Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TMobile confirms they store passwords in plaintext, don't see why it's a problem

twitter.com

Post reply on HN
Print view View original

41–45 of 45 posts

Re: TMobile confirms they store passwords in plaintext, don't see why it's a problem

#41

Post by nyxxie »

thisacctforreal wrote: post #38
Recursing wrote: post #31

Earlier quoted context omitted.

https://github.com/crypto101/book/blob/master/Crypto101.org#... While that was true before GPUs >To a modern attack, salts quite simply don’t help. Everybody should really move to key derivation functions (ideally scrypt)

What parameters do you recommend? Is N=14, r=8, p=1 good enough?

The usual answer is to choose the parameters in such a way that targets the largest verification time that your servers can stand. I'm not aware of a recommended minimum value. In general, though, you're making a pretty good choice by choosing bcrypt, and so long as you're using the above you should have far better security as compared to sha*/md5/etc

Re: TMobile confirms they store passwords in plaintext, don't see why it's a problem

#43

Post by boodrizz »

MR4D wrote: post #42

Can we please pass a law to make it criminally negligent if you store passwords in plaintext? This needs to end. Kinda like building a bank without locks. Insane.

How is it at all like building a bank without locks? It jeopardizes users who reuse passwords which has been a security faux pas since passwords. I feel like people dwell on this pattern of hashing passwords to show off that they know what hashing is. In the age of weekly leaks and multi gig dictionaries, assume your password is in a dictionary if not really long, high entropy, and unique to that site. Even the "gotcha" xss someone demonstrated on T-Mobiles site has nothing to do with this. If somebody has every password, they won. If they have your hash table, they still won. Yes, passwords would have to be changed site-wide, but you'd want to do that either way. At least since it's a phone company, they would know how to reach you. It's embarrassing to see another post of developers harassing a social media pr person.

Re: TMobile confirms they store passwords in plaintext, don't see why it's a problem

#44

Post by lowtolerance »

chatmasta wrote: post #40
matuszeg wrote: post #39

Earlier quoted context omitted.

Is it okay to sacrifice security because some members of society are either too old/dumb/misguided/whatever to bother? At what point do we just have to leave these people behind?

As long as the institutions are insured against fraud, they have a greater incentive for usability than security.

Yeah, but when they’re facilitating fraud...

Re: TMobile confirms they store passwords in plaintext, don't see why it's a problem

#45

Post by MR4D »

boodrizz wrote: post #43
MR4D wrote: post #42

Can we please pass a law to make it criminally negligent if you store passwords in plaintext? This needs to end. Kinda like building a bank without locks. Insane.

How is it at all like building a bank without locks? It jeopardizes users who reuse passwords which has been a security faux pas since passwords. I feel like people dwell on this pattern of hashing passwords to show off that they know what hashing is. In the age of weekly leaks and multi gig dictionaries, assume your password is in a dictionary if not really long, high entropy, and unique to that site. Even the "gotc…

Because it’s a minimum level of due care. Not meeting a minimum level is called negligence.

I think most people would agree that in this day in age, leaving passwords in plain text is like not even making the effort.

If you didn’t lock the doors on a bank, that would be the same thing - not making an effort, even though many criminals can pick a lock. So yes, the analogy holds up.

Post reply on HN