Hacker News Reader

Comment by keyle | Hacker News Reader

   "GoDaddy was storing sFTP credentials either as plaintext, or in a format that could be reversed into plaintext."

Goddamn, anyone else, feeling a deep anger rising, when reading this in 2021?

   "According to the report filed by GoDaddy with the SEC..."

In 2021, everyone has to be pissed off by javascript popups about cookie storage, but your passwords safety, screw that. Storing SFTP passwords reversible to plaintext, that's still fine, right?

As long as there is a SEC report... We look professional!

View on HN

> anyone else, feeling a deep anger rising, when reading this in 2021?

Look at most of the stories on the front-page of HN these days. Often some shiny tool to allow front-end JS devs to write and deploy full-stack applications automatically upon commit. I guarantee you they’re making similar newbie mistakes. Instead of SFTP it’ll be a serverless endpoint that returns entire User records, unhashed password and all, without any sort of auth check.

This has nothing to do with newbie mistakes. GoDaddy has been a household name for decades. This was not a newbie mistake, this was negligence and refusal to invest in modern technologies.

I'd rather risk it with the newbies, modern stacks usually have good tutorials and standard solutions to most security sensitive problems.

Last time I dodged a product because its website looked like it was designed in the early 2000's it was SolarWinds just over a year ago..

And they’ve been this bad continuously since the 90s, too, so clearly the market does not have a positive feedback loop for security.

I’m feeling nostalgic remembering helping clients migrate away from their breached shared hosting around the turn of the century, especially how this ended up being cheaper because GoDaddy was way over market rates.

Yep, just left a company where the contractors building out a core solution had just such an endpoint where you could get anyone's data, and worse, personal photos.

And of course, every API key and secret was just hanging out in the repo as well.

As long as companies view security as a worthless expense, and the only penalty is some monitoring (that no one uses) and a brief story everyone will forget, nothing will change. I doubt the stock will even be affected.

Maybe the CEO should be required to be put in stocks in the town square or something. With no real penalty, there is no change.

Stock is down 9% since announcement. It’s an interesting case study because you get clear arithmetic on how much this breach cost shareholders. Almost exactly one billion dollars. May be short lived but useful data nonetheless. Will inform infosec budgets going forward.

https://ibb.co/QMy8pZb

I'll bet on base64 "encryption"

VGhhdCdzIGEgc2FmZSBiZXQhIFRoZXknbGwgbmV2ZXIgZmluZCBvdXQhIFRoZSA9IGF0IHRoZSBlbmQgaXMgbmV2ZXIgYSB0ZWxsIHRhbGU=

Translation: "That's a safe bet! They'll never find out! The = at the end is never a tell tale"

Ah yes, be sure to base64 encode your secrets before commiting them to the git repository, everyone!

I would rot13() it twice to be extra safe. /jk

Thank you, I jokingly wrote rot26() expert once in a resume and got asked about it during an interview.

Back in 2006 as a college student, i had a sense of hashing passwords with salt.

What a visionary!

No, the point is that even newcomers can learn to do better than the team at godaddy did. They aren’t trying to brag, they’re pointing out that the team behind this compromise was negligent in their practices.

I get that. His idea was to implement rudimentary security practices. Practices that EVERYONE, even GoDaddy, should implement. I was being sarcastic.

My bad, I inferred that as less humorous and more condescending when I shouldn't have.

I don't really see the issue. It's not like some sort of deadly sin. If the users re-use passwords then that's on them.

As far as security goes, I would definitely include storing passwords in plaintext in a list of deadly sins.

Reply on news.ycombinator.com