Hacker News Reader

I've had Digital Ocean reset a VM on a different account (a client's) just by asking politely from my own account (not impersonation or anything alike on my part).

While it was helpful on that occasion, it should probably go completely against policy to do stuff like this.

View on HN

You literally only asked politely? I feel like there was at least /some/ sort of info you had to provide.

When he submitted the ticket or whatever he was probably logged into his account and to DO that is probably a "the user is logged in so we don't have to verify his identity".

Ouch. That makes me wary of using DO.

This is an issue with all providers, though. It's not specific to just DO.

Of course. The weakest link seems to be customer support when it comes to security.

Yep. That’s why it’s so crucial that these companies try to adapt solid guidelines in order to minizime the risks of social engineering attempts.

I wouldn't say all - but many. However, there is always more than one way to skin a cat.

Gandi states that they won't reset it - but offers instructions on how to do it [1]. Which, presumably if you are spinning up VMs the owner of the account should get an email notification.

[1] - https://wiki.gandi.net/en/hosting/gandi-expert/change-root-p...

Reply on news.ycombinator.com