read the sudo manpage.
Re: (Score:2)
Few people RTFA, why would they read a manpage? Come on, this is EARTH, the place with upright monkeys walking around, claiming to be intelligent. No one reads manpages!
Re: (Score:2)
Re: (Score:2, Informative)
Re: (Score:2)
If you give them a non-root user with all of the privileges of root, there's no way for them to know if you've really given them root.
sudo su
Don't allow su for that account. Do we really need to spell it out? I was at amazon for 3.5 years, pretty much never had root (sudo only) and had zero problems as a result.
Re:Feature, not a bug. (Score:4, Interesting)
Two things... (1) of course they can determine that after logging in with the credentials.
(2) Godaddy is using fricking Virtuozzo as their VPS hosting platform right?
They technically then don't NEED the root password at all if so.
In theory, they could 'vzctl enter' a customer's VPS from the host node. To be clear: _entering_ a container, spawns a new shell child process with the customer's VZPID, such that the child shell is actually created inside the customer's VPS.
Now there might be some reasons they wouldn't want to do this, or that they'd want to wrap that in additional layers.
Well, the reason is entering a VPS from the host node potentially places the VPS they have entered in control of the user's terminal.
That could in theory be a security risk to GoDaddy's own system.
So by getting the VPS root password, they can enter the VPS over the network, instead of through the hardware node.... thus, not ensuring a VPS can never have control over a terminal logged into the hardware node.
Basically, this is more sound security wise.
Anyways... there definitely doesn't seem to be anything wrong with GoDaddy gaining access to a customer VPS on an official basis, for good reasons, to investigate possible customer abuse or malware.
As long as they follow professional standards, respect customer privacy completely, do not conduct any abuses, such as stealing leaking info, or gratifying personal curiosities (IOW: no abuse whatsoever) -- basically everything you would expect from an admin of Gmail or Yahoo mail (as in not reading your e-mail and using it for personal uses, to satisfy curiosities, blackmail you, etc...).
Oh yeah, and that they exclude any utilization they generate from the customers' bandwidth / resource bills.
Re:Feature, not a bug. (Score:5, Insightful)
Why not just create an alternate account with sudo for them?
If I had mod points, I'd bump you up. Your password is your password. Who knows what else a person uses that password for...trying to gain access by using it is tantamount to a phishing scheme. Get your own damn password.
Re: (Score:2)
If they have root or sudo then they can change your password behind your back... unless you have a restrictive /etc/sudoers file.
Re: (Score:2)
If they have root or sudo then they can change your password behind your back... unless you have a restrictive /etc/sudoers file.
Change yes. View no.
Me giving you root access to my machine does not necessarily give you my passwords.
An easily brute forced hashing for passwords would, as would you installing some software to wait and log when i next typed in a password.
But both of those are illegal, and one would assume a ligit company would not want to do that.
This same legit company however OWNS that compu
Re: (Score:2)
This same legit company however OWNS that computer, so it is not illegal for them to log in as root.
Dunno. I'd compare that to you renting a house. The landlord can't simply waltz in unannounced, even if he owns the house (with some caveats, of course). The same base concept should pretty much apply.
Re: (Score:2)
the sure-fire way to edit
Re:Feature, not a bug. (Score:5, Insightful)
If I had mod points, I'd bump you up. Your password is your password. Who knows what else a person uses that password for...trying to gain access by using it is tantamount to a phishing scheme. Get your own damn password.
Ironically, the very last sentence is exactly the solution one should use when choosing what password to set on a machine you do not own that others have full and total access to, physically, electronically, and legally.
If you use the same password on two things, a password being a shared secret, clearly both of those things now have that secret and can use it between each other.
Solution? Get your own damn password! :D
Re: (Score:2)
Re:Feature, not a bug. (Score:5, Informative)
Why not just create an alternate account with sudo for them? Why give them root?
Give them sudo and they can grab root whenever they want:
sudo -i
passwd
[input new password twice]
exit
Re:Feature, not a bug. (Score:5, Insightful)
Give them sudo and they can grab root whenever they want:
I think the point is that they should never have access to your password.
(Which is why TFA mentions that GoDaddy encrypts the passwords instead of using a one way hash)
If they have sudo and reset your root password, they're going to have to explain themselves later.
Re: (Score:2)
If they have sudo and reset your root password, they're going to have to explain themselves later.
Forgive me newbishness. What evidence would you have that *they* did this? If they were unscrupulous, couldn't they just say, "LOL Sorry you got rooted. No way it was us. Make sure you don't have a keylogger on your system n00b"
Re: (Score:2)
If they have sudo and reset your root password, they're going to have to explain themselves later.
Or they could just restore it back to what it was..
Re: (Score:2)
But they won’t be able to know your actual password. Which was the point.
(Of course that ends, as soon as they install a different “passwd” program, and you use it to enter your new password.)
Re: (Score:3, Informative)
Re: (Score:2)
I don't think many security-minded folks would enable PermitRootLogin for sshd without-password on a public system. Though if they have access to the VPS filesystem, nothing would stop them from doing it themselves.
Re: (Score:2)
PermitRootLogin without-password forces root logins to be authenticated using keypairs rather than a password - though the manpage isn't terribly clear on this point. It's actually more secure than PermitRootLogin yes (which allows both keypair and password auth).
If you're going to permit root login remotely at all (rather than using sudo), it's the best way to do it.
Re:Feature, not a bug. (Score:5, Interesting)
Re: (Score:2)
When my trivia game was hosted at EV1Servers (now part of The Planet company) I kept my root password on file with them at all times, and quite a few times support logged in and helped me with a problem, like telling me the reason my webserver went down was that the Warnings file in Apache had hit the Linux system limit.
This isn't GoDaddy the domain registrar looking for your passwords, this is GoDaddy the hosting provider wanting to log in to a customer's VPS that's running on their hardware, and most likely is calming down a paranoid admin if he's yelling at Slashdot about a "security breach" when support wanted to log in.
Nothing to see here... move along.
That would make sense if this was a dedicated server, but this is a VPS. With the two different VM systems I've administered VPSes with (OpenVZ and Xen), you're able to log into any virtual machine as root from the hardware node without a password, negating the need for any of the user's passwords. With OpenVZ it's just `vzctl enter [vpsid]`. There is no reason GoDaddy should be asking for passwords, let alone be automatically probing the VPSes to make sure the passwords on file are correct.
Re:Feature, not a bug. (Score:5, Informative)
I was just about to write the same thing. This was something that was already brought up weeks ago in an Ask Slashdot. People who who don't have much exposure to the web hosting business (and that includes most Slashdotters) don't understand that web hosting falls into two major categories:
1) Unmanaged
2) Managed
Unmanaged hosting means you have full control over all of the software on your machine. (And by "machine" I mean both a real machine and a VPS or cloud node.) Nobody touches your configuration in the slightest once control has been handed over to you. If something goes wrong, including hardware failure, it's the customer's responsibility to notice it and either fix it or get it fixed. Any technical support beyond typical datacenter stuff usually incurs an hourly fee. Unmanaged hosting is ideal for people who want to admin their setup 100% on their own.
Managed hosting means the web hosting provider monitors the machine which can include external probes (checking for a response on various TCP ports) and internal metrics like system load and disk utilization. When a red flag pops up, a technician logs into the machine and tries to fix whatever is happening. You can call them up with all manner of ridiculous requests ("install WordPress for me and apply this theme") and they have to do it because, well, that's what the customers expect with a managed hosting account. Managed hosting is awesome for people who want a web server but don't have the expertise or will to actually configure and maintain it.
What the submitter ran into is that he though he had unmanaged hosting but actually has managed hosting. I don't completely blame him, because a lot of hosting providers don't explicitly state which style they provide. Sometimes it's even hard to tell after you've purchased the product. But its something you have to figure out or else you're going to be deeply dissatisfied with the company's technical support, as the submitter was.
Re: (Score:2)
This isn't GoDaddy the domain registrar looking for your passwords, this is GoDaddy the hosting provider wanting to log in to a customer's VPS that's running on their hardware, and most likely is calming down a paranoid admin if he's yelling at Slashdot about a "security breach" when support wanted to log in.
Why would, nay, should they log in when there are no indications your box is infected? Asking them for help is a bit different then them arbitrarily accessing it whenever they feel like it, 'we have a p
No Surprises Here (Score:5, Interesting)
Not surprising at all.
I had a domain with Godaddy a few years ago when they breached ICANN's rules by threatening to confiscate my domain unless I paid them $200, because I had supposedly breached their TOS.
GoDaddy is not to be trusted.
Re:No Surprises Here (Score:4, Funny)
I had supposedly breached their TOS.
What was your alleged offense and how do we know you didn't do it?
Re: (Score:3, Insightful)
They can't take his domain, regardless of the TOS, if I understand his post correctly. IANAL and IANFamiliarWithICANN'sRulesOrTheTOS.
Re:No Surprises Here (Score:5, Interesting)
Someone (falsely) accused me of spamming.
However, even *if* I was a spammer, what right does godaddy have to confiscate my domain? I didn't even have any hosting with them, I just had a domain registered. This is clearly against ICANN policy. Registrars are not arbiters who get to take your domain away because they feel like it.
Re: (Score:3, Insightful)
Who exactly would spank them if they did?
Rules are no good unless they can be enforced.
Re: (Score:2)
Re: (Score:2)
And since GoDaddy is aware that their GoDaddy Girls ads gain them some men, but offend some women, they operate several other domain registrar brands that seemingly have no connection.
Re:No Surprises Here (Score:5, Informative)
This was back in 2005, but lucky for me gmail archives everything. ;)
When I refused both those options (since I had paid for a years worth of registration and didn't feel like paying any penalties, they told me they would change my dns info without my permission).
I'd have thought it was obvious, but... (Score:5, Insightful)
Re: (Score:2)
Pro tip: never trust your domain or your business to a company who got its name from a Thrill Kill Kult song and advertises its services with soft-core porn.
That seems like it would depend on what I used my domain for or what my business was. Soft-core porn site? Seems fitting.
Re: (Score:2)
advertises its services with soft-core porn.
Their advertising screams "by geeks for geeks" to me.
Re: (Score:3, Funny)
Yes. If they were serious they'd surely advertise with hard-core porn.
Re:I'd have thought it was obvious, but... (Score:4, Funny)
Yes. If they were serious they'd surely advertise with hard-core porn.
That's a different registrar - "Oh! Daddy!"
I always wondered what use GoDaddy is (Score:5, Insightful)
Re: (Score:3, Funny)
They only seem to market themselves by objectifying women.
You're not one of those people who think that "The Office" is an actual documentary, are you?
Re:I always wondered what use GoDaddy is (Score:4, Funny)
Re: (Score:2)
They only seem to market themselves by objectifying women.
You're not one of those people who think that "The Office" is an actual documentary, are you?
Or "The Flintstones" is a documentary?
Re: (Score:2)
But what about the boobies^H^H^H superbowl commerci^H^H^H quality service they provide?
Re: (Score:2)
Should I be using a different registrar for cheap domain registration? Who is cheaper?
Are you squatting on domains? If so, stop that. If not you can afford the $15/yr that a reliable/competent outfit like DynDNS [dyndns.com] will charge.
Re: (Score:2)
I'll second gandi.net.
I wonder... (Score:5, Insightful)
How robust are the various common server operating systems against an attacker breaching the system by either reading or manipulating the VM's state? When your "hard drive" is just a file on somebody else's system, and your RAM is just a block of memory reserved for you by whatever virtualization mechanism is being employed, either could conceivably be read or written without any access to your system through the usual channels(ssh, admin passwords, etc.) If, say, you are using public key authentication, to avoid password attacks entirely, what would stop the VM host from just scribbling their own public key onto the list of approved public keys stored on your filesystem? Or doing something subtler, like scanning your block of RAM to find your SSH daemon, and flipping a few bits to make it interpret your login attempt as valid rather than failed?
Obviously, in theory, you can never win against somebody who controls the hardware(and, with VMs, they don't even need EE skills and an expensive oscilloscope to poke at the hardware, since the "hardware" is actually software). However, theoretical viability and practical doability can be very different animals. In this case, they tried a clumsy password guess, followed by a demand, obviously not uber-hacker material. Has there been any work done, though, on the strengths, weaknesses, and limits of what a VM that doesn't trust its host can do?
Re: (Score:2)
You know, This is the first thing I thought of.
The second thing is that they REALLY didn't even need to ask. Seriously, it's a VM, they can copy and crack the vm. They can restart it single user. They can mount the vm disk to another vm, change the password to what they want, and then put the disk back. They could make themselves a nice little backdoor of some sort. Etc...
In fact, the more I think about it, the nicer it was that they just asked for it. Once you trust someone to hold your entire machine in v
Re: (Score:2)
Passwords should always be salted and hashed.
Unless they shouldn't be.
Doing that for POP3-MD5 (or any other challenge authentication scheme), for example, would open you up to replay attacks, because the challenge would have to be the same for each login attempt.
What about credit cards? Credit card numbers in a PCI-compliant credit card vault are encrypted, and only decrypted (by a master key in the billing system) when needed for bill processing. If they were salted and hashed you'd never be able to bill anybody for anything.
Re: (Score:3, Interesting)
Where have we seen a lot of focus on that problem? DRM(and, secondarily, antivirus/anti-rootkit work). In both the case of the program that is trying to hide crypto keys from the computer's owner and the case of the program trying to determine, from w
Double take (Score:5, Insightful)
We've got a security expert gets an email demanding his root password, and it's all good because they called and said sorry we'll change our policy? HUH? No wonder people are commenting that he's been paid off!!!
Physical Access (Score:2)
Re: (Score:2)
Actually a good idea (Score:2)
Heck, if their sysadmins are definitely like the chicks in the commercials, I'd definitely give them my "root".
Always seperate hosting, dns, and registeration (Score:4, Interesting)
As someone that has been around the block with running a lot of web sites (well, a couple thousand at least) for say the last 10 years, I have learned the hard way to not put all your eggs in one basket. Registries come and go, even the big boys (at least service comes and goes, policies change), hosting providers can go bad for all kinds of reasons, and your DNS services are your keys to the castle in terms of just how much damage an outage can do to a buisness (backup DNS severs people).
Re: (Score:2)
Re: (Score:2)
Totally agree. There are plenty of affordable backup dns services like dnsmadeeasy.com, that will give you global dns backup coverage for very little money and still allow you to maintain ns6.mydomain.com type servers.
I don't think a lot of people with just a couple sites realize that if you can keep dns up, even really cheap hosting going up and down will keep those outages from doing real damage such as with mail not arriving. servers will keep trying normally for a long time as long as the DNS resolves.
So? Don't give it to them. (Score:3, Interesting)
Make a backup of your server, and then tell them that they won’t get it.
If they switch off your server, sue them for extortion, trespassing (in case they entered the server) and damages. [Same rules as with a (business) apartment and a landlord.]
But I personally already had hosters asking me for the root password. I refused. That was it. They did not do anything. (We still had a contract, after all.) Of course they told me that they wouldn’t give me support for the software. But I wouldn’t have wanted that anyway, since on the last managed server, they wrecked my database when one of their idiot admins did “fix” something.
I don’t see the problem. Let them bitch. Tell them to fuck off or you’ll sue. Done.
If they want my root password (Score:2)
all they need to do is send Danica over to ask for it.
Re:Thats scary.... (Score:5, Insightful)
They store all the passwords encrypted, and they can only be retrieved and reversed after a member of the security team opens a ticket and explains the reason for using the password (like to investigate malware)
Look at this epic fail right here. All security bets, are off.
Re: (Score:2)
I much prefer the moniker "NoDaddy"
Re: (Score:3, Informative)
Re: (Score:2, Interesting)
They have a long standing policy of refusing business with people who promote an agenda that counteracts conservative Christianity. It's impossible to register or get hosting for a pro-choice site with them for instance. Just because they use T&A in their ads doesn't make them even handed. It just shows that they will stoop to any level to attract customers.
Re: (Score:2, Insightful)
"*The distorted Protestant American version of the faith."
Religions should be judged by practice, not theory.
Besides the obvious fact they are fantastic nonsense, the superstitions of the desert are only useful for facilitating oppression and violence.
Re: (Score:2)
Nah, the title would have been "GoDaddy HACKZORED my server".
Completely misleading, check.
Uses the word "hack" inappropriately, check.
Links to other articles about a different branch of the same company, check.