Active incident at Dreamhost forcing password reset
dreamhoststatus.com
dreamhoststatus.com
These status updates from the PHP incident would also have us believe that they were never directly affected: https://www.dreamhoststatus.com/pages/incident/575f0f6068263...
They're being awfully vague about this issue so far. 8 hours ago I submitted a ticket requesting more information and they've not responded yet. I guess that they're still in the thick of it.
Having worked in support for years quite often higher layers of the company will give T1 support almost no information on what happened intentionally. That's pretty standard corporate CYA policy in litigious societies.
One might reasonably expect it to scream/shout and swear if one mentions PHP.
Thank you, this actually makes some sense. It's disturbing to get these emails with zero explanation what's going on, and very frustrating that user community has to guess. But PHP vuln in a web client intercepting user logins is the only thing that makes sense, otherwise that would mean passwords in the clear or some other 1990s-era nonsense.
As a precaution they reset everyone’s email passwords, presumably from an assumption people use the same ones for both.
I’m surprise they still let people use FTP.
"As a precaution, we have expired the passwords for some email and FTP/SFTP users on your DreamHost account. Their old passwords no longer work, and no new password has been set."
But none of those email passwords were actually expired - all were working. This is confusing - did they only expire passwords that were under threat? If a password wasn't expired, should it be trusted?
The same email suggests you change all email passwords you control.
Another account received no email warning from DreamHost so I assumed it was fine, but 7 hours later it also received the same generic email.
My complaints:
- sucks that it took them 48 hours to identify the breach - perhaps understandable
- but once the breach was identified, how the fuck does it take them over 7 rolling hours to email their customers? That's terrible.
- confusing messaging: DreamHost are claiming that passwords are expired, but in testing multiple accounts, all of them are still working. Do I need to rotate these? (I probably will just for safety).
I'm a 25+ year DreamHost customer and generally satisfied, but this feels like amateur hour.
It also doesn't help that a lot of scammers use this, or fake cyber incidents, for phishing; so it's not like they have an easy solution for exempting "security emails" either.
Of course, if they are nuking everyone's email password that doesn't help for notification purposes -- but as of this morning, all my email logins are still working fine, so it seems they didn't actually do that? Confusing.
A single sentence like, "If a password wasn't reset as of (timestamp), we don't believe it could have been at risk." would go a long way to fixing these incident comms, if that's the case.
May I ask to where you migrated?
I might have been willing to stick it out, but their panel/website-management is so slow.
I love that I have infinite/unmetered email accounts. In practice I run 3-4 accounts on 2-4 domains, but they don't nickel and dime you on it, I've literally setup 1200 forwarders in the past. They have a good sending reputation.
What other provider does this as well?
Having said that, very little of that is being done by the sort of people who'd host it on a service like Dreamhost.
Support is primarily via chat these days.
Pricing wise they don’t beat Herzner anymore but are somewhat competitive with Digital Ocean.
I am gradually moving everyone to my own self hosting mostly for supportability reasons. We want to react in seconds, not hours, when a customer has an issue.
I could not believe what the hell they were charging for a year of hosting with a dedicated ip (which they at the time required if you wanted https, real scumfuck move), so I didn't pay.
I guess I hope they actually deleted my shit because I sure didn't get this email
I do not miss those days.