GoDaddy injecting JavaScript into websites and how to stop it

https://www.igorkromin.net/index.php/2019/01/13/godaddy-is-sneakily-injecting-javascript-into-your-website-and-how-to-stop-it/

by ikromin • 8 years ago

949 302 8 years ago

igorkromin.net

hilyen2• 8 years ago

GoDaddy has always been horrible.

walrus01• 8 years ago

Nobody should ever use godaddy for a domain registrar or hosting services. Ever inherited a domain that was with them, and had to renew it? The sheer amount of unsolicited add-on offers you have to reject before successfully completing a payment for domain renewal is ridiculous.

There's a reason why companies like namecheap which market themselves on "no bullshit" registrar services are popular these days.

iamdave• 8 years ago

I've been buying exclusively from Domai.nr for the last five years now, and I only ever login to buy a new one, or change payment details--which ends up with me rarely having to login. Years ago when I was with GoDaddy and starting my time on the web, it was daily, I knew some of their support people by voice.

As far as "no bullshit" registrars, Domai.nr has been short of incredible.

Thought I'd share the option if anyone is looking to migrate and at least wants options on the table to think about, along with namecheap.

notyourwork• 8 years ago

Namecheap has been great, I've also had good luck with Gandi.

namuol• 8 years ago

How to stop it: Use a different hosting service.

calibas• 8 years ago

Their marketing is effective at convincing small business owners they're one of the best choices for hosting. That's pretty much the whole reason they're so successful.

mark-r• 8 years ago

I thought that would be good enough, I went with WebFaction. But it seems they recently merged with GoDaddy, so even though I explicitly avoided them it turned out I didn't.

Who's a good alternative these days?

ahmedalsudani• 8 years ago

Hover, Gandi, Namecheap, AWS, Google, Cloudflare.

There are many decent alternatives. From the above, I have used all but Google and Cloudflare. My experience has been pleasant with all that I have used.

meepthegeek• 8 years ago

have a look at https://freedns.afraid.org/

SyneRyder• 8 years ago

I'll mention FutureQuest. I've been with them for 20 years now. I'm certain they're not the cheapest, and I'm aware their website looks a decade or more out of date. But I've been extremely happy with them, they definitely wouldn't do something like GoDaddy did. They started as a small family business, and while they've grown a bit since then, many of the staff are still there. My occasional customer support emails still get answered by familiar names.

Since they're not the cheapest, I throw my experimental projects up on DreamHost, but my mission critical stuff is on FutureQuest.

https://www.futurequest.net/

Drdrdrq• 8 years ago

Hetzner (in EU).

sumedh2• 8 years ago

I moved to Webfaction just to get away from godaddy couple of years back and recently got an email that webfaction is merging with Godaddy.

Time to move away from webfaction now.

ChuckMcM• 8 years ago

pretty much pure evil. But hey its GoDaddy right?

There are at least three places where you can get injected, one is from the ISP (including phone company networks), one is from the hosting provider, and one is from add-ons in the browser.

One of the first Java applets I wrote (and you could easily do this in js) did a hash over the document page and reported if the hash didn't match the one stored in the applet. These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc.

userbinator2• 8 years ago

These days you could throw up an other wise invisible div that said "Page Tampered" please report to webmaster (or you could even do that yourself with a lookup on your hosted side to a script that would log IP/browser etc.

I've already encountered pages like that, they piss off everyone who uses adblocking/filtering so I would consider it an anti-user technique.

markdown3• 8 years ago

There are at least three places where you can get injected, one is from the ISP

I'm not sure if they still do it, but Vodafone in my country (and many others) used to cache and compress photos on all websites, which often led to visible degradation in image quality. Luckily I discovered that their software respected the `Cache-Control: no-transform` header so include that header on all my websites now.

int0x80• 8 years ago

Vodafone did also inject custom js/html in non HTTPS pages (obviously). This was 2 years ago.

johncolanduoni• 8 years ago

Are they sophisticated enough to modify CSP directives (in HTML or headers) to allow their scripts? If not that would be an easy solution.

ufmace• 8 years ago

Wouldn't it be better to just set up TLS terminated in a service you control?

throwaway8879• 8 years ago

The best way to stop it is to stop using GoDaddy. About 10 years ago.

willio58• 8 years ago

All interactions I’ve had with godaddy have been terrible.

obelos• 8 years ago

Who ever thought a registrar would be more awful than circa-1999 NetSol?

giancarlostoro2• 8 years ago

I remember when I first bought a domain from them. I guess I fell for the marketing witchcraft, they advertised the domain for a lower price than what I ultimately paid, once I heard about Namecheap I went there and never looked back. My other problem was that their domain management interface was soooo slooooow, it got to me. This was in about 2008, but I rather not fall for their overpriced domains.

Edit: My other pet peeve was that they supported SOPA when that whole mess was ongoing. I can't trust them at all since.

joering22• 8 years ago

You shouldn't trust Namecheap either. Just because nothing happened to your domain, doesn't mean when it does Namecheap will help. I had numerous issues over the years including someone being real jerk over their chat and just because of their rudeness and knowing my email and full name, was able to took over my account.

Namecheap is not cheapest neither (Namesilo)

https://www.trustpilot.com/review/www.namecheap.com

markdown3• 8 years ago

I've been very happy with Namecheap. I moved all my domains to them year that Godaddy did some bad shit (off the top of my head, they supported SOPA and the CEO Bob Parsons slaughtered an elephant in Zimbabwe for sport).

sureaboutthis• 8 years ago

We've used Namecheap for 7 years and have had no problems you mention at all and, needing tech help from them only twice, found them extremely helpful and friendly.

Ayesh2• 8 years ago

A happy NameSilo user and a former NameCheap user here. NameSilo is awesome!

Their UI will remind you of 2012 but it's functional and has all features you'd expect to be there.

carbocation• 8 years ago

GoDaddy convert here - Google Domains has worked out fine for me for the past few years.

saagarjha• 8 years ago

Second Google Domains; I use it for my website because they are cheap, no-frills, and have never tried to upsell me on anything. Sure, it's Google, so it might shut down tomorrow, but the domain registration market is large enough that I could probably just move.

J253• 8 years ago

Gandi is my go to alternative.

https://www.gandi.net/en

EduardoBautista3• 8 years ago

Mine as well. Only major registrar with U2F. They seem to take security very seriously.

Niten• 8 years ago

I've had good luck with Gandi in the past for SSL certificates, and their U2F support makes me inclined to choose them as my new registrar.

On the other hand, I've heard less than great things about Gandi's reliability and support lately. If you've had to contact their support team, what's your experience been like?

Jerry23• 8 years ago

Only major registrar with U2F

I recently went looking for a registrar and one of the must-haves was U2F. Only Amazon and Google had it. Didn't know that Gandi has it as well. Good to know!

PS: I was disappointed that Cloudflare still doesn't have a U2F support yet they are a part of critical infrastructure for much of the web. We ended up not using them because of that.

JChase23• 8 years ago

Namecheap is supposed to be getting it soon: https://www.namecheap.com/blog/true-totp-2fa-and-u2f-are-com...

justusthane• 8 years ago

Hover has U2F.

LeoPanthera• 8 years ago

Seconding Gandi. Their (old?) slogan, though surprisingly sweary, is accurate.

EduardoBautista3• 8 years ago

Still seems to be the case:

https://www.gandi.net/en/no-bullshit

aboutruby• 8 years ago

Also Google Domains https://domains.google and soon Cloudflare Registar: https://www.cloudflare.com/products/registrar/

jppope• 8 years ago

might be a good time to remind everyone that cloudflare is providing profit-less domain renewals ;)

shimms• 8 years ago

But with fewer tlds supported (for now).

Was excited to move my GoDaddy registered domains there, alas none of them are supported (yet).

Jerry23• 8 years ago

Cloudflare still lacks U2F. For domain names and hosting, this is something that you should not compromise on.

user59944614• 8 years ago

Cloudflare has had 2 factor authentication for years.

https://support.cloudflare.com/hc/en-us/articles/200167866-H...

guessmyname2• 8 years ago

This is quite ironic because I used to work in the security team at GoDaddy, writing tools to scan and clean websites infected with malicious code injected the same way. To find out that the company is using the same technique (for something less malicious?) is very surprising to me. I guess they never asked for a review of this feature to the security team, otherwise I doubt they would have approved it.

sk5t• 8 years ago

The very notion that GoDaddy could be in a position to "clean" websites of malicious code is--what's the word?--stupefying? profoundly unsettling? mystifying?

Wintereise• 8 years ago

Why? For those of us who've worked in hosting, it's a routine thing that you help customers do every day.

At their scale, trying to automate it hardly seems surprising.

bpchaps2• 8 years ago

Is this common in web hosting? I'd be pretty livid if my web host was modifying traffic, regardless of the intent.

JChase23• 8 years ago

I work for a competitor and we definitely do not do this, so I don't think it's ubiquitous at any rate.

joecool10295• 8 years ago

It's not unheard of. Some platforms offer New Relic RUM integration which breaks shit (like XML sitemaps).

I am guessing the hosting provider gets access to the information the client also gets, but that's just a guess without any evidence. It would just make sense in the absence of regulation.

icdsoft2• 8 years ago

This is something absolutely unthinkable in our company. However, we have heard of other providers using similar tactics in the past, so always do your research before trusting a provider with your website.

pas• 8 years ago

There used to be a lot of web hosting companies that offered free hosting and injected their ad frame.

user59944614• 8 years ago

It's very common with features like A/B testing, analytics, advertising and CDN.

This should be inserted by the customer instead of filtering traffic, but not necessarily. It's very user friendly to only have a button to turn something on or off.

sulam• 8 years ago

It’s pretty surprising to me that they could ship a feature like that without an enforced review by security and probably several other teams (legal and pr come to mind immediately).

ShakataGaNai• 8 years ago

Last time I got a "your site is infected with malware" alert from GoDaddy...it was for a domain parked with GoDaddy.

ve55• 8 years ago

GoDaddy has always been one of the worst providers or registrars someone can use. I wish I was surprised by a practice this bad.

Brajeshwar• 8 years ago

The best "How to stop it" would be to change registrars. Domain registrar is a highly commoditized, extremely low margin, volume play business. There is always another company better than the other.

Personally, I have a ResellerClub account that I 'sell' to myself and my families. I also use name.com and namecheap.com for both my personal and my companies domains. They all are good.

There is Google too, and CloudFlare entered the market.

Question: Even if one registers with GoDaddy, what if the DNS is at CloudFlare, it won't have this problem, right?

lathiat• 8 years ago

Doesn’t even matter where the DNS is. This is happening on the actual web hosting server.

userbinator2• 8 years ago

Yet all my pages were being served with the following <script> injected into them just before the closing </html> tag...

The free hosts I used many years ago would do something similar, with no way to opt out --- that is, until I figured out they were just detecting the '</html>' and inserting before it.

Combine that knowledge with the fact that the closing tag of the HTML element is optional, and you can guess what I did pretty easily. ;-)

jszymborski2• 8 years ago

If you want valid HTML, and if they aren't parsing the DOM, then the following would likely work as well:

<!--

</html>

-->

minitech• 8 years ago

It’s valid to omit </html> (<html> too, for that matter).

pmtarantino• 8 years ago

I remember those times. They were beautiful. I could spent hours trying to search for the best free webhosting that includes PHP, MySQL and Phpmyadmin, and didnt fill my website with popups or banners at the top/bottom of the webpage.

davidcorbin• 8 years ago

The good ol days :)

tomyws• 8 years ago

Some hosts didn't even bother with this. I used a PHP host who ran another script after serving the hosted one, but it you used `die()` you could skip any other fluff they included.

ssttoo• 8 years ago

How is this company still in business is beyond me. Maybe their clients are less savvy (non-HN-frequenting) site owners

roywiggins2• 8 years ago

I think that's exactly their target market.

ilaksh• 8 years ago

Since people are recommending alternatives, take a look at Netlify. It's my new favorite thing.

For me GoDaddy is like a client test. If they are using something else for hosting, plus one point to them. If they use GoDaddy for hosting, minus ten points. If you can't convince them to move away from GoDaddy, you probably want to replace that client if possible with a more reasonable or less cheapskate one.

Also I believe that https would prevent injections.

dpacmittal• 8 years ago

Netlify is a static site hosting, it's more like Github pages than godaddy hosting.

yjftsjthsd-h• 8 years ago

Also I believe that https would prevent injections.

Depends where it happens. On shared web hosting, they control SSL termination and everything behind it.

foobarbecue2• 8 years ago

I've used godaddy, namecheap, and 101domain. Godaddy was about ten million times better than 101domain in terms of customer service. I'm kind of surprised they would do something this malicious.

vortico• 8 years ago

This article is about GoDaddy web hosting, not DNS.

foobarbecue2• 8 years ago

oops!

thaumaturgy4• 8 years ago

In case this turned out to be misleading, I picked a random GoDaddy-hosted low-cost site (hometailer.com) and yep, there's the code:

That's pretty gross.

gigatexal4• 8 years ago

Happy with my namecheap domain hosted in Linode: never going to touch a godaddy domain for any of my needs.

abc-xyz• 8 years ago

A lot of people recommending NameCheap in this thread.. it's worth noting that they supposedly gave a warning to a guy running a forum with millions of visitors that they would suspend his account if he didn't remove two images within 24 hours (https://news.ycombinator.com/item?id=14139288), and that they're dumping costumers private info (https://news.ycombinator.com/item?id=18063667). I'm guessing there are other horror stories as well, but those two alone (which to me sound credible) were enough reason to take my business elsewhere.

dbg314152• 8 years ago

I was a huge fan of Namecheap, and I have like 25 clients using them.

But... I haven't been a fan of them lately.

I've got a password manager and 2FA on all my accounts, and I went to sign in. I kept getting an incorrect password response. Reset, tried again. Just kept getting the same error. Freaked me out as I couldn't sign in.

Fast forward, came to find out because I was on my company VPN they were blocking me. Rather than just show a message, "We don't accept users on a VPN..." they let me think my password was wrong and go through the panic of not being able to sign in. And, even thought they thought I was some sort of spammer / hacker for using a VPN, they were more than happy to discuss my sign in details over live chat.

I sort of get "security" here, but they shouldn't be heavy handed with just saying who can and can't sign in, and if you are going to block me, tell me why -- at least send an email letting me know what's up if you don't want to display a browser message. 2FA was enabled, at that point... just leave it up to the user where they want to sign in from, don't put in secret rules around who can and can't sign in.

Anyway, I moved everyone over to Amazon Route 53 and haven't had any more issues.

criley2• 8 years ago

This solution is for the 1% or the 0.1%, the vast majority who choose Linode are creating vulnerable servers because they are not going to competently keep the machine up to date on security patches or configure it properly for security.

Managed hosting is a requirement for the masses, and comparing a managed hosting service with a self-service VPS is a bit disingenuous IMO. Managed may seem more pricey, but that's only unless you don't value your own time as an administrator, or if your time isn't valuable (you're not good at it lol).

1337shadow• 8 years ago

If you're happy with namecheap you will be delighted with bookmyname imho

christophilus• 8 years ago

GoDaddy is the Oracle of web hosting companies. I don’t understand their popularity, yet it seems to be going strong. Why is that? (Serious question, not rhetorical.)

SteveNuts• 8 years ago

I would guess it's their marketing that helps. They're one of the few with prime-time TV commercials.

swebs• 8 years ago

Advertising. I remember seeing tons of not-quite-porn ads from them even during superbowls.

elorant• 8 years ago

Cheap .net packages, shitton of advertisement, constant discounts and offers, and more importantly they own the domain market.A lot of people buy domains from them and it doesn't take long to host something on that domain, so why not stick with them. Long story short, the power of convenience.

manyxcxi• 8 years ago

It’s name recognition. Whenever I have to help a company, friend, or family that doesn’t really know “tech”, their domain is, without fail, hosted by GoDaddy.

radicalriddler• 8 years ago

I was talking to my roommate, a non tech person, and asked her where she she got her domain, out of interest. She said GoDaddy. I let her know about their shittiness, but normal non I.T. people don't know enough to care.

hilyen2• 8 years ago

The JS file creates cookies, which would break GDPR I am guessing.

paulie_a• 8 years ago

While this seems pretty terrible in general. The GDPR is generally irrelevant. A large amount of websites will never need to even think about GDPR. If anything there is an over reaction complying to a law that will never be applicable.

GDPR matters to the EU. It doesn't apply elsewhere.

jobigoud• 8 years ago

It matters to EU citizens. We are everywhere.

johnnyfaehell• 8 years ago

GDPR applies to any company with a significant prescene in the EU. I think it's hard to believe GoDaddy doesn't. They sell large number of domains with EU based TLDs. They've even bought EU based hosting companies.

GDPR doesn't apply to companies that only have a tiny portion of EU customers. Good examples would be: small local news, US only shops. (K-Mart, gun shops, etc)

GDPR being an EU law doesn't matter so much when there are so many treaties allowing fines to be forced. This means not being in the EU just makes it more expensive to deal with.

hyperman1• 8 years ago

The GDPR lets you set as much cookies as you want. They are mostly an irrelevant implementation detail.

The GDPR will however care that your traffic passes through GoDaddy, no matter if they set cookies or not. To be more precise, the GDPR will consider GoDaddy a processor of your data and you as a controller will need a proof from all your processors that they process data in a GDPR compliant way.

In practice, most european web hosting companies set up a web page somewhere that gives you this proof, and will,for a small payment, give you a signed, printed copy of this page. For most small to medium sites, either option will do.

technion5• 8 years ago

I have created a gist with "beautified" version of the script the inject.

https://gist.github.com/technion/5de5739ee803ed0641b2de81660...

djsumdog• 8 years ago

I'm guessing this is some shared hosting solution where you don't have a lot of control or ability to add things like LetsEncrypt (but I'm sure GoDaddy will sell you their SSL offerings).

I noticed some of my sites getting Vodaphone banners when using Ireland/UK sim cards and realize they were injecting crap into my site. That really helped me make the push to use LetsEncrypt on everything.

I realize that 3rd party Wi-Fi/ISPs injecting code is a slightly different issue that the one in the article, but the solution is running SSL everywhere. If you need to login to a captive portal that redirects, there's always neverssl.com

benjaminjackman• 8 years ago

If you need to login to a captive portal that redirects, there's always neverssl.com

There's also:

http://http.rip

(which is easier at least for me to remember for some reason)

roywiggins2• 8 years ago

example.com responds on http, and since it's reserved by IANA I more or less trust it to not serve malware, so I always just use that.

linkmotif• 8 years ago

Serious question, why do people use GoDaddy? What does it have to offer in terms of price/features/anything that’s better than any other provider?

joecool10295• 8 years ago

It's cheap and it's a big company. They are basically the Walmart of domain registration. Out of having to deal with something like 40 or 50 registrars and resellers over the years I give them a slightly above average rating. Really, for all the bashing this thread people are giving there are far worse. They aren't great, but things will probably work with them.

I'll talk about alternatives now. Yeah, I know Gandi is cool, but they want too much money so majority of people pass them by.

If you want a really horrid example: 1and1 is a company that sets the bar. They buy up superbowl and print ads to lure in old people with cheap domain registrations (like $1 or so). Once sucked in they use a careful reading of the ICANN regulations to maximize difficulty in doing anything.

Oh, you want a transfer? That's going to be a week. Most things either go over the phone or through a panel that's down or nonfunctional half of the time.

Want to change nameserver delegation to your own DNS servers? Fuck you then. They wipe the current DNS records and process the change in a couple days. Your site can take a vacation.

Now, I hear a lot of people saying Namecheap is a good choice. They are ok, we recommend them but their panel likes to shit the bed and it can take hours to push DNS updates when things aren't running great there. They finally got off being an ENOM reseller, which is great. ENOM are assholes. I had a client that hired an ENOM reseller some time ago to register their domain and host their site. The reseller's company's owner got arrested and/or deported and while we were able to save the client's files the domain expired with no way for us to renew it. The good news is you can gripe up the chain to ENOM which will require a 5 year domain registration for $200.

That's it in a nutshell. They are a large company which has a service that mostly works for a cheaper price than arguably better options like Gandi.

Shout out to other terrible registrars like Yahoo Small Business (ugh)

rawoke0836003• 8 years ago

"Now, I hear a lot of people saying Namecheap is a good choice. They are ok, we recommend them but their panel likes to shit the bed and it can take hours to push DNS updates when things aren't running great there."

Yup !! Thats my experience also !

tracker111• 8 years ago

Other issues with Google aside, their registrar service has been great. I have 2FA on my google login and the domain services are pretty nice all around. No upsell, some integrated service options (close to one-click). Included Google DNS service and free mail forwarding.

NOTE: I use the free mail forwarding so I can continue using some very old email addresses.

miguelmota• 8 years ago

GoDaddy has crazy marketing and dominate search results in that regard.

They bait and switch their customers into buying a really cheap domain for the first year and then rake up the price for subsequent years.

It's annoying for businesses to switch everything over to a new provider, especially not so technical people that don't want downtime, so they eat the cost.

GoDaddy alternatives which aren't shady are:

Namecheap

iwantmyname

AWS Route53 Domains

Google Domains (wouldn't be surprised if they kill this service though)

rawoke0836003• 8 years ago

"Namecheap" used to be my fav but their backed is totally unreliable and broken.. At times when you add a new item to your domain (say mail) its not uncommon for the DNS settings to reset ! Happend to me twice.

Also lost my DNS settings for another domain after i "browsed" their backend !

aaronds• 8 years ago

+1 for iwantmyname - such a simple service - does exactly what I want without any fuss

tracker111• 8 years ago

I don't think Google Domains is going anywhere, it's complementary to Google Docs and their cloud services.

technion5• 8 years ago

People keep talking about domain registrations and competitors in this area, but the majority of GoDaddy customers don't know what means. The majority of competitors in the shared hosting space are part of the EIG conglomerate, which is largely more of the same.

All the options we might call "better", including deploying a static site to Netlify or GH Pages, using a cheap VPS or a complex AWS deployment, aren't actually options for the people buying these services, who expect a one click Wordpress deployment.

tracker111• 8 years ago

Google domains has close to 1-click integration with Google Docs for the mail side, and Wordpress via bluehost integration.

I've been VERY happy with them. Hadn't been on their main app in a while and it looks like they've improved the UX a bit. I do have gdocs on one of my domains, but probably will drop it. Otherwise I'm externally hosting a few things. I am also making use of the mail forwarding options for addresses on a couple of said domains.

austincheney4• 8 years ago

This has convinced me to take precautions. I am adding some logic to my site that if there are more than two script tags (I only have 2) replace body content with error text and send an xhr notification back to the server so that the server will know their pages are compromised

It’s as simple as document.getElementsByTagName(“script”).length

EDIT:

Here is my tested more sane approach: https://gist.github.com/prettydiff/f9f85fffb00a903ecd3f2cfe0...

I do not have an xhr notification in place in the gist, because I have not written a service to receive it yet.

ATsch2• 8 years ago

You could do this much easier and better with a Content-Security-Policy. Whitelist the things you want to allow, and set a report-uri to get notified of any CSP violations.

austincheney4• 8 years ago

CSP wont help you if you authorize scripts with a source of self or if the malicious script contains a relative "src" attribute.

This approach has the added benefit of letting you know that malicious things are happening.

franciscop• 8 years ago

What about those plugins that the user chose and add a script tag? While they should be becoming less common (since I read it's a bad practice), they are still out there.

im3w1l• 8 years ago

Did you consider a "silent alarm", that only phones home without displaying an error?

austincheney4• 8 years ago

No. Perhaps the most important part of this is keeping the user informed.

throwdaddy425• 8 years ago

This is facepalm-worthy and very unsettling. This is why I use NameCheap.

dizzyfingers• 8 years ago

I’ve followed HN for around 10 years now but even basic stuff like this can come across as jazz to me. Funny thing is I understand jazz at a professional level. I feel foolish because I use godaddy, because they have good customer service and their interface is easy to understand but as a HN lurker I want to have good web etiquette. I’m going to see about turning this feature off in the way the author describes but what can I do to stay clear of the Kenny Gs of tech? Full disclaimer I have nothing against Kenny G, and even respect him, just one of those jazz expressions...

Jedi72• 8 years ago

Companies that do this kind of garbage don't deserve your dollars. Its not enough to apologise after the fact, or offer opt-out, or any other half measures. I'm moving my domains over to someone else this week because of this.

DonHopkins3• 8 years ago

You shouldn't use godaddy unless you support exterminating elephants.

https://gawker.com/5787676/meet-godaddys-ridiculous-elephant...

ATsch2• 8 years ago

I think it's pretty unfortunate that even now, CSPs are getting so little love in the comments of a post where they would have easily prevented this script from loaded at all, and could have helped the author discover the script the second it was added.

For the unitiated, Content Security Policies (CSP) allow you to, among other things, define a whitelist of origins for things like scripts, css etc. and also notify you of violations. There is little excuse to not set a strong CSP on your sites if you can and you'll be glad you have it once something does happen.

Semaphor• 8 years ago

There is little excuse to not set a strong CSP on your sites

true, but

if you can

IIRC that excludes every website with Google Adsense and even just using a manual ad network includes always fiddling with your CSP.

kgwxd• 8 years ago

Anyone using either of those doesn't care about user security and privacy anyway.

dcbadacd• 8 years ago

There is little excuse to not set a strong CSP on your sites

Can't use CSP if you want any ads on your page usually. If anyone here knows an ad provider that plays nice with CSP and pays okay then please do let me know, I'd love to securely monetize a few webapps of mine.

DCoder• 8 years ago

Then again, Vodafone Portugal was caught rewriting CSPs of all your visited pages to whitelist their own domain last year [0].

[0] https://twitter.com/JackyHallyday/status/968263408003973121

jopsen3• 8 years ago

Nothing can save you if you don't trust your hosting provider, or don't use HTTPS.

However, "was caught" is important :) The more noise they make the more likely they are to get caught.

raimue2• 8 years ago

How would a CSP have helped here? GoDaddy injects that additional script tag right into the HTML file it serves. No policy will help if the web server does not serve what you uploaded.

StavrosK2• 8 years ago

The browser wouldn't have loaded the linked JS file. This is exactly the attack that CSP is designed to thwart.

Then again, GoDaddy could just rewrite your headers.

kodablah• 8 years ago

That's not true. CSP can have a specific host/path for scripts and won't even run JS in the page without explicitly opting in to 'unsafe-inline'. It's an important prevention technique against XSS for pages showing user generated content.

blntechie• 8 years ago

Isn't the script injected inline in the HTML here? I have only little experience with CSP but wouldn't it only prevent from loading external scripts?

jrahmy• 8 years ago

CSP affects inline scripts as well. They are actually disallowed by default and must be explicitly whitelisted.

megous2• 8 years ago

You can also make this assignment throw:

    window.tcg = ...

And the script will do nothing.

boramalper• 8 years ago

…and how to stop it

by not using GoDaddy.

I mean sure, it’s fixable, but this shouldn’t be a norm (for a paid service)!

oyebenny• 8 years ago

How does someone stop their internet service provider from doing this?

ndnxhs2• 8 years ago

VPN/https

ddtaylor• 8 years ago

"Monitoring performance"

I can't think of anything related to performance of the server that can/should be monitored using a client-side script versus a server-side component.

heipei• 8 years ago

I originally built a service to detect exactly this kind of large-scale injection of content and similar occurrences (e.g. library prevalence etc). This is a perfect example of how to find the GoDaddy injected content: https://urlscan.io/search/#%22tcc_l.combined.1.0.6.min.js%22

Another provider I found doing something similar is 000WebHost: https://urlscan.io/search/#filename%3A000webhost They "just" inject a footer with an image and a link to their service though. Not sure how common this is in the low-cost hosting space.

ndnxhs2• 8 years ago

000webhost also had their database leaked with plain text passwords.

Too• 8 years ago

Enabling HTTPS only should stop this right?

Or are they able to inject it even then since they are the hosting provider?

tuxone2• 8 years ago

No and yes.

m-ueberall• 8 years ago

Are you sure they have full access to your TLS certificates? Or can't you bring your own in this case?

dzek69• 8 years ago

It reminds me times of 5MB free web hosting from 2000 or so. A lot of them was doing it.

zzo38computer• 8 years ago

If someone is injecting JavaScript codes into your website and you do not want, put your own JavaScript codes which cause it to display a message asking the user to disable JavaScript if they want to access your webpage!

zaro• 8 years ago

Luckily there is a way to turn this off Luckily I am not using GoDaddy and most probably never will.

pdkl95• 8 years ago

The document ($PAGE + $NEW_JS_SCRIPT) is a new, different work. I doubt the added Javascript is a large enough change to be considered "transformative" and worthy of a separate copyright. The new work isn't a fair use of the original work, because it doesn't meet the statutory requirements[1]: 1) isn't a protected use (education, journalism, criticism, etc), 2) the original work is usually creative and (patently) published, and 3) the entire original work was included. Since the Javascript was added without without consent (or even any notification), we can assume GoDaddy hasn't negotiated with the original authors for a license to made derivative works.

Therefor this is probably a violation of copyright. Does anybody using GoDaddy for hosting want to sue GoDaddy? Statutory damages up[2] to $150,000 per work adds up fast.

[1] https://www.law.cornell.edu/uscode/text/17/107

[2] actual damage amount in copyright cases varies a lot - this is simply an upper limit

naniwaduni7• 8 years ago

Sadly, I think they have their ass covered in their TOS, under "User Content Other Than User Submissions": "You hereby grant GoDaddy a worldwide, non-exclusive, royalty-free, sublicensable (through multiple tiers), and transferable license to use, reproduce, distribute, prepare derivative works of, combine with other works, display, and perform your User Content in connection with this Site, the Services and GoDaddy’s (and GoDaddy’s affiliates’) business(es), including without limitation for promoting and redistributing all or part of this Site in any media formats and through any media channels without restrictions of any kind and without payment or other consideration of any kind, or permission or notification, to you or any third party."

I'll admit I didn't look that closely though.

beokop• 8 years ago

While you’re at it, why not sue for emotional distress? Or lost income for the time reading this instead of billing clients?

I’m all for GoDaddy being held responsible but advocating this kind of copyright abuse is as ridiculous as it is scary. Are we going to start suing CDN’s for setting custom HTTP headers now?

jopsen3• 8 years ago

You've presumably given GoDaddy a license to serve your content if you're hosting it on GoDaddy. It's probably all covered by some user agreement.

I think the important part is: Use a hosting provider you trust!

robin_reala• 8 years ago

I use a CSP on my site to work around potential JS injections: script-src 'none'. Possibly a little heavy handed but it does the job.

quickthrower2• 8 years ago

GoDaddy: the SourceForge of web hosting.

tracker111• 8 years ago

^^^ This is a very appropriate analogy.

throwaway321388• 8 years ago

This is nothing. India's state-owned ISP BSNL routinely injects js tracking and ads into HTTP pages.

https://www.reddit.com/r/india/comments/8wj6ec/bsnl_and_mtnl...

It's not surprising that this PSU like every other in India is being destroyed from the inside, and is well on its way into the mouths of the private vulture funds.

Hoasi• 8 years ago

Not surprising given GoDaddy's long history of malpractice and terrible behavior.

"Oh, but we've changed" they said... Glad I ran away from anything they touched since they acquired Media Temple.

toyg2• 8 years ago

Sigh. It’s crap like this that will eventually force me to leave WebFaction (that GoDaddy acquired), after a decade of excellent service. I never touched GoDaddy, but it looks like the plague comes to you these days.

ris• 8 years ago

This. WebFaction, in my eyes, is as good as shared hosting can get. Built an entire company on top of its robustness & trustworthiness. I was beyond dismayed when I heard the news of the acquisition (sorry, "partnership") and every time the GoDaddy integration is mentioned I go surveying the alternatives.

kpozin• 8 years ago

I'm in the same boat. Have you found any decent replacement for WebFaction?

toyg2• 8 years ago

Not really - the market has moved on to PaaS, a reliable shared-hosting-cum-shell with a Python slant is not easy to come by.

I’ll probably go with an OpenBSD vps somewhere, praying not to get hacked, plus Heroku for when I really can’t be arsed to look after a service. Quite a pain in the ass, though. At least my domains are already on Gandi...

demarq2• 8 years ago

probably should be a ask hn, but in 2019 isn't there a ready to go docker image or something that allows you to be your own webhost. Isn't it weird that we still pay for someone to run an apache instance for us on the web?

Koffiepoeder• 8 years ago

1) You need an ISP which allows this (opening ports 80 and 443), or that allows hosting more generally.

2) It is probably not a good idea to have people manage webservers without in-depth security and server knowledge.

3) You still have to arrange DNS-hosting.

4) Webhosting can be a lot of things, e.g. database hosting, http website hosting, email hosting, etc...

5) When hosting your own website, traffic bursts might become a problem for your own internet. Do you really want to open your own IP for DDoS attacks?

6) Probably external nameservers (e.g. cloudflare) would be a good idea (see 5).

7) By hosting your own server, you have a lot more legal liabilities.

There's a lot more to this than you would think on first sight. I outlined just a few problems and issues above, but there's probably many more. Truth is that it's probably not a good idea to host your own website if you're just a small business, or hobbyist (unless you want to learn something).

demarq2• 8 years ago

okay, good points.

You need an ISP which allows this (opening ports 80 and 443)

Anywhere on the internet that allows you to run a box allows you pretty much any port you like. DO, Linode, Light Sail

It is probably not a good idea to have people manage webservers without in-depth security and server knowledge.

Yes. But in my experiences most pwning happens due to application sec rather than server sec. i.e wordpress/drupal instances that aren't updated regularly and vulnerable plugins installed on the same. But I see your point, and I think it applies to any DIY effort.

database hosting, http website hosting, email hosting

Yeah, when you sign up to any host out there they give email, seo, and logging. But I feel most clients would only really need database + app + email services. And for email Gmail and Proton are really the only quality choices. So you could get away with only offering database + app hosting.

You still have to arrange DNS-hosting.

no, I think most domain registras will do this for you and offer a decent interface around this. I use namecheap and they are just stellar!

When hosting your own website, traffic bursts might become a problem

This is the same for most webhosts anyway. In fact the problem is worse for webhosts. The cheapest box on Digital Ocean can easily outperform you run of the mill webhosting package. The resources available to each app on shared hosting is laughable for anything but you mom and pops local bakery or blog.

Do you really want to open your own IP for DDoS attacks?

I don't think this is a problem you can get away from either way. You eventually have to use a service like cloudflare as you mentioned for this; webhosted or DIY.

By hosting your own server, you have a lot more legal liabilities. I agree with you on this one.

tracker111• 8 years ago

I'm pretty font of dokku. Runs great on DigitalOcean. I would DIY it on a base linux image so you have an easier upgrade path. The extension for Let's Encrypt is pretty great too. I tend to just have a Dockerfile in the root of my project, and `git push deploy` up to it when tests pass. It works well for single-server small/mid sized applications. You still have full docker for other bits, but the integration is nice.

NOTE: if you use the $5 droplet level, you must add a swap file or you will have issues. You probably should do this anyway.

Crontab• 8 years ago

It is kind of sad how every single web-based technology is turned against us. I shudder to think what they will be able to do with Web Assembly.

zimbatm• 8 years ago

how to stop it

When faced with egregious business practices the best option is to switch company. What guarantees do we have that GoDaddy won't toggle the switch back at some point, or introduce other trackers?

There are plenty of website hosting solutions out there. While at it, switch your domain registrar to a reputable one like https://www.gandi.net/

otachack• 8 years ago

Yep, and tons of others. And, it seems, they all require the feature to transfer providers. Consumers have the upper hand and should take advantage of it. I guess it requires awareness, though.

hellofunk• 8 years ago

Gandi might be great for common domain suffixes, but their support for country-specific domains is poor, they just don't offer that many. If you're not in the U.S. it can be frustrating.

techaddict009• 8 years ago

Name.com is good in that case.

theWheez• 8 years ago

This specific instance says a lot about how GoDaddy conducts their business. Enough to keep me away.

ojosilva• 8 years ago

I've switched to name.com a while back due to decent pricing and an easy to use rest api to change some of my subdomains ip address dynamically.

Has any one encountered sleezy practices like GoDaddy with name.com? I take my domain registrars reliability and business practices very seriously!

MrMorden• 8 years ago

Pair Domains takes my money and provides me exactly what they advertise. The only issue I've had is that their DNS service doesn't have all the record types I want, so I use CloudFlare for that.

DonHopkins3• 8 years ago

Why are you using godaddy in the first place? It's not like they aren't universally reviled for many good reasons. You deserve what you get for not educating yourself about what a terrible company they are and voting with your feet.

You might as well be complaining that you're surprised Larry Ellison isn't looking out for your best interests, David Miscavige tried to brainwash you, Donald Trump didn't tell you the truth, and Rick James ground his muddy cowboy boots all over your suede couch.

https://www.youtube.com/watch?v=ddIz-ydl6Yk

rdiddly• 8 years ago

Habitual line-steppers, all.

wpietri• 8 years ago

I don't think victims ever "deserve what they get". Yes, he's responsible for the outcome. But outfits like GoDaddy exist because they're good enough at advertising and PR to fool the novice. People can't be experts in everything.

Blame should stick to the bad actor, not the people they sucker.

JohnFen4• 8 years ago

People can't be experts in everything.

But you don't have to be an expert to conduct a web search.

Blame should stick to the bad actor, not the people they sucker.

I mostly agree with this, but I have a hard time not placing just a little blame on the people who don't engage in even the bare minimum of research.

EastSmith• 8 years ago

Spend half a day moving all my domains out of godaddy to cloudflare. Never felt better.

dguo• 8 years ago

I see a lot of mentions of Namecheap in these comments, but I recently discovered another option on tld-list[1]: Porkbun[2]. I don't need much out of a registrar, so price is the main consideration, and Porkbun's renewal prices are significantly cheaper ($8.70 for a .com, versus $13.16 on Namecheap).

I would consider using Cloudflare's new at-cost registrar service[3] for everything, but they don't allow you to use non-Cloudflare nameservers.

I've also experienced strange issues with logging in to Namecheap. From what I remember, I kept getting a server error message. Sometimes it happened after submitting my password, and sometimes it happened after submitting my 2FA code. Customer support couldn't help, and the issue went away the next day.

[1] https://tld-list.com

[2] https://porkbun.com

[3] https://www.cloudflare.com/products/registrar/

lkdjjdjjjdskjd• 8 years ago

Switching away from GoDaddy seems like a better approach.

On a related note, last I tried Cloudflare (a couple of years ago) they also injected JavaScript into my site. The JavaScript was larger than my site.

tr33house• 8 years ago

went to Google domains a while back and never turning back. Waiting for my domains with them to expire before turning them all over. GoDaddy runs its business like they only want to do business once with you

sonnyblarney• 8 years ago

Anyone care to explain, line by line, what that JS actually does?

technion5• 8 years ago

It's going to take some time to break it down line by line because it's minified and reads like garbage.

But look at line #230. You're basically seeing a list of information it gathers, and everything above helps populate that information.

Then everything below posts it off to their server.

tyingq• 8 years ago

Since it appears to be opt-out and hidden, this seems like it might be in violation of CFAA.

ykevinator• 8 years ago

Injecting is misleading, why don't people just use Amazon, is it just too much work or is shared hosting that much cheaper including cost of maintenance?

dylan604• 8 years ago

Shared hosting is typically a set amount per month. AWS is a mystery on pricing.

oneepic• 8 years ago

I read the code gist that someone else posted earlier...can someone explain to me exactly why this is gross in the first place?

I can easily imagine a scenario where someone innocently added this code with good intentions (i.e. purely for performance data that sites can use) as opposed to being evil. It may be the case that there wasn't enough internal review of the code in question, and that's all. Also you have the ability to opt out...

adanto6840• 8 years ago

Apparently my ISP (Cox) injects stuff as well? I've never seen this message before, but just now stumbled on it for the first time -- have been with them for 5+ years now, first time I've seen this message though.

https://imgur.com/a/f4BLf3h

Aside from the cap topic, it's outrageous to me that they find it OK to alter/inject into HTTP responses like this. Send me an email, sure -- but to alter responses?!

bo1024• 8 years ago

Just to be clear, this is a different kind of injection. Yours is at the visitor end (the ISP modifies the page while delivering it) while the original is at the server end (GoDaddy modifies the page while serving it).

tracker111• 8 years ago

This is an issue with many, especially mobile, carriers... the key is to use HTTPS everywhere, and send issues/requests to sites not HTTPS to switch. Let's Encrypt removes the last reason why a site shouldn't be all HTTPS.

Note: fixing redirect rules for logins on some sites is a significant PITA, but should be adjusted accordingly by now anyway.

droithomme• 8 years ago

This can cause massive unwanted legal liabilities to the customer under GDPR.

KrishnaGD2• 8 years ago

Hey everyone, Krishna here, I’m on the hosting team here at GoDaddy. There are some excellent points in this thread. I wanted to give a little bit of background about GoDaddy’s use of Real User Metrics (RUM) and our plan regarding its use moving forward.

A little more than a year ago, we created a RUM javascript for our customers. The javascript is extremely lightweight and evaluates hosting performance only. We did this to create a better hosting environment for our customers. We rolled this out to a small subset of customers.

As the RUM proved very beneficial in optimizing our hosting platform for our customers, we decided to roll it out to a wider audience. That said, we clearly could have better communicated this program.

Based on all the feedback, we have decided to turn off the RUM javascript immediately and focus on designing the program so that customer participation is on an opt-in only basis. While the RUM data is beneficial in helping us improve our customers’ website performance, we regret that the implementation has upset many of our customers and we apologize for any inconvenience this has caused.

Narasimha Krishnakumar VP of Product Management - Hosting GoDaddy

Calib3r• 8 years ago

If there is a chance this would break someone's website, why would you default this feature to being on?

Please Daddy, don't be so rough.

KrishnaGD2• 8 years ago

We are not perfect and should have thought through this more. We created the script to be as non-intrusive and lightweight as possible. The number of incidents we saw were so minimal, we kept moving. We’ve obviously learned a lot from this and it will be 100% opt-in when we reintroduce it later.

JohnFen4• 8 years ago

Wow. This is completely over the line and unacceptable.

It appears that GoDaddy's reputation for being dodgy is well-earned.

GoDaddy injecting JavaScript into websites and how to stop it

Related Stories