Update from Godaddy's CSO (Chief Security officer):
But just for calling back and talking about improvements, gives them a +1 (they are famous for ignoring their users).
Plus, that happened almost two months ago (see the date in the logs) and this post was on my draft for a while... So the sustained anger had time to pass.
But to me this still seems like letting GoDaddy off the hook. I understand they want to provide some sort of malware protection service for which they need to periodically log in to your vps with your password. The question is, if you are concerned about security at all, and you're not interested in taking advantage of that service, why would you continue to do business with a company that openly stores your password and makes it retrievable?
Seems like you shouldn't care if they have some sort of "procedure" in place for password retrieval. That's almost irrelevant. It's time to move your business elsewhere.
This is so unusual, and so unexpected that it should have been in the TOS, at the top. This should NOT have been a surprise, with proper description of the REAL TOS, rather than just the written TOS. (I am assuming this isn't in the TOS, I'm not a GD customer.)
The point is, the person with this key can view -- and possibly lose -- your password (which you may, but shouldn't, use in other places).
And once someone goes through this process, they can take it home with them.
The choice to do this, rather than to use an SSH key, is indefensible, and their explanation shows that they haven't got a clue.
They got root access (at least most hosts I know do), why would they need to reverse an encrypted password that would give them less access than what they already should have? Seems like BS.
That's the title of the post. without permission -- what you're saying could be true; however, permission is granted in that case.