5

Recently, on live chat, a representative of a web hosting company (will not disclose the company name for liability issues), asked me for my password to the server in plain text in order to verify the identity of the account holder (me)

He then proceeded to tell me that "your password does match it" -- He's reffering to the password I sent him over HTTPS.

Should I be changing my password every time I make a support request?

Furthermore, they MUST be storing passwords for user accounts in plain-text somewhere, correct?

This seems like a major compromise of security for their customers

Improve this question

3 Answers 3

Reset to default
7

Being slightly in the hosting business I realize what you mean. To put it simply, it is extremely bad practice to ask clients to give their passwords in plain text but all companies do it. They either ask the full password or simply a few characters from the end.

My point is that, at some places like dedicated servers it's impossible to provide support without asking for the admin/root password in many cases, then again for shared servers the support should able to get right in with their own accounts.

I'm assuming at the least that he used your password to compare it to a stored hash, but security procedures can be flawed in many such hosting companies. I say this definitively because I know that cPanel, Plesk, etc do not store passwords in plain text, therefore he'd have no way to just "read" it.

You should however change your credentials every time you contact support. You should also write about this on an open forum so that the host takes a good initiative to prevent such malpractices as they can easily use a secondary question answer or a phone call, etc to verify one's identity.

Improve this answer
5
  • So you're saying that you think they have some sort of tool to hash the plain text password given by the account holder and then compare to the [hopefully] hashed password in the DB?
    – Ryan
    Jun 23, 2012 at 9:07
  • Yeah, that's what I'm hoping. Note: If they have separate billing and hosting account passwords, then you'll need to cross-check whether their billing system (WHM Solutions Cart, etc) hash passwords by default. But for hosting passwords, I don't see which practical system would keep passwords in plain text.
    – Rohan Durve
    Jun 23, 2012 at 9:10
  • I agree completely with you're last sentence. It's rather absurd that he is able to verify that my password is correct. I really want to ask them how the process of comparing the password works. He must be able to see the password in plain text ( on their end ) with his eyes.
    – Ryan
    Jun 23, 2012 at 9:12
  • Even if he does compare the password against a hash, it is an unnecessary risk. Especially since i am assuming you send him your password in plaintext over the live chat.
    – user10211
    Jun 23, 2012 at 9:38
  • Quite true, you should write them about this, or notify the security certification company they use for malpractices.
    – Rohan Durve
    Jun 23, 2012 at 9:54
2

Usually the hosting providers shouldn't ask for the customer personal details( like passwords for control panel , admin panel or FTP) via live chat. This information should be provided via tickets to and from the customer contact email address which he previously used to register with the hosting company.

Improve this answer
1

Should I be changing my password every time I make a support request?

Yes (ideally you'd prefer for the specific tech to not be able to trivially login as you at a future time). Though recognize that if you use a third-party service for web hosting (even if its a VPS) you should not be reusing that password anywhere else (and ideally would be using a ssh private key 90% of the time). In principle, an untrustworthy third-party service could easily secretly run a keylogger / rootkit that captures your passwords (especially if you just selected an introductory VM that they considered). This would be fairly unethical; but

Furthermore, they MUST be storing passwords for user accounts in plain-text somewhere, correct?

Possibly. If they ask for your full password; they could just be trying to see if it works from their end (e.g., comparing it directly against a stored hash or just logging into the system as you). If they ask for a partial password; more likely than not they are storing it in plaintext or encrypting it (and have the key to decrypt it to plaintext). If they are an administrator and dealing with account settings (for say billing purposes; purchasing new services), they should not have to login as you; but should have an admin account that grants them permissions to see/change your account settings.

It really depends on the environment and the issue you are having. Ideally, you never share passwords (whose to say the employee isn't writing it down and then going to try using your information to break into your email/bank/etc if you re-used passwords). However, if you have a VPS (not shared hosting) and you are reporting issues that could be hardware related; they check logs at their end and don't see anything suspicious and want to double-check that you have things setup sanely, they may want to try logging in to your virtual machine for themselves to look around and run some diagnostics; and it may be easier for them to test themselves then to talk to you over the phone/web chat and have you look around for them (and always have to read back the screen; or deal with mistyping commands).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .