I don't speak much bash. What does the script do exactly? Just demonstrates that the password is transmitted in plain text?
Why you shoud never use your favorite password on News.YCombinator.com
71–80 of 136 posts
Re: Why you shoud never use your favorite password on News.YCombinator.com
#72Earlier quoted context omitted.
That's an active attack. My statement was clear and correct. The number of people who can passively eavesdrop on traffic (eg, on open wifi) is much larger than those who can dynamically change traffic in transit.
There are no passive-only attackers. Attackers who can observe raw traffic can hijack it (if it's the '90s) or redirect it (if it's 5 years ago, and in Brazil, and money is involved --- just to make it specific). Look, we're locked in an Internet message board death struggle and neither of us are going to concede anything, so let me just finish with this tangent: If you tried to sell an app to a Fortune 1000 company…
As should have been clear, I wasn't talking about apps with Fortune 1000 company customer data. I certainly did not suggest the mild javascript-hashing technique would be appropriate for such situations. (So, your 90+ word tangent hypothesizing that I might try to sell such a thing is... obdurate? A strawman? Unfair?)
And, you seriously think there are "no" passive-only attackers? No people happy to merely scan or log traffic, not actively hijacking TCP sessions, but looking for info to exploit later? I suggest both the guy in the wifi cafe running a sniffer, and the NSA hardware in AT&T's room 641A, count as "passive-only attackers". Of course the javascript-hashing technique is only helpful against the former.
Re: Why you shoud never use your favorite password on News.YCombinator.com
#731. Go read up on HTTP vs HTTPS 2. Never use the same login for 2 websites The fact this has been upvoted to top position is more worrying than any security worries.
Never use the same login for 2 websites Dude, my brain would explode.
It's not like you have to remember them...
I just use a script that based on a site name/keyword I give it, generates a password for me. Then the browser remembers it.
Of course that means if anyone steals my laptop they have all my logins, but that's extremely unlikely.
Re: Why you shoud never use your favorite password on News.YCombinator.com
#74Earlier quoted context omitted.
Never use the same login for 2 websites Dude, my brain would explode.
It's not like you have to remember them... I just use a script that based on a site name/keyword I give it, generates a password for me. Then the browser remembers it. Of course that means if anyone steals my laptop they have all my logins, but that's extremely unlikely.
Re: Why you shoud never use your favorite password on News.YCombinator.com
#75Earlier quoted context omitted.
I don't want to be liable if one of my servers is hacked and someone's bank account gets accessed because of it. Don't store user passwords in plaintext.
I use a hash. I don't quite know how secure that alone is though. My thoughts are if my server is compromised(and an endless stream of attempts lead me to believe it's not extremely unlikely) having both the scripts with the database could deduce the passwords. Am I wrong?
A hash is a one way thing so you can't reverse it. However, if they have that much access it'd be trivial to just change your script to dump the username/password combo into a plain text file whenever the login succeeds.
Re: Why you shoud never use your favorite password on News.YCombinator.com
#76Earlier quoted context omitted.
There are no passive-only attackers. Attackers who can observe raw traffic can hijack it (if it's the '90s) or redirect it (if it's 5 years ago, and in Brazil, and money is involved --- just to make it specific). Look, we're locked in an Internet message board death struggle and neither of us are going to concede anything, so let me just finish with this tangent: If you tried to sell an app to a Fortune 1000 company…
you are saying that if someone is encrypting the password using RSA in javascript and then using the hash to exchange the password between server/client, is volnerable because someone can interfere in the traffic and change the javascript served to the user, so that the password is sent in plaintext and therefore steal the password? then why meebo and other sites practise this method without security problems?
The canned argument is: No known security problem does not mean no security problem.
Re: Why you shoud never use your favorite password on News.YCombinator.com
#77While you are at it: All that javascript hashing still leaks information. Why not implement some zeroknowledge protocoll with AJAX?
(You need to send information back and forth because those protocolls are interactive.)
Re: Why you shoud never use your favorite password on News.YCombinator.com
#78Earlier quoted context omitted.
Before you consider converting your own web app to HTTP auth instead of login forms, be aware of the fact that several of the top security firms will demerit your app for doing it, and that will hurt you selling to companies. I don't totally agree with this (HTTP digest auth, while silly, is still better than the crazy Javascript hashing schemes), but the logic is, it is difficult to "log out" and manage sessions wit…
be aware of the fact that several of the top security firms will demerit your app for doing it Speaking as FreeBSD Security Officer: Several of the top security firms provide ratings which reflect the quality of their checklists more than the quality of the security in the systems they're assessing. The FreeBSD security team recently dealt with a case of "if you don't fix this, people using FreeBSD will lose marks on…
Care to elaborate?
Re: Why you shoud never use your favorite password on News.YCombinator.com
#79Earlier quoted context omitted.
I use a hash. I don't quite know how secure that alone is though. My thoughts are if my server is compromised(and an endless stream of attempts lead me to believe it's not extremely unlikely) having both the scripts with the database could deduce the passwords. Am I wrong?
You are. One of the defining properties of a cryptographic hash is that you cannot easily deduce the input given the output, nor can you easily construct an input to produce a given output. (see the overview at http://en.wikipedia.org/wiki/Cryptographic_hash ) However, it's still possible to do a dictionary attack on the database of hashes ("is the hash of "password" the same as the user's password hash? yes? Bingo!"…
You should use individual salting for each password to make this at least a bit more difficult.
Re: Why you shoud never use your favorite password on News.YCombinator.com
#80Earlier quoted context omitted.
Never use the same login for 2 websites Dude, my brain would explode.
It's not like you have to remember them... I just use a script that based on a site name/keyword I give it, generates a password for me. Then the browser remembers it. Of course that means if anyone steals my laptop they have all my logins, but that's extremely unlikely.
"It's not like you have to remember them... I just use a script that based on a site name/keyword I give it, generates a password for me. Then the browser remembers it.
Of course that means if anyone steals my laptop they have all my logins."
Would have gone down better, I guess.