A straight list without the irrelevant screenshots would be much more scalable.
Plain Text Offenders - Did you just email me back my own password?
51–60 of 147 posts
Re: Plain Text Offenders - Did you just email me back my own password?
#52Pretty scary feeling: search your gmail inbox for your default password.
Re: Plain Text Offenders - Did you just email me back my own password?
#53I tried to submit a screenshot, but got the error message Sorry, your page had expired. Please try again. on the submission screen. Either they're having trouble (and displaying an unhelpful error message), or they have an awfully short page expiration time - from page load to the time I hit submit was under 30 seconds.
Re: Plain Text Offenders - Did you just email me back my own password?
#54Earlier quoted context omitted.
You say you telephone the users. What if they are traveling? How do you verify the other person on the phone is who they say they are?
>How do you verify the other person on the phone is who they say they are? This came up in another thread some time ago, and it was suggested that one very simple way to do this is to have the person call you back. Ultimately though there is no real solution to this problem except meeting the person face to face.
That pretty much covers it. We telephone them in house on their extension number and there's only 60-ish employees so we know their voices. Externally they have to call back.
Re: Plain Text Offenders - Did you just email me back my own password?
#55Pretty scary feeling: search your gmail inbox for your default password.
Thank you for this. Now I have a list of places where I need to delete my account or change password.
Re: Plain Text Offenders - Did you just email me back my own password?
#56Rackspace does this with their Cloud Servers :'(
Re: Plain Text Offenders - Did you just email me back my own password?
#57Can someone explain to me why it is so important to hash passwords before storing them?
Re: Plain Text Offenders - Did you just email me back my own password?
#58The worst offender I can recall was Wordpress.com. Not only do they email you your password back, but show it to both you and whoever might be sitting within a few metres in LARGE LETTERS in the webpage immediately after activating your account. After I emailed to complain about this, they said: "Security and usability is often a trade-off. We make two main ones: * When you register at WordPress.com, we show you your…
At least it's some consolation that they don't store the password in plain text, unlike plentyoffish.com. Do they also email you your new password if you change it?
If they use the same codebase that is on opensource wordpress they store the password as an md5 hash which isn't much better. Take a look at the wordpress source code one day, you'll be horrified.
Re: Plain Text Offenders - Did you just email me back my own password?
#59Earlier quoted context omitted.
From the site: A website storing a password in plain text means that your password is there, waiting for someone to come and take it. It doesn’t even matter if you’ve created the strongest possible password. It’s just there. ...We’re tired of websites abusing our trust and storing our passwords in plain text, exposing us to danger. Here we put these websites to shame. That is possibly a libellous allegation. It is no…
There's also a difference between (non-reversible) hashing, with or without salt, and (reversible) encryption. Additionally, encrypted passwords are only better than plaintext passwords if an adversary that breaks into your database does/can not also get the encryption key. That's unlikely to be the case.
Very true, my mention of salts seems to have muddied things.
As for getting the key, I'm no Linux expert but in windows afaik SQL injection generally doesn't allow you to get to the machine key which is used for this type of encryption.
So it really depends on the attack vector on the likeliness of them having the key.
I also totally agree in this day and age everyone should be hashing, it's just too easy to leave an accidental hole and you should mitigate the consequences of a breach.
But I still stand by the idea that they're not necessarily storing the password in plaintext, which was all I was trying to say with my nitpick!
Re: Plain Text Offenders - Did you just email me back my own password?
#60Seems that in many cases you get a choice between security over the wire or security in storage, but not both. By this I mean if you use a challenge response authentication algorithm then you often don't have any choice but to store the password in cleartext. Then authentication can be done even over an unencrypted channel without revealing the password. The compromise seems to be to store the password with a oneway…
If I understood you correctly - there doesn't need to be a tradeoff between wire and storage security.
You could use a oneway hash at the client side as well.
If you don't want to divulge what's the hash in your database, you can add another oneway hash for whatever reaches the server.
The challenge-response can also be based on hashes.