Breaches, traders, plain text passwords, ethical disclosure and 000webhost
troyhunt.com
troyhunt.com
1. A dump of 000webhost's user database was being circulated and actively exploited for over six months, and they either never realized what was going on, or never took any action. (I'm not even sure which would be worse.)
2. 000webhost made themselves essentially impossible for the author to contact (regarding a very serious security issue!), and still haven't publicly acknowledged the breach, beyond forcing a password reset.
Like the other commenter said, sadly, 000webhost and many were very popular back in mid 2000s during the Great PHP Frontier goldrush. I had used it, but luckily I was using a ghost email address that couldn't tie back to my real identity, so the best people can do is add that password to a list of known password database.
(and yes, point 2 makes that redundant in this case)
I played for a while with sending people warning letters asking them to upgrade known vulnerable versions, and more often than not they would just close their account and move it somewhere they "don't have those issues".
It's easy to be amongst larger application developers and lose track of just how low the bar in the market they are playing in.
Also. Unresponsive companies like this contribute to the volume of people who don't bother with responsible disclosure and just go straight to full disclosure, anonymously or not.
Companies need to see a hit on their bottom line or a breach in their own security before they take it seriously, as has been demonstrated time and again.
That tells me that you've got a security team (even if its one person who wears other hats too), and it implies that anything encrypted with that key will be forwarded to your security team instead of being triaged by front-line support staff.
It definitely lends creedence to your Application Security offering.
Unfortunately I believe I'm on that list from when I was in middle or high school, dabbling with PHP. I'm certain that I haven't used that password in nearly 10 years (and of course now use a password manager with random passwords for every site), but it still feels terrible anyway that my email and plaintext password are being sold online.
They will happily pay $50 - $200 for drinks on the weekend, but when something hosting comes up, there's a perception that it "should" be free.
At the end of the day, we all pay. It's just a question of how much...
I did have problems with one site, it was hijacked by someone with a .ru email. I needed to point my name servers elsewhere in order to get my account back. Yes, it was a problem, but their staff was not completely indifferent to my problem. I've experience worse.
I can't knock a free server. If they get their security problems worked out, I would consider paying them, and using them for a site I really cared about.
For things I need to declare ownership or critical, I turn to the brand well known vendors. Not for the reason that they do very well in security, but they have lots to lose. And they have a office in my jurisdiction I can hunt down.
Digital Ocean is a good one for $5 and pretty stable for me. If all you need is a static site, use github.
No, I don't care if it means amazon doesn't get paid for the bandwidth consumed by an attack. Sometimes all I care about is not getting a 10k or bigger bill at the end of the month for what was advertised as free. IMO they really need a way of automatically shutting down VMs that go over limit instead of just charging the credit card on file.
Also, they have http://docs.aws.amazon.com/AmazonCloudWatch/latest/Developer... but like a lot of things with AWS, it's ridiculously complex.
Of course it would require you to set it up, but for the vast majority of companies that are on AWS, if they were to go over their budget, it would be worse to shut down the instances in that case...
http://www.reddit.com/r/netsec/comments/3qqo79/000webhost_da...
Anyone got a good host they use? Lol. There goes my weekend. Daaaaamnit!
Just a bit scared that someday these irresponsible companies will some day ruin it all for even ones that are responsible such as hashing passwords and other security measures.
Wonder if other Hostinger services were also hacked like YouHosting or Hosting24
"At 000webhost we are committed to protect user information and our systems. We are sorry and sincerely apologize we didn't manage to live up to that."
Being committed to protect user information and saving passwords as plain text are two different things in my opinion, though..