On 4 November 2026, BleepingComputer reported that DreamHost had confirmed a breach of its web-based File Manager. According to DreamHost's notice, an intruder was able to access the FTP/SFTP usernames and passwords of people who logged into that File Manager, and may also have accessed webmail systems. The intrusion ran from August 2026 until DreamHost discovered it on 23 October 2026. The report does not give a number of affected customers.

Source: BleepingComputer, "DreamHost confirms data breach exposed FTP logins and webmail sessions", 4 November 2026.

A password is a shared secret. You type it, the service stores some form of it, and often the same string is reused somewhere else. Whatever a breach copies keeps working wherever it is reused, until someone changes it. That is why a reused hosting or FTP password matters well beyond the one account it belongs to.

What a passkey changes

A passkey is a key pair created on your device. The website keeps only the public half. To sign in, your device signs a fresh challenge with the private half, which never leaves the device. A breach of the server exposes public keys, and public keys cannot sign anyone in.

Passkeys have limits:

  • A device that someone else can unlock is still a risk.
  • A passkey covers only the login it was created for. An FTP account that still uses a password is outside it.
  • Someone can still try to trick you into approving a request. In ClientN, "This wasn't me" cancels a request you did not start.

What ClientN does

ClientN is built on passkey sign-in. A free account needs an email address and a passkey. When you sign in to a website that uses ClientN, that site gets an anonymous ID that differs from the ID any other site gets for you. Each website approval asks for a fresh passkey check (fingerprint, face or device PIN).

ClientN does not check identity documents. Each account needs an email code and a passkey, which slows down mass fake signups, but ClientN cannot prove that two accounts belong to different people.

Free account: https://clientn.com/signup?utm_source=devto&utm_medium=article&utm_campaign=dreamhost-passkeys

What to do this week

  1. List the logins you reuse, especially hosting, FTP, SFTP and webmail. Change any password that appears in more than one place.
  2. Turn on passkeys or an app-based code wherever the provider offers them.
  3. In hosting panels and webmail, look for sessions you do not recognise and sign them out.
  4. If your host supports SSH keys for SFTP, use keys in place of a password.

For website owners

If you run a site and want passkey sign-in without handling passwords yourself, start with the free developer starter at https://github.com/clientn/clientn-session-starter. The docs are at https://clientn.com/docs?utm_source=devto&utm_medium=article&utm_campaign=dreamhost-passkeys and the live demo is at https://clientn.com/demo?utm_source=devto&utm_medium=article&utm_campaign=dreamhost-passkeys.