Nitpick, they're not necessarily storing it in plaintext, they may just not be salting it. There is a difference.
I think you mean hashing rather than salting.
I think you're right (hence my confusion about the salting comment)
Plain Text Offenders - Did you just email me back my own password?
31–40 of 147 posts
Re: Plain Text Offenders - Did you just email me back my own password?
#32Nothing new there! When we setup a new in-house account, we either telephone the user or go to see them with their password. If it's a senior Manager with a corporate phone they get their password texted to them - Ok, not ultimately as secure as possible but a darn sight more secure than a plaintext email. In my previous job I was asked to FTP our full client list (with financial information) to a third party acting…
You say you telephone the users.
What if they are traveling? How do you verify the other person on the phone is who they say they are?
Re: Plain Text Offenders - Did you just email me back my own password?
#33Earlier quoted context omitted.
Whether it is stored plaintext, or in an encrypted format: 1) They are sending it in plaintext 2) Encrypted passwords are a factor less secure than hashed (and salted) passwords I am not sure how salting the password comes into it in the context you describe - can you explain?
From the site: A website storing a password in plain text means that your password is there, waiting for someone to come and take it. It doesn’t even matter if you’ve created the strongest possible password. It’s just there. ...We’re tired of websites abusing our trust and storing our passwords in plain text, exposing us to danger. Here we put these websites to shame. That is possibly a libellous allegation. It is no…
There's also a difference between (non-reversible) hashing, with or without salt, and (reversible) encryption.
Additionally, encrypted passwords are only better than plaintext passwords if an adversary that breaks into your database does/can not also get the encryption key. That's unlikely to be the case.
Re: Plain Text Offenders - Did you just email me back my own password?
#34Nothing new there! When we setup a new in-house account, we either telephone the user or go to see them with their password. If it's a senior Manager with a corporate phone they get their password texted to them - Ok, not ultimately as secure as possible but a darn sight more secure than a plaintext email. In my previous job I was asked to FTP our full client list (with financial information) to a third party acting…
You say you telephone the users. What if they are traveling? How do you verify the other person on the phone is who they say they are?
Worse, GSM encryption is pretty broken, people could be listening in, etc. Phoning people is still sensible in that attackers have to be close to the target, though (or get a wiretap).
Re: Plain Text Offenders - Did you just email me back my own password?
#35The other day I thought there should be a "Wall of Shame" site for photos of the d-bags who abuse handicapped spots.
Just make a tumblr page for it :) Seriously, not including setting up a domain it takes about 15 minutes...
>not including setting up a domain it takes about 15 minutes...
Which, coincidentally, is about the same amount of time as you can expect your tumblr page to be up every month ;)
Re: Plain Text Offenders - Did you just email me back my own password?
#36Nothing new there! When we setup a new in-house account, we either telephone the user or go to see them with their password. If it's a senior Manager with a corporate phone they get their password texted to them - Ok, not ultimately as secure as possible but a darn sight more secure than a plaintext email. In my previous job I was asked to FTP our full client list (with financial information) to a third party acting…
You say you telephone the users. What if they are traveling? How do you verify the other person on the phone is who they say they are?
>How do you verify the other person on the phone is who they say they are?
This came up in another thread some time ago, and it was suggested that one very simple way to do this is to have the person call you back.
Ultimately though there is no real solution to this problem except meeting the person face to face.
Re: Plain Text Offenders - Did you just email me back my own password?
#37Mailman ... My LUG uses it and mails me my password in plaintext every month; IIRC it is|was the default setting ... /me-rolls-eyes
To be fair the Mailman registration page explicitly tells you not to use a secure password as it'll be mailed back to you in plain text.
And to be fair, you can't really do anything with that password except change your subscription status. That said, version 3 is in the works and I read that "feature" is going away.
Re: Plain Text Offenders - Did you just email me back my own password?
#38There are some cases when storing plaintext passwords is justified, despite all of the risks. There are cases where you can't - or shouldn't - hash passwords.
For Freeversation, we store plaintext passwords for two reasons:
1. Our passwords are group passwords, which (hopefully) aren't re-used anywhere else. If someone hacks our server, the conversations stored on it are incredibly more valuable than the passwords themselves, which aren't associated with a specific email address or account. Our approach to security is that unauthorized access to our server is checkmate. That is the worst case scenario, not stolen passwords.
2. When you create a new conversation, you can invite new users to the discussion. Those users didn't sign up for Freeversation - and in all likelihood never heard of Freeversation before - but they're expected to remember a password that someone else chose. We help them remember that password by including it in every notification email we send. (E.g. emails inviting them to the conversation, emails notifying them of new comments, etc.) We wouldn't be able to do that if we hashed passwords.
In our case, the alternative to plaintext passwords is actually getting rid of passwords altogether and replacing them with secret URLs. We chose plaintext passwords because they provide psychological reassurance that conversations on Freeversation are invite-only, and not public. The irony is that secret URLs are actually more secure than the passwords that most of our users choose. In the future, we may use a combination of the two, so that users both feel protected and are protected in the best way possible.
Re: Plain Text Offenders - Did you just email me back my own password?
#39Earlier quoted context omitted.
At least it's some consolation that they don't store the password in plain text, unlike plentyoffish.com. Do they also email you your new password if you change it?
A secure website should be mathematically incapable of ever displaying your plaintext password in any form whatsoever, at any time, even during the registration process.
If you have a public key associated with your email address on a public keyserver, they could encrypt your password—using said key—when you set it, and then store only the encrypted copy. Then, even though they were holding it, the only person who could do anything with it is you :)
Re: Plain Text Offenders - Did you just email me back my own password?
#40Earlier quoted context omitted.
Whether it is stored plaintext, or in an encrypted format: 1) They are sending it in plaintext 2) Encrypted passwords are a factor less secure than hashed (and salted) passwords I am not sure how salting the password comes into it in the context you describe - can you explain?
From the site: A website storing a password in plain text means that your password is there, waiting for someone to come and take it. It doesn’t even matter if you’ve created the strongest possible password. It’s just there. ...We’re tired of websites abusing our trust and storing our passwords in plain text, exposing us to danger. Here we put these websites to shame. That is possibly a libellous allegation. It is no…
I've refined the allegation to not sound libelous. Thank you for bringing it up.
@omervk