FTP Username and password just given out

axer

Hi y'all,

I'm not one to normally criticise but I am helping out a local school with their website. It is hosted with UTV at the moment and I wanted to move it to a different hosting company.

I just rang UTV and was talking to their support. I simply said to the tech support rep "I want to get the FTP username and password for xxxxxx.xxx". The rep said it would have to be gotten from a server and I would be rang back. 2 minutes later I got a call from the rep to give me the username and password.

Thankfully in this case the request for the details is legit but one thing is for sure I will never be hosting with them.

This is hardly the norm for hosting companies - is it?

Thomas_S_Hunterson

A similar thing happened to me, myself and a mate were giving my schools website a bit of a once over while we were in Transition year. It was hosted with Rivertower. The previous webmaster, a teacher, was being narky with the password so we rang up rivertower and they gave us the password without any issues at all.

It's worrying.

mneylon

axer wrote:

This is hardly the norm for hosting companies - is it?

I can't speak for other hosting companies, but I can assure you that it wouldn't happen with us.

Seth Brundle

blacknight wrote:

I can't speak for other hosting companies, but I can assure you that it wouldn't happen with us.

I can actually vouch for this. I had been running a site for someone (and paying for the hosting) and behind my back they tried to take it from me. They rang up blacknight and demanded the login details to which Michele et al thankfully declined. By pure coincidence I had rang blacknight up right after that call.

Malice

Something similar happened to me. My company was taking over the maintenance of a website and I rang up the hosting company and the conversation basically went like this:

Me: Hi this is xxxx. We have taken over the maintenance of company yyy's website but they haven't given us the FTP login details. Can I have them please?
Them: Certainly. <Pause> Here you go. They are zzzzz.

They also e-mailed them to me. It was only after I got off the phone that I realised how insecure their whole setup must be as they made no attempt to check who I was! I spoke with the client immediately and they confirmed that they had made no contact with the hosting company on our behalf. Needless to say, we moved the client from that hosting company very quickly!

As the old saying goes: A security system is only as strong as it's weakest link.

CoNfOuNd

A lot of companies are far too trustworthy when they clearly shouldn't be. Worst of all they probably have no record of when they give out account details over the phone, so the actual owner won't be able to trace it back.

There are so many complaints about UTV. You're making an excellent decision leaving them!