Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop restricting my password - Help these sites get better security.

weakpasswords.org

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Stop restricting my password - Help these sites get better security.

#41

Post by swombat »

staunch wrote: post #15

I was thinking of creating a list like this of all the sites that (most likely) store passwords as plain text. I'd get the list by doing a password reminder and seeing if they email me my password. Would be cool if that was added as a column here. I'd submit some sites.

I'd get the list by doing a password reminder and seeing if they email me my password.

That will tell you whether they send the password in clear, not whether they encrypt it. The only information you'll have is:

IF (they send you the password in clear) THEN (they don't use a one-way hash)

There is no other information to be derived from this method of checking.

Re: Stop restricting my password - Help these sites get better security.

#42

Post by dinkumator »

Jach wrote: post #20
teye wrote: post #18

I can upvote one item as much as I want if I clear my cookies. Voted for Amex (twice). I'm always annoyed that the 8-character limit prevents me from using my normal password + PwdHash.

He probably should use IP logging too, but beyond that and cookies what can you really do?

yeah i made it once per session, that way I don't have to track IPs. it could be better, but its not worth the trouble/storage

Re: Stop restricting my password - Help these sites get better security.

#43

Post by dinkumator »

1amzave wrote: post #4

How timely! Just last night I was frustrated by a stupid policy when changing my online banking password (my bank is now listed). I think his once-a-month policy could stand to be more aggressive, though.

good point. I didn't really expect this big of a response in 24 hours, but I may bump it up to sending a message every few hundreds votes.

Re: Stop restricting my password - Help these sites get better security.

#44

Post by eli »

Yeah, ING Direct's password scheme is pretty lame. I assume the idea was to use a simple numbers-only on-screen keyboard to avoid keyloggers. Seems silly, since if malware were to target them it would obviously just track clicks instead.

Though to be fair, they ask additional security questions if you haven't previously logged in from that browser.

Re: Stop restricting my password - Help these sites get better security.

#45

Post by IgorPartola »

eli wrote: post #44

Yeah, ING Direct's password scheme is pretty lame. I assume the idea was to use a simple numbers-only on-screen keyboard to avoid keyloggers. Seems silly, since if malware were to target them it would obviously just track clicks instead. Though to be fair, they ask additional security questions if you haven't previously logged in from that browser.

Their model sucks. First I have to now remember (can be read as write down) a separate account number, a bunch of digits. Second I have to now create a PIN and I can't even use a keyboard to type it in.

Account creation at ING is also awful. I created my account, but did not yet "activate" it. Keep in mind that it did not tell me in any obvious way that I needed to take extra steps to activate the account. Once I tried to log in it started asking me questions like "What is your father's father's name?" and my answer was: you cannot possibly know that yet since I haven't told you. Eventually I figured that out.

Next comes the verification of my checking account. This was fun because I have a joint checking account and a joint ING account. Guess what: it made me AND my wife verify the same exact transactions. Seriously? It's just bad UX all around. Now that I've got it set up I am fine with using it, just the initial process was awful.

Re: Stop restricting my password - Help these sites get better security.

#46

Post by Quarrelsome »

swombat wrote: post #41
staunch wrote: post #15

I was thinking of creating a list like this of all the sites that (most likely) store passwords as plain text. I'd get the list by doing a password reminder and seeing if they email me my password. Would be cool if that was added as a column here. I'd submit some sites.

I'd get the list by doing a password reminder and seeing if they email me my password. That will tell you whether they send the password in clear, not whether they encrypt it. The only information you'll have is: IF (they send you the password in clear) THEN (they don't use a one-way hash) There is no other information to be derived from this method of checking.

But if they use a two way hash and the server is compromised one would presume the mechanism for un-hashing the passwords would also be compromised meaning it is almost as bad?

(? as my knowledge on security is somewhat limited)

Re: Stop restricting my password - Help these sites get better security.

#47

Post by geocar »

Quarrelsome wrote: post #46
swombat wrote: post #41

Earlier quoted context omitted.

I'd get the list by doing a password reminder and seeing if they email me my password. That will tell you whether they send the password in clear, not whether they encrypt it. The only information you'll have is: IF (they send you the password in clear) THEN (they don't use a one-way hash) There is no other information to be derived from this method of checking.

But if they use a two way hash and the server is compromised one would presume the mechanism for un-hashing the passwords would also be compromised meaning it is almost as bad? (? as my knowledge on security is somewhat limited)

The word here is "encrypt" or "cipher" not "hash":

> But if they use a two way cipher and the server is compromised one would presume the mechanism for un-encrypting [decrypting] the passwords would also be compromised meaning it is almost as bad?

It might be. It is conceivable that a site may use public key cryptography and store encrypted passwords, but have password recovery done on an independent system which has the decryption key.

(For our purposes, a "reset question" might also be considered a password because it is still something "you know" and to be differentiated from an email address which would be something "you have")

Re: Stop restricting my password - Help these sites get better security.

#48

Post by mcantor »

IgorPartola wrote: post #45
eli wrote: post #44

Yeah, ING Direct's password scheme is pretty lame. I assume the idea was to use a simple numbers-only on-screen keyboard to avoid keyloggers. Seems silly, since if malware were to target them it would obviously just track clicks instead. Though to be fair, they ask additional security questions if you haven't previously logged in from that browser.

Their model sucks. First I have to now remember (can be read as write down) a separate account number, a bunch of digits. Second I have to now create a PIN and I can't even use a keyboard to type it in. Account creation at ING is also awful. I created my account, but did not yet "activate" it. Keep in mind that it did not tell me in any obvious way that I needed to take extra steps to activate the account. Once I tri…

Actually, you can click a little "Use Keyboard" link to let you type it in. Thank goodness.

Re: Stop restricting my password - Help these sites get better security.

#49

Post by CWuestefeld »

geocar wrote: post #47
Quarrelsome wrote: post #46

Earlier quoted context omitted.

But if they use a two way hash and the server is compromised one would presume the mechanism for un-hashing the passwords would also be compromised meaning it is almost as bad? (? as my knowledge on security is somewhat limited)

The word here is "encrypt" or "cipher" not "hash": > But if they use a two way cipher and the server is compromised one would presume the mechanism for un-encrypting [decrypting] the passwords would also be compromised meaning it is almost as bad? It might be. It is conceivable that a site may use public key cryptography and store encrypted passwords, but have password recovery done on an independent system which has…

I'd give an admonishment to anyone who uses a password question from the standard set (mother's maiden name, etc.), even if it is hashed, because the data is so easily discoverable.

Nevertheless, the idea of a password question is so useful that I still support it on my sites. But our implementation is open-ended: you define your own question as well as its answer. I think this is better for anyone who is security conscious, but unfortunately it still allows the lazy or ignorant to be insecure.

Re: Stop restricting my password - Help these sites get better security.

#50

Post by IgorPartola »

mcantor wrote: post #48
IgorPartola wrote: post #45

Earlier quoted context omitted.

Their model sucks. First I have to now remember (can be read as write down) a separate account number, a bunch of digits. Second I have to now create a PIN and I can't even use a keyboard to type it in. Account creation at ING is also awful. I created my account, but did not yet "activate" it. Keep in mind that it did not tell me in any obvious way that I needed to take extra steps to activate the account. Once I tri…

Actually, you can click a little "Use Keyboard" link to let you type it in. Thank goodness.

Yes, but you still can't type in the number. It just lets you use the keyboard to navigate their "number pad".
Post reply on HN