http://passwordfail.com/ lets people register the offenders.
If you have the passwordfail chrome extension installed, you will get a warning whenever you visit an offender. Highly recommended.
Plain Text Offenders - Did you just email me back my own password?
21–30 of 147 posts
Re: Plain Text Offenders - Did you just email me back my own password?
#22Nitpick, they're not necessarily storing it in plaintext, they may just not be salting it. There is a difference.
Is there an effective difference between storing it in plaintext and with storing it with a trivially reversible algorithm?
Re: Plain Text Offenders - Did you just email me back my own password?
#23[deleted]
Re: Plain Text Offenders - Did you just email me back my own password?
#24I've been wanting to make this for ages. Very pleased to see it made! Would be awesome to have a notable offenders section. A chrome plugin that hooks into this would also be cool: "This site has rubbish password security. Don't use your usual passwords"
It's already planned :) Stay tuned!
Re: Plain Text Offenders - Did you just email me back my own password?
#25Mailman ... My LUG uses it and mails me my password in plaintext every month; IIRC it is|was the default setting ... /me-rolls-eyes
To be fair the Mailman registration page explicitly tells you not to use a secure password as it'll be mailed back to you in plain text.
Re: Plain Text Offenders - Did you just email me back my own password?
#26Nitpick, they're not necessarily storing it in plaintext, they may just not be salting it. There is a difference.
Whether it is stored plaintext, or in an encrypted format: 1) They are sending it in plaintext 2) Encrypted passwords are a factor less secure than hashed (and salted) passwords I am not sure how salting the password comes into it in the context you describe - can you explain?
From the site:
A website storing a password in plain text means that your password is there, waiting for someone to come and take it. It doesn’t even matter if you’ve created the strongest possible password. It’s just there.
...We’re tired of websites abusing our trust and storing our passwords in plain text, exposing us to danger. Here we put these websites to shame.
That is possibly a libellous allegation. It is not necessarily true.
The password is not necessarily stored in plaintext, it may still be encrypted.
The website owner does not understand encryption.
Understand my point now?
Re: Plain Text Offenders - Did you just email me back my own password?
#27I'd considered doing something like this the other day, good work for getting the bad news out there! Hopefully this can help lift the expected minimum of security on the web a little.
Re: Plain Text Offenders - Did you just email me back my own password?
#28Nitpick, they're not necessarily storing it in plaintext, they may just not be salting it. There is a difference.
I think you mean hashing rather than salting.
Re: Plain Text Offenders - Did you just email me back my own password?
#29Earlier quoted context omitted.
Whether it is stored plaintext, or in an encrypted format: 1) They are sending it in plaintext 2) Encrypted passwords are a factor less secure than hashed (and salted) passwords I am not sure how salting the password comes into it in the context you describe - can you explain?
From the site: A website storing a password in plain text means that your password is there, waiting for someone to come and take it. It doesn’t even matter if you’ve created the strongest possible password. It’s just there. ...We’re tired of websites abusing our trust and storing our passwords in plain text, exposing us to danger. Here we put these websites to shame. That is possibly a libellous allegation. It is no…
Not really; this post doesn't mention salting, which is where my confusion about your point came from.
Re: Plain Text Offenders - Did you just email me back my own password?
#30Seems that in many cases you get a choice between security over the wire or security in storage, but not both. By this I mean if you use a challenge response authentication algorithm then you often don't have any choice but to store the password in cleartext. Then authentication can be done even over an unencrypted channel without revealing the password.
The compromise seems to be to store the password with a oneway hash then use an encrypted channel such as TLS to send the full password for each authentication. There is still the possibility of intercepting the password at the end of this encrypted channel before the password is compared to the stored hash.
So both models have weaknesses, it just means you have to focus your security efforts into a different area. For the first, it might be somewhere deep in the backend, for the second you'd be paying attention to the front end where you accept the TLS (e.g. https) connection.
This has certainly been the case with for example PPP where you had a choice between PAP (secure storage, but sent in plain text) or CHAP (insecure storage but not sent over the wire in full). Jabber/XMPP servers also traditionally store in plain text but passwords aren't sent for each login. Though it seems that HTTP Digest auth does allow storage of passwords in a hash without transmitting the full password.
Then even with challenge response algorithms if someone is able to monitor a number of authentications then they may be able to gather enough information to pose as that user without actually knowing the password.