Hacker News Reader

> For active customers, sFTP and database usernames and passwords were exposed. We reset both passwords.

> For a subset of active customers, the SSL private key was exposed. We are in the process of issuing and installing new certificates for those customers.

Wow.. That's quite severe.. From September 6th to November 17th.. I wonder will they do a full impact summary after they figure it out internally.

View on HN

I hope they are talking about hashed passwords. There is no reason why in 2021 passwords can be recovered in clear text, even in a legacy code base...

It's about the database and SFTP usernames and passwords, how can you hash them?

I've met Demetrius and he's a smart, capable security professional who has already done a lot to bring GoDaddy up to shape. This is a an unfortunate miss for them after years of hard work to rectify these kinds of issues.

Unfortunately, 20 years of treating customers like dirt can't be washed-away by hiring one capable security professional. For dirt customers like me, the best way of judging a service provider is past form.

I don't buy from companies with a bad history. It's not some kind of behaviour-modification strategy; it's just self-preservation.

Reply on news.ycombinator.com