26 października 2005
P.S. Kto to jest Marek Jurek?
26 października 2005
26 października 2005
25 października 2005
24 października 2005
24 października 2005
24 października 2005
24 października 2005
23 października 2005

23 października 2005
23 października 2005
23 października 2005
21 października 2005
20 października 2005
20 października 2005
19 października 2005
19 października 2005
19 października 2005
Ah tak. Mój kolejny hosting provider okazał się niewypałem. Lepszy taki, niż ten, którego obecny "wchłonął" - przynajmniej nie "przypomina" haseł do konta na LiveChacie. Do rzeczy:
Hello. After moving my account from xxxhosting to you I can not access my \"private\" dir via ftp (nor control panel) any more. In the control panel I see that the rights of this dir are different from the rest of the dirs, also, the Owner is not set to \"xxx\" (my login to xxx) or \"root\", but to matthewneeley or something. I think changing this should fix the problem.
Dear Valued Customer, You cannot have ownership of this directory while it is on the same level as your httpdocs directory. This directory will need to be moved into your httpdocs directory for me to give you access. If you do not object to having this directory placed in your web space, please reply with either the last four digits of the credit card number used to bill this account or the account password. We need to verify that you are authorized to make this request.
Move it to any other dir then which in I can manipulate the files (edit, delete, download, move) via ftp or the control panel.
I didn't use a credit card to pay for this account at xxxhosting.
Also, it makes me kinda sad that you ask for my password, while you shouldn't ever do that. This makes me figure - is my password encrypted in your database by any hash? Or is it only a text field, which everyone could look at if they have access to the db?
I didn't ask you to move the dir, however you can do it, if it will enable me the option to access my files. I can give you info about myself, but no passwords, credit card numbers etc.
How come I am the owner of other dirs that are on the same level as httpdocs, but it's impossible for the private dir?
It's quite simple - I want to access my files. How will you enable them to me is your problem. Sorry for the offence, it came out when you asked for my password.
P.S. This email account is also registered for the domain xxx.com in the whois database and the xxx panel. When making migrations on the domain, they ask the owner of a domain by email from the whois database. You can do so too for example, just mail me the question if I want to do it... You following me here?
It is not a security risk for personnel who have administrative access to the server on which your site is hosted to have access to cleartext passwords. The reasoning is that these personnel have complete access to all your files, email, DNS... everything about your account. For someone with that sort of access, the password is unnecessary because that person has direct control of all aspects of the account without needing your password. Your password does not give an administrator any more access to your account than they already have.
You can be sure that this really it's xxx asking you for your password because you initiated this support ticket. If this were an unsolicited message out of the blue asking you for your password information, that would be a good indication that you shouldn't give your password. In this case, you have contacted xxx and requested that files belonging to your account be manipulated, so we need to verify that you are authorized to make this request.
It's not the case that you can see my password. It is that it's not hashed (is it?). If somebody would ever reach your database, through internet or manually, ALL of your customers would be in huge trouble. Not saying in what trouble whould xxx be in. Isn't it obvious, that passwords should be always encrypted?
And, yes, I believe it is the admin who is contacting me. However, as a advanced internet user I know that no one should never ever give out a password. Who knows, if my or your mail account isn't read by someone else? Or the packets aren't cought on their way? Or tons of other situations?
I don't like to argue, so let's just say the password has xx characters which consist of alphanumericals. Happy? But as far as I believe it's the admin responding to me, you should believe that a user mailing from the account which is connected to the hosting account AND the domain name is in fact him. For future references, consult a better way to identify your users then passwords/credit card numbers and other such private infos. Most likely, try asking about all other infos that the user provided you when registering (date of birth, address etc.) or set up a var in the control panel which the user will paste you to confirm an action. Something like banks use with mobile phones - tokens.
Or, a simplier way: the md5 hash for my password is 2cf6da73531a532ecdf90f197fb9eacb.
Odpowiedzi jeszcze nie dostałem (22 godziny). Niezaszyfrowane hasła. To, co gumisie lubią najbardziej.
19 października 2005
18 października 2005
18 października 2005