News for hackers. Stuff that matters.

A comment on The ongoing story of a Dreamhost account compromise. Parent comment

Re:The ongoing story of a Dreamhost account compromise by Frazzydee on Tuesday March 30, 2010 @05:56PM (#1230292)
Why don't they want to change their passwords when they forget them? Presumably the old password isn't much use anymore, since it's been forgotten.

But unless there's something I'm missing, I suspect I'm just preaching to the choir right now ;)

[ Parent | on HN ]
Re:The ongoing story of a Dreamhost account compromise by andfarm on Tuesday March 30, 2010 @06:01PM (#1230299)
One or both of:

- They've forgotten the password, but it's still in the keychain (or equivalent) for their mail or FTP client, which will all stop working when they reset the password.

- The password is shared with other employees, and it might be difficult to notify them all of the new password.

[ Parent | on HN ]
Re:The ongoing story of a Dreamhost account compromise by Frazzydee on Tuesday March 30, 2010 @07:09PM (#1230446)
(1) Fair enough, I suppose some keychains might make it difficult to recover the password.

(2) Why not just ask the other employees for the old password?

[ Parent | on HN ]
Re:The ongoing story of a Dreamhost account compromise by andfarm on Tuesday March 30, 2010 @07:29PM (#1230481)
(1) Right -- and, even if it is possible to recover the password, walking a non-tech-savvy customer through the process may not be a palatable option, either for Support or for the customer.

(2) I wish I knew. Not really our place to ask, though.

[ Parent | on HN ]