Hello everyone, A brand new Online File Manager based on the in-house iFastNet built version is now available. It is a lot more stable with new features such as built-in code formatting and side-by-side website preview. We have made modifications on top to give you the best experience possible! It will bring you a smoother experience in managing files! The old Filestash file manager has been removed. Happy Hosting and thank you for your continuous support. Spookhost - https://spookhost.xyz/

Hello everyone,   With Client Portal v3.5, we now supports issuing TLS certificates from ZeroSSL, Let's Encrypt, and Google Trust Services with key algorithms of EC 256, EC 384, and RSA 2048. In a good environment, the full certificate request process can be done in within 1 minute and 30 seconds (from requesting the certificate, to adding the required CNAME and getting the actual certificate) using our nameservers.   Important points to note: ZeroSSL EC 256 is the default configuration, you may change this via advanced options when requesting the certificate. We recommend EC 256 for balanced performance and security. ZeroSSL does not support RSA 2048 using our TLS Tool Your private keys stored in our Client Portal is encrypted with password and salt with Argon2id for key derivation, and then securely encrypted with AES-256-GCM. Free subdomains do not need to request a certificate as it is automatically covered. How to request for a certificate Head to the Client Portal TLS section, input your domain and request it. Add the required CNAME in the Control Panel, or your respective DNS provider. Click on the Validate TLS button. Copy and paste the Private Key followed by the Certificate in the Control Panel. Our client portal will provide "multiple" certificates, please copy ALL of them in order in to the control panel. You may simply Ctrl+A to copy the whole string, the order is already properly formatted if you use our tool.   Using other Certificate Authorities You are not limited to using our TLS Tool with those 3 CAs. If you have a certificate purchased elsewhere, you may input the private key and certificate provided by your CA into our control panel.   Do note that: RSA keys are only supported up to 2048 bits, if you need higher security, consider EC keys. We highly recommend the use of certificate chains as it ensures browser compatibility especially with new Root CAs recently. To add a certificate chain, simply put them AFTER your website's end entity certificate. We do not recommend including the Root CA. ---BEGIN CERT--- // your website's end entity cert ---END CERT--- ---BEGIN CERT--- // intermediate CAs ---END CERT--- ... and more intermediate CAs Security of our server's TLS setup Spookhost Free webservers are configured to only support TLS 1.2 and TLS 1.3 along with Post-Quantum Cryptography support. If your TLS certificate is correctly installed, you will get a score of A in Qualys SSL Labs. (See https://www.ssllabs.com/ssltest/analyze.html?d=demo.shpage.top&hideResults=on)     Happy Hosting and thank you for your continuous support. Spookhost - https://spookhost.xyz/

🔐 Auto-renewing SSL Certificates for Free Subdomains & Security Enhancements Auto-renewing SSL Certificates for Free Subdomains All Spookhost-issued free subdomains (e.g. *.shpage.top and more) now have free and auto-renewing TLS Certificates covered. With this update: Please access your free subdomains WITHOUT www in the front Custom TLS certificates for free subdomains are no longer available Other security enhancements Post-Quantum Cryptography is now supported on Free Hosting if a valid TLS certificate is provisioned. Compatible devices will start using X25519MLKEM768 for key exchange, protecting against 'harvest now, decrypt later' attacks. Only TLS 1.2 and TLS 1.3 are now accepted to ensure data safety during transportation. Most devices after 2012 already supports TLS 1.2, this should not impact much of your visitors. Happy Hosting and thank you for your continuous support. Spookhost - https://spookhost.xyz/   

Interconnectivity with Allen ID Through a strategic partnership Allen ID, you may now login to either account system with the others. Spooky ID 與 Allen ID 互聯互通  Spooky ID 已與 Allen服務 之 AS_Allen_Shih ID (Allen ID) 服務達成戰略合作，現可使用一帳户登入驗證另一平台 Spooky Services &  Allen ServicesSpooky ID - https://id.spookysrv.comAllen ID - https://id.asallenshih.tw

Introducing Spooky ID! Enhanced Security, Passkeys & More Hey everyone, we have now migrated to the our Authentication Platform Spooky ID, giving you more control & security! How to login - Continue to use your existing email & password & 2FA code (if applicable) or OAuth Provider (Google/Discord) linked on the Hub to login to Spooky ID. New features - Spooky ID supports passkey (FIDO2/CTAP2) authentication & as 2FA (U2F/CTAP1), you can now login quickly to Spooky Services just using your fingerprint or other biometrics!- More OAuth providers are supported - now, we have brought back GitHub OAuth and added Allen ID.- Backup codes (Static Tokens) can now be issued at your discretion. These codes can recover your account in the case that you lost your other MFA tokens.- Email alerts are now sent on important security events. Setting up passkeys (WebAuthn) - To set up a passkey, head to your user settings -> Credentials -> MFA Devices -> WebAuthn Device- If the security key is FIDO2-compliant, it will be automatically allowed for login use when you use the "Use a security key" button in the login page.- If your device type is automatically detected (Google, YubiKey etc.) by Spooky ID, it is very likely FIDO2-compliant and can be used for login.- All U2F (CTAP1) / non-FIDO2 key types cannot be detected automatically. Limitations - Currently, setting a profile picture is not possible directly, it will be implemented soon. Meanwhile, you may set your profile picture via Gravatar.  Spooky Services