All Your Eggs in One Basket and Security

17 replies
Hi Guys

As many of you will already probably know the Honest Work From Home Forum seemed to disappear over a week ago. The full story is that just over a week ago Paul Lynch who runs that forum, had his hostgator account hacked into and the person targeted Paul's top 10 domains and redirected them.

Even though Paul has 100's of domains on hostgator only the top 10 were targeted, which leads Paul to think that the person who hacked his account knew what he was looking for. The good news is that the forum should be back online in the next few days, and Paul has managed to get the rest of his domains sorted out as well.

This just goes to show that your online security is something that you should take seriously especially if you market online. As it is possibly your income source that is at risk of being stopped should something go wrong.

This story also raises the question about not having all your eggs in one basket. We all know that we should ideally be setting up different flows of income from our online or offline marketing, but I wonder how many of use have 2 or more income generating sites or blogs on the same hosting account.

I don't know about you, but this has made me think about maybe spreading the sites that make me money over 2 or 3 different hosting accounts, especially the ones that make more than enough to cover the cost of doing that, but what do you think?
#basket #eggs #security
  • Profile picture of the author Benjamin Ehinger
    You are correct and I personally have two different hosting accounts for this reason exactly. I have never been hacked, but I don't like to take that chance and if it does happen it will not kill everything I have.

    Benjamin Ehinger
    {{ DiscussionBoard.errors[4890708].message }}
  • Profile picture of the author rtailor
    I agree with you to have multiple sources of income and not to rely on one for security reasons. But if our control over our domains is week and are not secure enough to prevent from expected hackers than we should seriously think about it. If a hacker can hack one domain, he can do so with your other also.
    Main thing is to make them secure even if you have only one. If its secure than no problem at all.
    Signature
    Keep your environment neat and clean
    {{ DiscussionBoard.errors[4890836].message }}
  • Profile picture of the author sbucciarel
    Banned
    That's amazing. I have only one domain that I purchased through Hostgator and I can't even find the damned thing to change the nameservers on it. I just contact them and they do it for me.

    I keep my domains separate from my hosting accounts and have two hosting accounts to spread things out a bit.
    {{ DiscussionBoard.errors[4891025].message }}
    • Profile picture of the author art72
      Originally Posted by sbucciarel View Post

      That's amazing. I have only one domain that I purchased through Hostgator and I can't even find the damned thing to change the nameservers on it. I just contact them and they do it for me.

      I keep my domains separate from my hosting accounts and have two hosting accounts to spread things out a bit.
      I have 10 or 12 domains that I purchased through Registry Rocket, HG's registrar, and I agree, after I contacted them, they explained how to find them, and I still couldn't locate them. Their over-priced and the service sucks.

      Definitely keep my domains and hosting seperate, and am even considering using multiple hosting accounts as time and money permits.

      This thread drives home a message that applies online and off. As my wife, son, and myself all worked for the same company for 2 years and due to a rather abrupt take-over, and rumors (lies) from the previous owner stating; we'd all have our positions well into the new year... it didn't play out like that, and we all got walking papers last Tuesday.

      Arguably, I saw this coming when we all took the jobs initially, as I can be quite hot-headed, and feared if one of us were to have a disagreement, it would effect the whole. Amazingly, it was a rather unespected series of events, but I am actually glad, as we're moving on.

      Back to the topic... My 'unlimited' HostGator business account currently has nearly 75k files uploaded, and I just now realized; they only allow 100k files max... so much for 'unlimited,' huh?

      With that said, I actually like HG for hosting, so, my complaint remains with their domain registrar, just to clarify things.

      Never-the-less, I can easily reduce the files by using Amazon S3, and deleting a bunch of junk. But to think someone established as the OP points out having a malicious attack destroy a life's work, I have seen this repeated throughout my life offline as well.

      The hard part being, for every sense of security or honest effort, there's a locksmith, coder, or villain out there with equal or greater knowledge who can crack open a vault, and prey on the unsuspecting, which really pisses me off.

      Maybe, we should revert to the old days, and start hanging people of such vicious intentions.

      Thanks for the heads up, great share.

      Art
      Signature
      Atop a tree with Buddha ain't a bad place to take rest!
      {{ DiscussionBoard.errors[4892188].message }}
  • Profile picture of the author Alexa Smith
    Banned
    Originally Posted by gaz59 View Post

    I don't know about you, but this has made me think about maybe spreading the sites that make me money over 2 or 3 different hosting accounts, especially the ones that make more than enough to cover the cost of doing that, but what do you think?
    I think this is a really good idea.

    I think people often don't pay enough attention to issues of this kind, until they themselves have a problem.

    I think there should be more threads like this one and people should pay more attention to them and contribute to them more.

    I hold all my domain registrations at Namecheap, and divide my hosting between Hostgator, TypePad and Weebly (if anyone's interested, I think TypePad and Weebly are both outstanding hosts, though TypePad isn't exactly the cheapest). This is pretty inconvenient for me, because the sites I have at Hostgator I can't even work on myself, and I'm still unable to use Wordpress.

    I do sometimes wonder, though, when I read things like this, whether Wordpress sites are actually a little more likely to be hacked than anything else? Just as so many email viruses used to be designed specifically for Outlook/(Express) because that was so commonly used? I'm wondering if there's a generation of "Wordpress hackers" out there, and some other kinds of sites might be a little safer? I don't know enough about it to form an opinion, but it does make me wonder: one seems to read all the time about Wordpress sites, specifically, being hacked. I don't think it's just because there are more of them than anything else? (If indeed that's even true in the first place?).
    {{ DiscussionBoard.errors[4891263].message }}
    • Profile picture of the author art72
      Originally Posted by Alexa Smith View Post


      I do sometimes wonder, though, when I read things like this, whether Wordpress sites are actually a little more likely to be hacked than anything else?
      Also a good point, with all the free open source plugins, it almost seems too easy for a programmer to gain access through a number of portals, as was so with Tim Thumb app which was quite popular, and later proved an access point for hackers.

      While, I am slowly learning WP, I am a far cry from being competent enough to understand programming at the security levels required to actually feel my computer or my sites are truly ever safe.

      There's too many people whom I know (indirectly) who have a massive amount of technical knowledge, and still cannot prevent malicious malware, viruses, and hackers from screwing up their sites, or more over their livelihood.

      One of my affiliates (and Warrior) had quite a battle with a similar experience, causing his sites to go down for a week or so.

      I am curious to know if all this 'cloud storage' will be a safer, and more effective way to house and transfer our data, but I am far from educated on it yet to really know if it is an alternative to the poblems discussed here?

      All the Best,

      Art

      PS- I did invest recently in an external hard-drive, and still probably don't back-up as often as I should.
      Signature
      Atop a tree with Buddha ain't a bad place to take rest!
      {{ DiscussionBoard.errors[4892326].message }}
    • Profile picture of the author Benjamin Ehinger
      Originally Posted by Alexa Smith View Post

      I think this is a really good idea.

      I think people often don't pay enough attention to issues of this kind, until they themselves have a problem.

      I think there should be more threads like this one and people should pay more attention to them and contribute to them more.

      I hold all my domain registrations at Namecheap, and divide my hosting between Hostgator, TypePad and Weebly (if anyone's interested, I think TypePad and Weebly are both outstanding hosts, though TypePad isn't exactly the cheapest). This is pretty inconvenient for me, because the sites I have at Hostgator I can't even work on myself, and I'm still unable to use Wordpress.

      I do sometimes wonder, though, when I read things like this, whether Wordpress sites are actually a little more likely to be hacked than anything else? Just as so many email viruses used to be designed specifically for Outlook/(Express) because that was so commonly used? I'm wondering if there's a generation of "Wordpress hackers" out there, and some other kinds of sites might be a little safer? I don't know enough about it to form an opinion, but it does make me wonder: one seems to read all the time about Wordpress sites, specifically, being hacked. I don't think it's just because there are more of them than anything else? (If indeed that's even true in the first place?).
      I think wordpress is targeted a bit more than other types of sites, but there are also security measures you can take to make sure you are less likely to get hacked.

      Benjamin Ehinger
      {{ DiscussionBoard.errors[4894448].message }}
      • Profile picture of the author Spinoza77
        Nice thread, keep it up guyz.. I was going along with my computer for a while and was thinking I am safe with a good antivir and common sense. Then an friend of my came over (security expert). We found some deep rootkit on my computer. Now I have get rid of those. The bad think is that they have been there for years, and no antivir detected it and they still do not have them in the their DB. But we know that they did something funny in my kernel.
        {{ DiscussionBoard.errors[4894494].message }}
  • Profile picture of the author Gary Ning Lo
    I always separate hosting and domain.. (you never know)

    **** can always happen and i try to always have a plan b in all the things that i do.

    Cheers,

    ~Gary
    Signature
    -------------------------------------------------------------
    {{ DiscussionBoard.errors[4891271].message }}
  • Profile picture of the author JCorp
    Yes, definitely separate hosting and domain...

    I have quite a few domains as well and I try to separate them between 2 hosting accounts as well.
    {{ DiscussionBoard.errors[4891282].message }}
  • Profile picture of the author salaka
    HEY
    great point nevre thought of that one?? need to consider
    {{ DiscussionBoard.errors[4891297].message }}
    • Profile picture of the author Alexa Smith
      Banned
      Separating the domain registration and the hosting matters only if/when something goes wrong. (Which, as we all know, "only happens all the time").

      If your host isn't also your registrar, then in the event of any accident/problem, if anything ever goes wrong with your hosting, you're in control, not them. And can avoid nightmares, disasters, long delays and entirely unexpected "ransom demands". And can re-host your site somewhere else the next day, minimising the commercial interruption.

      There's a large number of horror stories of hosting/registration/control disasters scattered about the forum, almost all of which could have been avoided by registering and hosting in two different places.

      Brad expresses it very well, with several well-known examples, in this post.

      It's one of those issues which so many people look at and think to themselves "Eew, well, those are all other people: it wouldn't ever happen to me". Until someone on one of their lists reports them, even with absolutely no justification at all, to their host for alleged "spamming" and their website disappears and the host (in accordance with its TOS which few people have ever read all the way through at the time they registered the domain) suddenly wants hundreds of dollars to release the domain so they can get it back online somewhere else.

      The point is that "whether something goes wrong" may not be within your own control - it can be just one of those pretty random things that Winston Churchill called "events". :rolleyes:
      {{ DiscussionBoard.errors[4891316].message }}
  • Profile picture of the author Home Easy Earn
    Well it looks as if Paul Lynches forum is now back online but it has taken him the best part of a week to get it back. I think we can all learn something from this.
    {{ DiscussionBoard.errors[4892111].message }}
  • Profile picture of the author eminc
    Hi,

    A very nice idea to have separate hosting panels with separate domains. I would like to point out some bad practices, which some people follow regularly which leads to compromised passwords and potential attacks or threats.

    Here's one example scenario. People hire programmers and give away their control panel ids and passwords. One more scenario, you buy a software and it doesn't work. You contact the service owners and give them your IDs and passwords. After the work is done, nobody changes them. Why?

    I am not blaming the programmer or service providers for hacking or leaking your passwords out. Their or your own computer may have a backdoor or a trojan which leaked the passwrds out. There are more than a thousand active viruses, worms and trojans which do that.

    Some simple guidelines that I follow to keep my whole system secure:

    1) [Important] Keep the computer clean (Install antivirus, anti sypware, etc. and get them to update daily)
    2) Don't provide passwords to people. If you do, change it after your work gets done
    3) Change your passwords monthly, regardless of when you have changed them last time.
    4) Put passwords on my laptop and desktop.
    5) Different password for every account.
    and finally,
    6) Do a check for all my websites once a week, just to see if something is not behaving the way it should. (Wonder somebody hack your server, and puts an advertizement with his affiliate link on your website )


    Mohit
    {{ DiscussionBoard.errors[4892237].message }}
  • Profile picture of the author Mikey D
    Another thing to consider is your password security. Do you use the same password for all your sites or do you use different passwords? Personally, I use different passwords for everything - using lower and uppercase, symbols, numbers, and max length.

    I do web maintenance for many clients, and I've noticed a lot of people will use the same database passwords, the same hosting logins, e-mail, etc. The scary part? Most of these passwords aren't even secure or hard to guess.
    {{ DiscussionBoard.errors[4892676].message }}
  • Profile picture of the author art72
    Passwords... that reminds me, my PayPal account was 'hacked' a couple of months back, and while they resolved the $212 rather quickly, I changed my password. But, the phone rep also mailed me (free of charge) a nifty little credit card with a 'digitallly generated' pass code for added protection.

    Funny thing being, I have still yet to use it, despite being amazed that it is like a credit card, with a "calculator-like" 6-digit password generator built-in. Here's a link, which may better explain it:

    https://cms.paypal.com/us/cgi-bin/?c...y/security_key

    Art
    Signature
    Atop a tree with Buddha ain't a bad place to take rest!
    {{ DiscussionBoard.errors[4893242].message }}
  • Profile picture of the author HelenAbell
    Unfortunately there's a perpetual arms race between hackers and the security measuers hosts can take, so you can never guarantee your host is secure enough. The cloud won't solve that I'm afraid. It's good advice to have a backup host and keep control of your domain so you can re-direct it if you need to.
    {{ DiscussionBoard.errors[4894319].message }}

Trending Topics