GoDaddy Breached – Plaintext Passwords – 1.2M Affected

[Gogol]

Daaaang. Goes to show why you should always configure your own server. Also, @IamNRE touched on a good point. If you have to go for a shared hosting, please make sure you do not purchase it from that same company which you purchased the domain from.

It sucks to see a company as big as GD following the worst practices in the business. I wouldn't be surprised if they manage to find some sql injection now.

easy fix:

$password = md5($password);

Can I get paid?

Nopes, that's not enough. Specially because you don't have a salt. Stop using md5 guys, move on to sha.

 

[MJ]

Rule number 1.
Never have your domain register also host your domain.

Be like me, I followed rule number 1.

Yep, this is important. Also, avoid buying domains from GoDaddy. I have seen lot of domains theft reported on their platform

 

[getseoonline]

That's why we should all use 2 factor authentication. It's a must

 

[Dunga]

If only they spent more money on strengthening their security instead of all those models......

 

[MisterF]

GoDaddy confirmed that the breach has widened to GoDaddy Managed WordPress resellers that include tsoHost, Media Temple, 123Reg, Domain Factory, Heart Internet, and Host Europe.

 

[Steptoe]

How the fuck are Godaddy still storing passwords as plaintext in 2021 jeez

Nopes, that's not enough. Specially because you don't have a salt. Stop using md5 guys, move on to sha.

Probably too difficult for the Godaddy techs, they'll have to start with ROT13

 

[PatJustPat]

On a different note: Where can I get the database dump?

 

[nSnoopy]

Plaintext passwords... How come i am not surprised by this coming from Godaddy

 

[636173696e6f]

No big surprise here, worst company ever.

 

[Chris Newman]

GoDaddy (a domain registrar) being breached this way, is like a police station getting robbed.
There is nowadays NOTHING like data security. In the past, it may have been, but as of now and into the future, there is NOTHING like data security. Oh, in theory and whitepapers it all seems awesome, though. Reality is totally different.

 

[Dopious]

GoDaddy confirmed that the breach has widened to GoDaddy Managed WordPress resellers that include tsoHost, Media Temple, 123Reg, Domain Factory, Heart Internet, and Host Europe.

This is really bad, on top of this. I moved my last domain out around 8 years ago, so I´m happy that I did now .. =)

 

[MisterF]

This is really bad, on top of this. I moved my last domain out around 8 years ago, so I´m happy that I did now .. =)

They were good back in the day for the 99c .coms and that was about it even then.

 

[techguruxl]

GoDaddy confirmed that the breach has widened to GoDaddy Managed WordPress resellers that include tsoHost, Media Temple, 123Reg, Domain Factory, Heart Internet, and Host Europe.

I never knew 123Reg, Heart Internet, and Host Europe are GoDaddy resellers

 

[PatJustPat]

I never knew 123Reg, Heart Internet, and Host Europe are GoDaddy resellers

Host Europe! Those assclowns who tried to automatically renew my weird TLD domains, made it almost impossible to cancel, and then tried to (legally) extort a few hundred bucks out of me for that!

Not surprised at all.

 

[techguruxl]

I never knew 123Reg, Heart Internet, and Host Europe are GoDaddy resellers

My quick tip for checking if the host is a GoDaddy reseller is by clicking on the login /sign-in page & it redirects to secureserver URL. So maybe my trick doesn't work for all GoDaddy resellers.

 

[johnpham]

Don't they encode customer passwords?
Is this a way for anyone who is able to access their management system and just copy-paste is in hand billions of dollars?
I recently heard a saying: GoDaddy has nothing ... except that there is a lot of money. But only for advertising.

 

[HustleTong]

Great. Now GoDaddy will spend even more on paid ads in the next couple of months

 

[awesomewebsites]

Plain text. Who handles them?

 

[SnitchHunter]

Thank god that no one with a brain buys stuff from godaddy in 2021.
Seriously guys they need us to send passport and selfies for 1$ transactions

 

[jimbobo2779]

Wow. I am guessing that the passwords for their website are not stored in plain text but still, I guess it's time to move my remaining domains out just in case.