Registrar password not-encrypted

[01globalnet]

Hello

 

First of all, nice product - watching it for many many months, but a few mins ago just decided to test it.

 

1) My main concern : I've installed various registrar modules and all passwords are stored in plain text.

 

Server passwords (whm etc.) are encrypted, admins passwords are encrypted, client passwords are encrypted - why not Registrars'?

 

This is a very serious issue once a db is compromised.

 

Is there anything else crucial that is not encrypted?

 

2) Moreover, any concern hosting whmcs in a shared enviroment (not storing cc)? I've seen many resellers install billing systems in their shared reseller accounts... Please share your opinions.

 

Thank you

[Adam]

Hey,

 

If your database is already compromised, then whats stoping someone from running a DELETE * sql query?

 

From my understanding, all passwords are already encrypted in the database. So for which part of the database are you seeing passwords in?

 

From,

Adam

[bear]

If your database is already compromised, then whats stoping someone from running a DELETE * sql query?

There are worse things than deleting the db. How about logging into your registrar account and doing damage there?

From my understanding, all passwords are already encrypted in the database. So for which part of the database are you seeing passwords in?

Have you looked in yours for the registrar info?

[Adam]

Hey,

 

Don't have a registrar account , just hosting and services for me

 

But that would explain why I never noticed it.

 

From,

Adam

[01globalnet]

If your database is already compromised, then whats stoping someone from running a DELETE * sql query?

 

There are worse things than deleting the db. How about logging into your registrar account and doing damage there?

 

Exactly !

 

From my understanding, all passwords are already encrypted in the database. So for which part of the database are you seeing passwords in?

 

Have you looked in yours for the registrar info?

 

Exactly, again ! Thank you bear!

 

The real problem is here, someone is accessing the domains, unlock and transfer to another registrar.

 

Deleting a database is not so serious ( you keep backups right ) - and the other information is not so 'critical' that will destroy your business asap. As soon as you realise you get compromised you change all server passwords.

[trine]

I would also agree here that plain text passwords should be stored with 2-way encryption.

 

Then again, if your box get's compromised, they'd be able to get that password anyway.

[01globalnet]

I will make a post in Features Request forum - I am not a current client, so I hope I do not break any rules.

[Matt]

I'll get this added for the next release.

 

Matt