A Password-Storage Field Study with Freelance Developers [pdf]
net.cs.uni-bonn.de
A Password-Storage Field Study with Freelance Developers [pdf]
1–10 of 21 posts
Re: A Password-Storage Field Study with Freelance Developers [pdf]
#2Good summary: https://twitter.com/PwdRsch/status/1103021803503607808
> Researchers asked 43 freelance developers to code the user registration for a web app and assessed how they implemented password storage. 26 devs initially chose to leave passwords as plaintext.
> Those devs were then asked to rewrite their code to 'store passwords securely.' Overall here are the methods of password storage chosen by the developers: > 10 - MD5 > 8 - Base64 > 7 - Bcrypt > 5 - SHA-256 > 5 - PBKDF2 > 3 - AES > 3 - 3DES > 1 - SHA-1 > 1 - HMAC/SHA1
> only 3 of 17 participants, who used other hash algorithms, implemented salting. One of them generated a random salt, one made use of the username, and one hard-coded a static salt
As an industry, we (developers) have a long way to go.
Re: A Password-Storage Field Study with Freelance Developers [pdf]
#3Good summary: https://twitter.com/PwdRsch/status/1103021803503607808 > Researchers asked 43 freelance developers to code the user registration for a web app and assessed how they implemented password storage. 26 devs initially chose to leave passwords as plaintext. > Those devs were then asked to rewrite their code to 'store passwords securely.' Overall here are the methods of password storage chosen by the developer…
Maybe the segment of in the industry in which the cheapest outsourced devs work, anyway.
Their conclusion states as much (hiring more expensive devs on freelancer.com got them more secure solutions):
"In addition, we found a significant effect in the freelancers’ acceptance rate between the €100 and €200 conditions for the prompted task and examined the effect of different payment levels on secure coding behavior. We saw more secure solutions in the €200 conditions, although the difference was not statistically significant. However, this result might be due to the small sample size and we believe this is worth following up in future work."
Re: A Password-Storage Field Study with Freelance Developers [pdf]
#4Good summary: https://twitter.com/PwdRsch/status/1103021803503607808 > Researchers asked 43 freelance developers to code the user registration for a web app and assessed how they implemented password storage. 26 devs initially chose to leave passwords as plaintext. > Those devs were then asked to rewrite their code to 'store passwords securely.' Overall here are the methods of password storage chosen by the developer…
It's insane to me that it's not "common knowledge" to AT LEAST hash the passwords.
It's also interesting because 6 used an encryption algorithm, 10 used MD5 which is as good as plaintext nowadays IMO, and 8 used Base64, so even though 24 people thought they "secured it" the passwords are trivial to recover.
Re: A Password-Storage Field Study with Freelance Developers [pdf]
#5Good summary: https://twitter.com/PwdRsch/status/1103021803503607808 > Researchers asked 43 freelance developers to code the user registration for a web app and assessed how they implemented password storage. 26 devs initially chose to leave passwords as plaintext. > Those devs were then asked to rewrite their code to 'store passwords securely.' Overall here are the methods of password storage chosen by the developer…
Maybe the segment of in the industry in which the cheapest outsourced devs work, anyway. Their conclusion states as much (hiring more expensive devs on freelancer.com got them more secure solutions): "In addition, we found a significant effect in the freelancers’ acceptance rate between the €100 and €200 conditions for the prompted task and examined the effect of different payment levels on secure coding behavior. We…
They also state it's not statistically significant :P
(Although I agree that seems likely because of the sample size)
Re: A Password-Storage Field Study with Freelance Developers [pdf]
#6Good summary: https://twitter.com/PwdRsch/status/1103021803503607808 > Researchers asked 43 freelance developers to code the user registration for a web app and assessed how they implemented password storage. 26 devs initially chose to leave passwords as plaintext. > Those devs were then asked to rewrite their code to 'store passwords securely.' Overall here are the methods of password storage chosen by the developer…
It's insane to me that it's not "common knowledge" to AT LEAST hash the passwords. It's also interesting because 6 used an encryption algorithm, 10 used MD5 which is as good as plaintext nowadays IMO, and 8 used Base64, so even though 24 people thought they "secured it" the passwords are trivial to recover.
MD5 is a little better than plaintext. Difficult passwords are still difficult when you know their MD5 hash.
Base64... is actually plaintext; that's much, much worse.
Re: A Password-Storage Field Study with Freelance Developers [pdf]
#7What was the task they were asked to perform? For most work a contract under 1k isn't going to get you an extremely high quality developer. In finding, planing, negotiating, and implementing a project you accrue a lot of billable overhead time.
If you assume it takes....
- 1hr to apply, negotiate, and accept job
- 1hr to do job
- 1hr to submit and aid in support & integration of code
I wonder what kind of quality they'd get with a larger project priced at that range. Something with 15hr of work @ $150 might bring in higher quality freelancers that are closer to the industry average.
Re: A Password-Storage Field Study with Freelance Developers [pdf]
#8What was the task they were asked to perform? For most work a contract under 1k isn't going to get you an extremely high quality developer. In finding, planing, negotiating, and implementing a project you accrue a lot of billable overhead time. If you assume it takes.... - 1hr to apply, negotiate, and accept job - 1hr to do job - 1hr to submit and aid in support & integration of code Then at $200 you're making $66/hr…
Sounds like an expensive study
Re: A Password-Storage Field Study with Freelance Developers [pdf]
#9Good summary: https://twitter.com/PwdRsch/status/1103021803503607808 > Researchers asked 43 freelance developers to code the user registration for a web app and assessed how they implemented password storage. 26 devs initially chose to leave passwords as plaintext. > Those devs were then asked to rewrite their code to 'store passwords securely.' Overall here are the methods of password storage chosen by the developer…
It's insane to me that it's not "common knowledge" to AT LEAST hash the passwords. It's also interesting because 6 used an encryption algorithm, 10 used MD5 which is as good as plaintext nowadays IMO, and 8 used Base64, so even though 24 people thought they "secured it" the passwords are trivial to recover.
To play devil’s advocate, to me plaintext means I want to finish quickly because you haven’t asked and are paying too little, while any solution other than bcrypt/pbkdf2 means I don’t know what I’m doing.
Re: A Password-Storage Field Study with Freelance Developers [pdf]
#10Good summary: https://twitter.com/PwdRsch/status/1103021803503607808 > Researchers asked 43 freelance developers to code the user registration for a web app and assessed how they implemented password storage. 26 devs initially chose to leave passwords as plaintext. > Those devs were then asked to rewrite their code to 'store passwords securely.' Overall here are the methods of password storage chosen by the developer…
I'm curious as to why they only said 3 of 17 used salt -- most bcrypt implementations will automatically generate a random salt (since the salt is visible in the generated hash), and 7 people used bcrypt?
Literally bcrypt and you're done (for now).