# My ISP asked me to tell them my account and FTP passwords - does that seem reasonable to you? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [November 7, 2010, 7:18pm UTC](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809 "2010-11-07T19:18:44Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [November 8, 2010, 9:39pm UTC](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809/21 "2010-11-08T21:39:32Z")
Thanks for that - I may look at migrating. Next bill doesn’t come from 1and1 until Feb, so that gives me enough breathing space to do it without rushing, I think. In addition to the webhosting, I’ve got three domains for which they handle the registration (1 free with the account - two additional, but I don’t think there are any transfer away fees). How do I go about seamlessly moving the domain registration? It’s really important to me that I don’t lose the domain names. ---
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [November 9, 2010, 2:03am UTC](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809/22 "2010-11-09T02:03:02Z")
> [@Mangetout](#): > > In addition to the webhosting, I’ve got three domains for which they handle the registration (1 free with the account - two additional, but I don’t think there are any transfer away fees). How do I go about seamlessly moving the domain registration? It’s really important to me that I don’t lose the domain names. It is always recommended to keep your domain registration separate from your web host so these kind of issues don’t arise. I use [hostgator.com](http://hostgator.com) for shared hosting and [moniker.com](http://moniker.com) for domain registration but there are many good alternatives. ---
**Author:** ![jjimm](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jjimm](https://boards.straightdope.com/u/jjimm)\ **Post date:** [November 9, 2010, 6:26am UTC](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809/23 "2010-11-09T06:26:58Z")
> [@Mangetout](#): > > Thanks for that - I may look at migrating. Next bill doesn’t come from 1and1 until Feb, so that gives me enough breathing space to do it without rushing, I think. > > In addition to the webhosting, I’ve got three domains for which they handle the registration (1 free with the account - two additional, but I don’t think there are any transfer away fees). How do I go about seamlessly moving the domain registration? It’s really important to me that I don’t lose the domain names. **AnalogSignal** is probably right. However, if you do want do a seamless transfer of hosting _and_ have your registration with the same people who do the hosting (I certainly have my URLs registered with DreamHost): 1. Rent the new hosting account. 2. Replicate the sites on your new webhost, assigning the relevant domain name to each site (this won’t have a public effect, but prepares the webhost for where to point the incoming domains). There’s a way of viewing and testing them through a browser that I can’t remember - you won’t have a static IP address though so I can’t remember how to do it, but I’m sure DreamHost support will tell you. 3. Inform your old registrar that there’s a transfer about to happen. 4. Use the DreamHost panel to instruct DH to initiate a transfer of such-and-such domains, providing the old registrar’s details. 5. New registrar will contact old registar. Old registrar will contact you and ask you to verify the transfer (in the old days this was often by fax; these days there’s either email confirmation or a secure verification form online). 6. Domain transfer will happen in about 24 hours if 1and1 are playing ball. 7. At this point both sites - and email - may be live at the same URL depending on the speed of DNS propagation and where a visitor is in the world. (That said, I’ve had it happen instantaneously - DH may have a good relationship with one of the top-level DNS servers.) But just in case it’s vital to keep both sites on the go simultaneously. You may have to check two mailboxes too to make sure you don’t lose any email. 8. After about 48 hours, to be completely safe, during which time you should archive email from your old host, you can then close down the old hosting account. 9. Then play with the goodies on the new site! By the way, the Google Mail at your domain part is optional. Personally my new clients get it, with POP3 enabled, as it’s such a good interface, but you don’t have to - DH have their own webmail/POP client too, though it’s fairly primitive. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [November 9, 2010, 9:06am UTC](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809/24 "2010-11-09T09:06:23Z")
> [@AnalogSignal](#): > > It is always recommended to keep your domain registration separate from your web host so these kind of issues don’t arise. I’ve heard that, and understand the reasons, however, there’s also something to be said for having a single person to whip when something goes awry - there’s no way they can deflect responsibility. Also, many hosting packages come with free domain registration. It seems a waste not to take advantage of that, although I suppose it could be used to register something other than the primary domain. ---
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [November 9, 2010, 10:06am UTC](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809/25 "2010-11-09T10:06:40Z")
> [@Mangetout](#): > > I’ve heard that, and understand the reasons, however, there’s also something to be said for having a single person to whip when something goes awry - there’s no way they can deflect responsibility. But if the web host is unscrupulous or incompetent they can make your life difficult and delay transferring the domain. If my web host gets flaky, I would simply upload my site to a new host and redirect the domain to the new host. There is nothing the old host could do to stop this. ---
**Author:** ![Sailboat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sailboat/32/461_2.png) [@Sailboat](https://boards.straightdope.com/u/Sailboat)\ **Post date:** [November 9, 2010, 1:32pm UTC](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809/26 "2010-11-09T13:32:14Z")
There are reasons they might need your account or FTP passwords. None of those reasons are _the slightest bit_ legitimate. If for some stupid reason their system really does require them to ask users for passwords, it’s a huge neon sign their system is stupidly designed and badly run. Flee. ---
**Author:** ![kushiel](https://avatars.discourse-cdn.com/v4/letter/k/bbce88/32.png) [@kushiel](https://boards.straightdope.com/u/kushiel)\ **Post date:** [November 10, 2010, 6:44pm UTC](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809/27 "2010-11-10T18:44:17Z")
I’ve been on the other side of the fence, sort of. I do web development, but the place I work at has the web server across the country in a colo facility. I only have cPanel reseller access and cPanel can be wonky with what it lets you access as the superuser (it won’t let me access phpMyAdmin from the reseller account, which I find stupid) . But if I was the tech support in the OP, I would always reset your password, tell you why I needed to do so, and the instructions for you to change it again. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [November 16, 2010, 1:55pm UTC](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809/28 "2010-11-16T13:55:24Z")
Heh. A week on, nothing had happened - the problem file was still there. I emailed them: (replying to, and quoting their previous message - the one about the ‘one time courtesty’) > [@](#): > > Hi there > Please can you give me an update on when this problem might be resolved? The problem file is still there. > Thanks They replied: > [@](#): > > Thank you for contacting us. > > We have checked your case and found out that backup request was not processed because you did not provide us your ftp password. We could not request backup unless we verified the ftp password. > > If you have any further questions please do not hesitate to contact us. So I went back with: > [@](#): > > Three things: > > This is not a backup request. It’s a request to delete a file which I cannot delete myself either through the webspace explorer, or in my FTP client. > _ **Please would you confirm that you actually understand the request I made here?** _ > > Your support people already authenticated me on the phone, and stated that they would process the request without me needing to give you my FTP password (it’s right there in the email from [operative name] quoted below) > > I find it highly irregular that you’re asking for my passwords to verify my identity. And asking me to send this by email is even worse. They have now deleted the file, saying: > [@](#): > > Dear Customer, > > Thank you for contacting us. > > In connection to your concern, we check this file name [the file name] and it is no longer exist. Could you check on your end if the said file is still there? Hoping for your quick response. > > If you have any further questions please do not hesitate to contact us. Following the closure of this case, I did get a standard survey invitation to rate their service. As you can imagine, they did not score well - and I added comments to this effect. I’ll also be writing to them separately to discuss this matter further, however, I can’t really see any way they can restore my trust now. Time to start moving to a new host. [Previous page](https://boards.straightdope.com/t/my-isp-asked-me-to-tell-them-my-account-and-ftp-passwords-does-that-seem-reasonable-to-you/559809.md?page=1)