Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TMobile confirms they store passwords in plaintext, don't see why it's a problem

twitter.com

Post reply on HN
Print view View original

11–20 of 45 posts

Re: TMobile confirms they store passwords in plaintext, don't see why it's a problem

#11

Post by alex_duf »

alex_duf wrote: post #10

So does Plusnet in the uk

Here's the proof (it's my tweeter account)

https://mobile.twitter.com/alex_duf/status/61472768376378163...

Re-reading myself, I should have been more polite and less smug I think, the community manager never asked for that.

Re: TMobile confirms they store passwords in plaintext, don't see why it's a problem

#12

Post by gregatragenet3 »

Ajkaz wrote: post #5
dkonieczek wrote: post #2

Here comes the damage control https://twitter.com/TMobileHelp/status/982334382806454272 Hoping this blows up. Time to short.

I'm wondering. Why would encrypting the password be any more worse than hashing ? If the private key of encryption is well kept, I don't see why they couldn't do that. I understand though that no one being able to know the password except the user is utmost security, but why not encrypting it ?

Presumably the application that accesses encrypted passwords in the database also has the decryption key close at hand. So if that application is compromised the attacker has access to both the encrypted data and the key to decrypt it. If the password is just stored hashed there is no way to directly decrypt it, you can only verify that a clear text string matches the hash. I'm not sure how relevant it is these days, it seems like there's enough CPU / GPU power that any password that's short enough to be practical can probably be cracked from it's hash quickly.

Re: TMobile confirms they store passwords in plaintext, don't see why it's a problem

#15

Post by Kalium »

Ajkaz wrote: post #5
dkonieczek wrote: post #2

Here comes the damage control https://twitter.com/TMobileHelp/status/982334382806454272 Hoping this blows up. Time to short.

I'm wondering. Why would encrypting the password be any more worse than hashing ? If the private key of encryption is well kept, I don't see why they couldn't do that. I understand though that no one being able to know the password except the user is utmost security, but why not encrypting it ?

Long story short, an encrypted password can be decrypted. There is no reasonable scenario here under which this is preferable to a non-decryptable hash. This creates a scenario where the only possible outcomes that are added involve security breaches of password texts.

Re: TMobile confirms they store passwords in plaintext, don't see why it's a problem

#16

Post by jonnismash »

alex_duf wrote: post #11
alex_duf wrote: post #10

So does Plusnet in the uk

Here's the proof (it's my tweeter account) https://mobile.twitter.com/alex_duf/status/61472768376378163... Re-reading myself, I should have been more polite and less smug I think, the community manager never asked for that.

The company sure did, I think you handled yourself fine.

Re: TMobile confirms they store passwords in plaintext, don't see why it's a problem

#20

Post by Poiesis »

Fnoord wrote: post #6

"Well, what if your infrastructure gets breached and everyone’s password is published in plaintext to the whole wide world?" "What if this doesn't happen because our security is amazingly good? ^Käthe" This is begging for it.

I can’t fault a low-level employee too much for enthusiastically defending their company. I can’t expect someone at that level to know about sound development practices.

What’s often lacking though is a clear path for reporting security issues to people such as this representative. They don’t have a process to flag something for the security team.

Post reply on HN