From: Dan Nachbar <dan@...>
Date: 2011-10-08T05:30:39+09:00
Subject: OT -  dreamhost password security WAS Cheapest way to host low-traffic small-footprint Rails app?

On Oct 6, 2011, at 7:37 PM, brettg wrote:

> ...
> I'm a DH employee and I can assure you we do not store PT passwords; we do send PT over email for certain things though. I've been informed that said emails are being addressed as we speak.
> ...

Please ignore the following if you don't care about dreamhost.com.

Since several other folks on the list also seem to be dreamhost customers,
I'll risk belaboring this point and summarize things as I understand them
given a couple of recent exchanges with various dreamhost staff -

1) At issue are web control panel passwords and not linux user passwords.
2) Passwords for the web control panel are saved with two-way encryption.
   A password is decrypted and and emailed to the user in plain text if the
   user clicks on the "forgot password" link.
3) Customers can individually contact customer service and ask that their
   passwords be expunged from the encrypted file.
4) As mentioned above, dreamhost seems to have recognized that the current
   password recovery system is a problem and is in the process of fixing it.

Dan Nachbar