Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plain Text Offenders - Did you just email me back my own password?

plaintextoffenders.com

Post reply on HN
Print view View original

71–80 of 147 posts

Re: Plain Text Offenders - Did you just email me back my own password?

#71

Post by scott_s »

tedunangst wrote: post #66
lkozma wrote: post #46

Earlier quoted context omitted.

The hashing should be done in the client's browser. The plaintext password should never reach the server (which is capable of sending emails).

Actually, I think "wut" was a reasonable response. If the browser hashes the password, that just makes the hash the plaintext password. You've accomplished nothing.

Not necessarily, if I understand the situation correctly. In this notation, -> represents communication between components, and | represents the boundary between local and remote communication, which we assume is encrypted/decrypted appropriately.

On account creation,

  password -> hash -> | -> stored
Upon account creation, I provide my password, which is hashed locally. The hashed version of my password is passed over the network and stored on the other end.

Logging in,

  password -> | -> hash -> compare
Upon logging in, I provide my password and send it to the remote server. The remove server hashes my password and compares it to what it stored previously.

Hence, if someone intercepted my hash, it's the same situation as if they looked in /etc/passwd on a multi-user Unix system. That is, it's more information than nothing, but it's non-trivial to use that information to figure out my password.

Is there a flaw in my reasoning?

Re: Plain Text Offenders - Did you just email me back my own password?

#73

Post by bmelton »

nyellin wrote: post #47
kunley wrote: post #43

Earlier quoted context omitted.

The catch is in the word hopefully . Wishful thinking is not a successful way of doing things in engineering.

If someone creates and conversation and re-uses a password, that password is emailed to everyone they invited. There is no way to avoid that and still use a group password. Edit: Furthermore, the password is not associated with a specific email address or user name. Even if someone has access to a conversation's password, they don't know who the password belongs to.

I don't know your use cases, so pardon me if this is naive, but couldn't you create a token that is unique for each user, and is consumed after use?

Re: Plain Text Offenders - Did you just email me back my own password?

#74

Post by JoachimSchipper »

asharp wrote: post #70
JoachimSchipper wrote: post #34

Earlier quoted context omitted.

Worse, GSM encryption is pretty broken, people could be listening in, etc. Phoning people is still sensible in that attackers have to be close to the target, though (or get a wiretap).

Surprisingly not, mostly due to some very strange bits of the GSM protocol. Basically, as long as you have enough signal such that the victims handset can hear your commands, you can tell it that you are stronger then any other signal, and the handset will instantly switch to your cell. What's worse is that there exist secure GSM encryption/etc. standards, however as the cell tower chooses what encryption to use, it…

There is a lot wrong with GSM, and I didn't even know about this particular attack (thanks!), but you still have to be reasonably close to the victim - it's harder than "attack from anywhere on the internet".

Re: Plain Text Offenders - Did you just email me back my own password?

#75

Post by asharp »

JoachimSchipper wrote: post #74
asharp wrote: post #70

Earlier quoted context omitted.

Surprisingly not, mostly due to some very strange bits of the GSM protocol. Basically, as long as you have enough signal such that the victims handset can hear your commands, you can tell it that you are stronger then any other signal, and the handset will instantly switch to your cell. What's worse is that there exist secure GSM encryption/etc. standards, however as the cell tower chooses what encryption to use, it…

There is a lot wrong with GSM, and I didn't even know about this particular attack (thanks!), but you still have to be reasonably close to the victim - it's harder than "attack from anywhere on the internet".

Most certainly agree. Unfortunately, dropping the range limit from "Anywhere on earth" to "From a nearby mountain" doesn't fill me with all that much confidence.

Re: Plain Text Offenders - Did you just email me back my own password?

#76

Post by [deleted] »

linker3000 wrote: post #17

Nothing new there! When we setup a new in-house account, we either telephone the user or go to see them with their password. If it's a senior Manager with a corporate phone they get their password texted to them - Ok, not ultimately as secure as possible but a darn sight more secure than a plaintext email. In my previous job I was asked to FTP our full client list (with financial information) to a third party acting…

[deleted]

Re: Plain Text Offenders - Did you just email me back my own password?

#77

Post by btilly »

tedunangst wrote: post #66
lkozma wrote: post #46

Earlier quoted context omitted.

The hashing should be done in the client's browser. The plaintext password should never reach the server (which is capable of sending emails).

Actually, I think "wut" was a reasonable response. If the browser hashes the password, that just makes the hash the plaintext password. You've accomplished nothing.

Go read http://en.wikipedia.org/wiki/Digest_access_authentication and become informed on how you can do hashing on the client's browser and actually gain something in the way of security.

Re: Plain Text Offenders - Did you just email me back my own password?

#79

Post by asharp »

estel wrote: post #22
mattmanser wrote: post #15

Nitpick, they're not necessarily storing it in plaintext, they may just not be salting it. There is a difference.

Is there an effective difference between storing it in plaintext and with storing it with a trivially reversible algorithm?

A slight one if any.

If you store passwords plaintext in the database, a simple SQL injection can dump them out.

If you store passwords encrypted in the database, you need to get the code of the server software in order to extract the keys.

So at the end of the day, it depends on the probability of a complete server compromise vs. the probability of a successful SQL injection.

Re: Plain Text Offenders - Did you just email me back my own password?

#80

Post by asharp »

mattmanser wrote: post #15

Nitpick, they're not necessarily storing it in plaintext, they may just not be salting it. There is a difference.

Salting is a process used in hashing. Hashing converts an input text (ie. a password) into an unintelligible mash of symbols, that cannot be reversed. If they were sending passwords in plaintext, they are not hashing it, as they are able to reverse it. I believe what you meant to say is "They may just be encrypting it, not hashing it".
Post reply on HN