Security: New VPS Account Info and Emails

[tonyg]

I just recently signed up for a few new VPS and received the customary new VPS info.

What I could not believe was all the nitty, gritty info was there for all to see...complete with username and password.

These VPS were through some of the best known and reputable VPS providers around.

How can in this day and age this still be part of the normal business practice?

Why not a link back and retrieve all the juicy details from the actual provider's site via https?

Tony

 

[cubixcloud]

Most providers simply urge you to change your password immediately once you are given credentials you input at the time of order. Any person worried about security would IMO.

 

[tonyg]

Most providers simply urge you to change your password immediately once you are given credentials you input at the time of order. Any person worried about security would IMO.

I understand that, but my point is:

Why send the username and password to begin with...just send a link back to the provider's site and then you can retrieve this info.

 

[Virtovo]

I understand that, but my point is:

Why send the username and password to begin with...just send a link back to the provider's site and then you can retrieve this info.

If you could sniff the user/pass, you could sniff the link and retrieve anyway?

 

[tonyg]

If you could sniff the user/pass, you could sniff the link and retrieve anyway?

What...sniff the link? How would sniffing the link get them in without a username and password?

Unless they are sniffing with SSLStrip you wil be fine, but that is another story.

 

[SrsX]

That is why when you register you use stupid passwords, for example I usually use (not anymore): tmpS301$@#

Once I get given the information, I change all my passwords at the provider including server password.

 

[BlueVM]

Feathur doesn't email sensitive information like passwords. Feathur uses a one-time activation link where the user sets their own password. Thus if someone were to get the URL via email it would be blatantly obvious and we'd simply issue a new unique link to the correct owner of the account.

I was hoping that other panels would change to help improve security... maybe they still will.

 

[WebSearchingPro]

Unfortunately when you have thousands of customers and you do not send the password, a large bulk of your sales tickets will be resetting passwords or answering password related questions.

Keep in mind most low end customers are not security experts and a vast majority do not learn English as their primary language so warnings at checkout are often ignored, not translated, or read. 

Edit: Of course if you allow users to set their own passwords and not deal with it at all, you will inevitably get passwords like "1234".  

 

[perennate]

Oh yeah, you should never enter a password you care about, because many providers store it in plaintext (SolusVM) even though the password should not be stored at all (I mean, only on the VM with the operating system's native hashing).

Our panel generates a random password and gives users the option if they want the initial VM information emailed to them (otherwise you can view it on the panel over HTTPS). Because for some people, especially if you're ordering multiple servers, it's easier to manage if everything is in your email inbox).

The best would be to show the initial password on order page and never store it again, but that'd be inconvenient for some users who don't pay attention, and then they'd have to reimage their VM.

Also all providers should provide a way for users to get their email sent with PGP encryption (if you're using Postfix, see gpg-mailgate-web). PGP should be standard.

It also stores passwords with far better encryption than most panels offer.

Encrypting passwords in the database is useless, you could just decrypt it with whatever the panel decrypts it with. Unless you mean hashing of course. But why store the VM password in the first place?
 

 

[perennate]

Feathur doesn't email sensitive information like passwords. Feathur uses a one-time activation link where the user sets their own password. Thus if someone were to get the URL via email it would be blatantly obvious and we'd simply issue a new unique link to the correct owner of the account.

I was hoping that other panels would change to help improve security... maybe they still will.

You edited your post but as far as I can tell you're still talking about the control panel password and not the VM password. What do you do with the VM password?

 

[BlueVM]

You edited your post but as far as I can tell you're still talking about the control panel password and not the VM password. What do you do with the VM password?

Feathur doesn't store the VM password at all. The user can change their VM password in Feathur, but Feathur just issues the commands to set it then drops the password from memory. 

The only passwords stored by Feathur are the account passwords and they're hashed with SHA256 at 50,000 rounds with a global and a user unique salt.

 

[willie]

Yeah, emailing passwords is pretty common practice.  It's also typical to have a link to reset your password by email.  That lets someone with access to your email get to your control panel and take over your VPS anyway.  Most KVM hosts I know of also make you configure your server through unencrypted VNC.   

Usually when I set up a VPS the first thing I do is install SSH public keys and then lock out all the ssh passwords.  The web passwords get reset to random ones through the (hopefully) SSL web server.  Sure it would be an improvement for hosts to stop sending passwords in the clear and to have 2-factor auth for control panels etc. But there is still that password reset link and I've had to use it a few times.  Any much more secure way to authenticate a user who has locked himself/herself out would be outside the price range for this type of service.  

Budget VPS's are great for the money but it's not really sensible to think of them as high-security products.

 

[tragic]

Just like other providers, we urge out customers to change their password and we mention this in the email.

 

[cubixcloud]

I understand that, but my point is:

Why send the username and password to begin with...just send a link back to the provider's site and then you can retrieve this info.

Mostly due to limitations of the software and as others said many tickets with hey change my password. Back in the old days that was something you were accustomed too and some had scripts then. But now days is so trivial why even mess around with reset password tickets.

@BlueVM since you mentioned it, Feathur might be something to look at in the future then. 

 

[tonyg]

Oh yeah, you should never enter a password you care about, because many providers store it in plaintext (SolusVM) even though the password should not be stored at all (I mean, only on the VM with the operating system's native hashing).

That is good info, definately something to keep in mind.

It's incredible how professinal software developers can skim basic security.

 

[Shados]

Feathur doesn't store the VM password at all. The user can change their VM password in Feathur, but Feathur just issues the commands to set it then drops the password from memory. 

The only passwords stored by Feathur are the account passwords and they're hashed with SHA256 at 50,000 rounds with a global and a user unique salt.

Why not use bcrypt?

 

[budi1413]

Learn from mistake. Next time when you first register the account just use simple password then after you succesfully registered and get confirmation email, login and change the password to a super complex one. I do this everytime for every website registration. Because i know most of them share common characteristic to send password in plain text over email.

 

[tonyg]

Learn from mistake. Next time when you first register the account just use simple password then after you succesfully registered and get confirmation email, login and change the password to a super complex one. I do this everytime for every website registration. Because i know most of them share common characteristic to send password in plain text over email.

My post was not because of a "mistake" I made.

I was pointing out an obvious flaw in the system which in today's world should not be part of normal operations.

 

[BlueVM]

Why not use bcrypt?

Everyone has their own preference when it comes to hashing passwords.  The point of hashing passwords is to make sure it's very hard, if not impossible to determine the original text. SolusVM stores the client passwords in MD5, which takes about 20 minutes to generate a rainbow table and discover 90% of the passwords listed. Compare that with SHA 256 with a global and a unique salt... it'd take weeks or months to determine every password. Thus giving administrators plenty of time to make sure their clients passwords are reset.

On top of that Feathur is open source unlike SolusVM. So if you wanted to change to a password encryption you prefer more the code is right there... Heck you could even make a upgrade out of it and release it so other people can use it...

 

[willie]

1. Current preference is to use scrypt rather than bcrypt.  Of course if you can hash with a secret key that's even better.

2. sha256 as a hash primitive may be disadvantaged by its popularity ;-).  There's a heck of a lot of last-generation bitcoin mining hardware out there, some of it in disreputable places, that's not really competitive for mining any more, but that still does sha256 orders of magnitude faster than is possible on normal computers.  I can't help wondering if any of it will be / has been repurposed towards breaking sha256/bcrypt which is in wide use.  I'd consider another hash function (truncated sha512t maybe) just to get in the way of that.