1

Unfortunately, I've tried a hosting service and it returned my password value as it was in my inbox (as connection details).

I went to a control panel in an attempt to delete or deactivate my account. It showed IP Logged I didn't input any details there, connection was HTTP.

So my questions are:

  • What is the IP log ?
  • Can I create an additional email account and use this password again?
  • Am I doomed?
8
  • every time you type your password into a web page the server knows the password. Even if they don't return it to you. You know that, right? Commented Feb 3, 2023 at 21:56
  • @user253751 Isn't hashed or something? Can you provide me an insight please?
    – linuxverse
    Commented Feb 3, 2023 at 22:02
  • How do you know the server hashes it? You don't know. Commented Feb 3, 2023 at 22:02
  • @user253751 Isn't a policy that should be followed in general thought?
    – linuxverse
    Commented Feb 3, 2023 at 22:04
  • sure, but how do you know they followed the policy? Commented Feb 3, 2023 at 22:05

2 Answers 2

3

There seems to be a misconception here. Every time you type a password into a web page, it sends the password to the server, therefore the server knows the password.

It sounds like you use the same password for everything, including your email account, and now you realize the hosting company knows your password. But every company where you typed in your password knows your password.

About hashing: Good websites will hash the password. But how do you know they hashed it? You don't know because you can't see what the server is doing. Anyway a hacker could install a password logger on the server and then know the unhashed password the next time you send it because you want to log in.

Sometimes password hashing is impossible, for example, when using a challenge/response protocol to verify the password. That style of protocol is more secure than sending the password, since the password isn't sent, but the server has to know the actual password, so that's less secure. Decisions, trade-offs! (This kind of protocol isn't used on websites. It might be used to log into the server you are renting.)

About passwords in emails: A hosting service sending you "connection details" in plaintext is not terribly unusual (although some people would argue that it should be). It's for convenience, obviously: it tells you how to connect to the server (or whatever you are hosting). If you had typed in a completely random password, or the hosting service had made a random password for you, would there be any concern here? Not really, only a small one. It is your fault that the password is the same as your email account password.

Does it mean the hosting company got hacked? Probably not. They almost certainly do this on purpose for your convenience so you know how to log into the server.

About threat modelling: A question like "am I doomed?" or "am I safe?" is useless unless you think about what you are doomed or safe from. So consider what the threats are:

  • An employee at the hosting company might steal your password because they can see it because it isn't hashed. - Plausible. Any company could do this, not just this hosting company. We don't know whether the password is hashed in their database or not.
  • Someone could read your emails and get the password. - Yes - if they can read your emails.
  • Someone read the password when it was sent from the hosting company's email server to your email server. - Plausible. If you are using something like Gmail, there is a good chance the email was sent securely, directly from the hosting company's server to Gmail's.
  • An employee at one of those other sites where used the same password could see it, and I only just realized that. - Yes. That's why people are recommended to use different passwords on every site, e.g. by using a password manager program.

One thing that is completely unrelated to the email thing:

  • Someone read the password when I typed it into the hosting company's login page. - Very plausible! Using HTTP (not HTTPS) for logging in to a serious company is completely unacceptable in 2023. You should use a different company and tell them why you are not using them.

What is the IP log ?

It is very common for websites to record IP addresses of who accesses them. Especially when you log into something, the website records the IP address that logged in, in case they need to know it for some investigation. Nothing unusual. (If you don't like it, GDPR might make it illegal under some circumstances)

Can I create an additional email account and use this password again?

You can certainly do whatever you want.

Am I doomed?

5
  • thank you for taking the time to explain me these in detail. As for the email it was example.I meant that can i use this password anywhere at all (from safety perspective - for example as additional mail's password ) ? What's your opinion for password manager programs and why to trust them?
    – linuxverse
    Commented Feb 3, 2023 at 22:47
  • @linuxverse my opinion is that I do password management manually because I am not so sure about password managers, and my online banking password is not saved anywhere at all. But that is just how I do it. Password managers are better than using the same password for every website, because the password manager has to be hacked, not 1 out of 50 different websites. Commented Feb 3, 2023 at 22:49
  • also now I'm checking it again , inside the link that was loading while it was creating the account it contains some credentials (not password) & hash & installation process but that doesn't matter right? Why can i see the link's operation thought? Shouldn't be some kind of hidden?
    – linuxverse
    Commented Feb 3, 2023 at 23:04
  • @linuxverse what should be hidden? the server has to know which link you clicked on and what it's supposed to do Commented Feb 3, 2023 at 23:17
  • Is it possible that it had hash function then?
    – linuxverse
    Commented Feb 3, 2023 at 23:20
0

Your description is quite unclear, but it sounds like you are saying the following:

  1. You went to your hosting provider's control panel page, which is over plain HTTP (RED FLAG)
  2. You found there a log (list of records) of past connections, including the IP address you were connecting from (totally normal)
  3. This log also contained the password you used to log in? (RED FLAG if true)
  4. Regardless of whether it was in the log or somewhere else, your hosting provider returned your password, in plain text, somewhere (RED FLAG)

Each place I've marked RED FLAG indicates that your hosting provider is dangerously insecure, and should not be used for anything. Any company with even quarter-decent security these days will be using HTTPS for all sensitive traffic (including authentication - logging in - and everything you do thereafter such as accessing a control panel). They will also NOT be storing passwords in plain text anywhere (including in logs!), much less revealing plain-text passwords over the internet. A company that can't manage these things is so incompetent as to be indistinguishable from malicious. None of these best practices, or how to adhere to them, are new, complicated, or obscure.


What is the IP log ?

Most web servers store a log of users, especially users who try to log in. The entries in this log almost always contain the IP address of the user's device. (Something termed an "IP log" might contain little else, except a timestamp.) This is normal and useful data, as it helps with things like diagnosing user problems or analyzing traffic for malicious activity. Some extremely privacy-focused sites might avoid logging IPs (or delete entries from the log after a very short time) so that nobody - not even they themselves - can tell who used the site after the fact... but that's extremely rare.

Critically, however, logs of any sort must never contain any highly-sensitive data. Log storage is usually not especially secure. It generally shouldn't be public - only authorized users should have access - but it's also usually not very tightly restricted, or encrypted, or similarly secured. Additionally, some highly-sensitive data - such as passwords and other authentication secrets - should literally never be stored in plain text (or, ideally, under reversible encryption) anywhere at all. Rarely it may be necessary to store password-equivalent hashes, or passwords under reversible encryption, within secure storage on a server; there's no need (or excuse) for putting them in logs.

Can I create an additional email account and use this password again?

NEVER re-use passwords. This is basic, fundamental security practice. If you use the same password with multiple sites, then any of those sites can impersonate you to any of the other sites. In essence, you are claiming that you consider all of those sites to be the same, trust-wise; anything that any of them are able to see (of yours) or do (on your behalf), they all are. To make matters worse, you are increasing the "blast radius" of a security compromise at any of those sites; an attacker who gets your password on any of them (via any means: improper password storage / modifying the server to copy passwords as they're entered / brute-force guessing / watching over your shoulder as you type / etc.) now can log in as you on all of them.

Use a password manager instead. There are tons of them. Every major web browser has one built in, as do both Windows and MacOS (and most desktop Linux environments). Furthermore, there are many purpose-built ones, commercial, free, open-source, etc. They have all sorts of properties and features - some support syncing between devices (with varying security along the way), some support storage on a different computer so you don't lose them if your device dies, some support generating new passwords for you, some support automatically filling credentials when you open a webpage, etc. - but even a very simple, relatively weak option - like a "passwords.txt" file on your computer - is arguably better than re-using passwords across sites (it definitely is if you don't share your computer's login account with anybody, and there's a password on the computer's account).

Am I doomed?

Well, unless medicine gets a whole lot better in the next few decades, everybody alive today is. Less existentially, though, you absolutely should change the password on every site that is currently using the same password as you used on the hosting provider (and don't use that hosting provider for anything!). After that, you should change all your other passwords (assuming you have more than one right now) that were ever used in multiple places. (Obviously, each new or changed password should be unique and unpredictable!)

You might also want to check your account(s), and password(s), to see if they've been compromised. There's a really cool site, https://haveibeenpwned.com/, which tracks known site compromises and lets you see if your username/email/phone number were used on any site with a breached account list. You can also use https://haveibeenpwned.com/Passwords to test whether your password has ever been used (by you or anybody else) on a compromised site where passwords were recovered. It uses some clever client-side cryptography to avoid ever actually sending your password to the server, and the owner of the site (Troy Hunt) is well-known and respected... but frankly, if you're leery of entering a password you used anywhere into a new site, good for you! That's generally not something you should do! One way to handle it is change the passwords on all your accounts first, and then test it on https://haveibeenpwned.com/Passwords; that way, you can see whether an attacker would have had it, without risking giving Troy any of your current passwords.

2
  • Hello , thanks for taking the time to respond my questions . What are you suggesting if some passwords been breached for example in some platform? Should i deactivate the accounts that I'm not using anymore? But if yes isn't dangerous revisiting platforms that exposed my password?
    – linuxverse
    Commented Feb 4, 2023 at 19:55
  • If a site is actively under attack it might be dangerous to use it, but there's no harm, usually, in visiting one that was breached in the past. Obviously you shouldn't use a password there that you currently or will in future use with any other site, but you should never do that anyhow. The main point of checking for breached accounts/passwords is to help prioritize changing passwords (and perhaps also to help you understand how easy it is for a re-used password to be breached, leading to all associated accounts being compromised).
    – CBHacking
    Commented Feb 5, 2023 at 0:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .