Hover.com: we store & email passwords in plaintext for usability

Post by pavel_lishin » Tue, Jul 05, 2011, 1:06 PM UTC

freejack wrote: post #162

GigabyteCoin wrote: post #131

Earlier quoted context omitted.

What's to stop me (possible hover CSR, co-worker, whatever) from simply reading a high-profile customer's password and transferring all their million dollar domain names to me later that night when I get home from work? I have a pretty good memory. I bet I could remember 5-10 simple passwords and email addresses without writing anything down. Chances are the idiots use the same password for their email anyways. Muaha…

Industry secret - at the most basic level, registrar and registry staffers don't need access to a customer account to manipulate a domain name. We've implemented tons of controls to manage who can do what, etc. but relying on customer passwords to safeguard domain names from internal tampering isn't really a great tactic.

Post by pavel_lishin » Tue, Jul 05, 2011, 1:09 PM UTC

kgermino wrote: post #123

eam wrote: post #37

> Very quickly, our customer service team was inundated by requests from people that weren’t receiving the email, found the process confusing, and a myriad of other related requests. Wait a second, so customers wont receive an email with a password reset link, yet they'll receive an email with a plain text password? I guess it's possible, but interesting.

It's not that they don't get the email so much as they don't understand it. Where I work, I make a new account for someone, then send them a password reset email asking them to create a password for themselves, and a personal email writteden by me explaining exactly what they need to do (go to this other email, click the link, enter your new password twice, hit enter, then log in) and I still have 1 in 4 result in su…

Post by pavel_lishin » Tue, Jul 05, 2011, 1:12 PM UTC

rkudeshi wrote: post #50

Whenever I call up MediaTemple for support, they always ask me my password for verification. Does that mean they also store passwords in plaintext? (serious question)

Post by JonoW » Tue, Jul 05, 2011, 1:24 PM UTC

freejack wrote: post #116

keeperofdakeys wrote: post #111

Earlier quoted context omitted.

"...to give our CSRs a completely effective way to handle inbound password requests in cases where customers no longer had access to their email account." I personally don't see how having the plain-text passwords help in the case where the person owning the account doesn't have access to their email account. Since they don't have access, you can't exactly email them their password.

Most of our customer inquiries come in over the phone.

Post by Dylan16807 » Tue, Jul 05, 2011, 2:07 PM UTC

boot13 wrote: post #168

masterzora wrote: post #113

Earlier quoted context omitted.

Disclaimer: I am an ex-DH intern and my information is only as good as August 2010, but it is likely to still be accurate. At the very least, DH does not store passwords as plaintext, but it's only very marginally better than that. Passwords are stored using a custom-rolled symmetric encryption algorithm created by... I never found out if it was a founder or just one of the earlier admins, but that doesn't really cha…

I can confirm that they're still doing this. I recently had a conversation with their support staff about it and I don't think they'll be changing it any time soon. I like Dreamhost, but if they don't change this I'll probably bail.