81–90 of 426 posts
It doesn't help that the front door is securely locked when the back door is not! :-/
It's a level of security-through-obscurity, yes, but that doesn't mean it's wrong. It means you can keep that address monitored well. You could make any activity on it send a page, for example.
This is the same for DigitalOcean. I'm always amazed that clicking "Rebuild" or "Delete + Scrub Data" doesn't require _any_ confirmation at all.
I had my 2FA at Singlehop bypassed by social engineering attack. They helpfully changed the entire account contact info without any notice to me, presumably from a phone call. The attacker didn't even have any information to go off other than the IP address. I only found out when I saw the server rebooting into rescue mode and luckily I still had an active management portal cookie (changing the password doesn't log y…
We have had this at Amazon AWS. We had 2FA, one phone call was enough to disable 2FA. The only thing they asked were the last four digits of our credit card.
Not trying to be snarky, but the biggest lesson here seems to be "don't operate without off-host backups". Cheap VPS providers don't typically offer that sort of thing as a standard feature. Even when they do, the backups would be on the same infrastructure, and easily wiped from the same (compromised) console. You could have just as easily lost all the data in an accidental way, with no malice or 3rd party involved.…
We offer full backups with all managed servers/services Self-managed a customer is responsible for their own backups. Just like with DO and that full server loss a couple of months back.
It's a $30 to $75 a month upcharge on top of the base VPS price. I don't think the OP was paying for a managed VPS.
Edit: Apparently, only the $75/month package includes backups. The $30/month package does not. (http://i.imgur.com/Iy7iacH.png)
Is password recovery a bug or a feature? cloud providers seem on the fence about this. AWS has certainly had similar problems in the past.
It depends on how its implemented. If it's "Whats your mother's maiden name?" and they let you reset it in the browser, it's a bug. But if they send you an email (in my case to Gmail, that has 2FA turned on), then it is a feature, because then you'd be required to either 1) intercept the recovery email (and get the password reset URL) or 2) know the format of the password reset URL and just happen to guess mine after…
Have the customer provide an SSH/GPG public key, and store it with the account.
When a password reset is requested, encrypt a random string using said public key, and email it to the email for the account.
An attacker who may have breached your webmail is then reasonably unlikely to also have your private key to decrypt the string.
Follow the link (which didn't necessarily need to be encrypted) and enter the string you decrypted to reset the password.
On a related note: do any/many sites with 2FA, require the 2FA code to do a password reset?
Earlier quoted context omitted.
Namecheap uses the same 2FA provider as Tumblr, Yahoo, Microsoft, and a slew of other services.
What do you mean by "provider"? I find it hard to believe Microsoft of all companies has outsourced two factor authentication.
(disclosure: obviously I work for Namecheap.)
Earlier quoted context omitted.
Namecheap uses the same 2FA provider as Tumblr, Yahoo, Microsoft, and a slew of other services.
What do you mean by "provider"? I find it hard to believe Microsoft of all companies has outsourced two factor authentication.
"This was an isolated case and procedure was not followed. I can assure you we have addressed it so it won't happen again."
