http://passwordfail.com/ lets people register the offenders. If you have the passwordfail chrome extension installed, you will get a warning whenever you visit an offender. Highly recommended.
[deleted]
Plain Text Offenders - Did you just email me back my own password?
61–70 of 147 posts
Re: Plain Text Offenders - Did you just email me back my own password?
#62Re: Plain Text Offenders - Did you just email me back my own password?
#63Can someone explain to me why it is so important to hash passwords before storing them?
The passwords can be stolen and then you royally screwed your users who trusted you.
http://blog.moertel.com/articles/2006/12/15/never-store-pass...
http://stackoverflow.com/questions/287517/encrypting-hashing...
http://www.usenix.org/publications/login/2001-11/pdfs/singer...
Re: Plain Text Offenders - Did you just email me back my own password?
#64Pretty scary feeling: search your gmail inbox for your default password.
Default password? There's your first problem. Use a utility like LastPass or 1Password. You shouldn't have a default password.
Re: Plain Text Offenders - Did you just email me back my own password?
#65Earlier quoted context omitted.
There's also a difference between (non-reversible) hashing, with or without salt, and (reversible) encryption. Additionally, encrypted passwords are only better than plaintext passwords if an adversary that breaks into your database does/can not also get the encryption key. That's unlikely to be the case.
Very true, my mention of salts seems to have muddied things. As for getting the key, I'm no Linux expert but in windows afaik SQL injection generally doesn't allow you to get to the machine key which is used for this type of encryption. So it really depends on the attack vector on the likeliness of them having the key. I also totally agree in this day and age everyone should be hashing, it's just too easy to leave an…
Just look at http://news.ycombinator.com/item?id=2343330. Tumblr has piles of money, and a misplaced 'i' still gave away all their passwords (fortunately, just their passwords for external APIs...) Keeping the source code secret is usually not security goal #1, and not needing to is a good idea.
Also, un-salted encrypted passwords are still bad. Just compare the top 10 most popular encryptions with a table of the top 10 most popular passwords.
I'll drop this, but please do hash your passwords with something sensible like bcrypt. ;-)
Re: Plain Text Offenders - Did you just email me back my own password?
#66Earlier quoted context omitted.
By that logic, how should the website know what password it should be hashing?
The hashing should be done in the client's browser. The plaintext password should never reach the server (which is capable of sending emails).
Actually, I think "wut" was a reasonable response.
If the browser hashes the password, that just makes the hash the plaintext password. You've accomplished nothing.
Re: Plain Text Offenders - Did you just email me back my own password?
#67Mailman ... My LUG uses it and mails me my password in plaintext every month; IIRC it is|was the default setting ... /me-rolls-eyes
If you log in to Mailman, you can at least tell it to stop sending those emails every month...
Re: Plain Text Offenders - Did you just email me back my own password?
#68Props! Took me a moment to figure out why all the initial sites are in Hebrew ;)
Re: Plain Text Offenders - Did you just email me back my own password?
#69I'm shocked that Mozilla not only (seemingly) stores their mailing list passwords unhashed, but that they also email them out to each member every month in a reminder email.
Re: Plain Text Offenders - Did you just email me back my own password?
#70Earlier quoted context omitted.
You say you telephone the users. What if they are traveling? How do you verify the other person on the phone is who they say they are?
Worse, GSM encryption is pretty broken, people could be listening in, etc. Phoning people is still sensible in that attackers have to be close to the target, though (or get a wiretap).
Surprisingly not, mostly due to some very strange bits of the GSM protocol.
Basically, as long as you have enough signal such that the victims handset can hear your commands, you can tell it that you are stronger then any other signal, and the handset will instantly switch to your cell.
What's worse is that there exist secure GSM encryption/etc. standards, however as the cell tower chooses what encryption to use, it is mostly pointless. (I remember watching a video about this. Apparently your phone is meant to show a massive warning if they are using unencrypted GSM. None do).
http://www.youtube.com/watch?v=rXVHPNhsOzo is a good video about this.