Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plain Text Offenders - Did you just email me back my own password?

plaintextoffenders.com

Post reply on HN
Print view View original

111–120 of 147 posts

Re: Plain Text Offenders - Did you just email me back my own password?

#111

Post by JangoSteve »

potatolicious wrote: post #101
tedunangst wrote: post #66

Earlier quoted context omitted.

Actually, I think "wut" was a reasonable response. If the browser hashes the password, that just makes the hash the plaintext password. You've accomplished nothing.

There's one big win here I can see: your passwords don't exist in a vacuum. Many users, whether you like it or not, are going to be using the same password for a number of other websites. By sending the hash and never letting the plaintext password hit the air, the worst that can happen is breach of your login system, you will not be responsible for someone in a coffee shop with wireshark sniffing out people's passwo…

Or, you do the registration process over SSL.

Re: Plain Text Offenders - Did you just email me back my own password?

#112

Post by ars »

gabbo wrote: post #107

By far the worst example I can think of here is Yodlee, the bank aggregator. Their product, Moneycenter, has this convenient "feature" which lets you display your bank password in plaintext! It's unthinkable that someone you trust with your bank credentials would let their website be a two-way street for plaintext bank passwords. Things like this remove any confidence I may have had in their product. The fact that a…

How are they supposed to log in your sub-accounts without the password? They have no choice except to store the plain text password.

And they don't just show you the password - they make you enter your login password first.

What exactly do you want them to do? You aren't thinking this issue through. Do you just want them to hide the password from you? What would be the point? They still have it.

They also have a one-click login to your subaccounts, so even if they don't show you your own password it wouldn't be enough. I suppose you want this feature disabled too?

The point of not storing plain text password is not to avoid displaying them, it's to make sure no one else can steal them.

But yodlee has no choice, they must store it plain text. And once they do, displaying it - only upon your explicit request (so it's not accidentally displayed), and after you enter your password, seems reasonable to me.

Re: Plain Text Offenders - Did you just email me back my own password?

#114

Post by omervk »

tnorthcutt wrote: post #53

I tried to submit a screenshot, but got the error message Sorry, your page had expired. Please try again. on the submission screen. Either they're having trouble (and displaying an unhelpful error message), or they have an awfully short page expiration time - from page load to the time I hit submit was under 30 seconds.

This is a tumblr issue. I think it has something to do with Chrome. Did you use that?

Re: Plain Text Offenders - Did you just email me back my own password?

#115

Post by code_duck »

tedunangst wrote: post #66
lkozma wrote: post #46

Earlier quoted context omitted.

The hashing should be done in the client's browser. The plaintext password should never reach the server (which is capable of sending emails).

Actually, I think "wut" was a reasonable response. If the browser hashes the password, that just makes the hash the plaintext password. You've accomplished nothing.

Yep, Etsy used to do that back in their more incompetent days. The only site I've seen that had a 'md5.js' script, seemed kind of unusual...

Re: Plain Text Offenders - Did you just email me back my own password?

#116

Post by lkozma »

tedunangst wrote: post #66
lkozma wrote: post #46

Earlier quoted context omitted.

The hashing should be done in the client's browser. The plaintext password should never reach the server (which is capable of sending emails).

Actually, I think "wut" was a reasonable response. If the browser hashes the password, that just makes the hash the plaintext password. You've accomplished nothing.

Yes, but if we have hash(plaintext + site_specific_salt), then even if I use the same password for different sites and the hash from one of them is intercepted, it still takes a while until the others will also be compromised. I didn't say the system was perfect, but still better than sending the password in plain text.

Re: Plain Text Offenders - Did you just email me back my own password?

#118

Post by kgermino »

qntm wrote: post #104
scott_s wrote: post #71

Earlier quoted context omitted.

Not necessarily, if I understand the situation correctly. In this notation, -> represents communication between components, and | represents the boundary between local and remote communication, which we assume is encrypted/decrypted appropriately. On account creation, password -> hash -> | -> stored Upon account creation, I provide my password, which is hashed locally. The hashed version of my password is passed over…

That only protects you at account creation time. How about this: Password hash function is h. Client creates password p, hashes it 1000 times. Account creation: Client sends h^1000(p) to server in the clear. Server stores h^1000(p) in plain text. Attacker eavesdrops h^1000(p), which is useless. Log in: Client either looks up h^999(p), or calculates it from scratch starting at p. Client sends h^999(p) to server in the…

The only problem I see with this is in cases where you sign in from multiple devices. How would each device know which x (for h^x(p)) you are on? Is that something the server sends to each device at login time? Would that be a security risk? I don't know a lot about this so these may be stupid questions.

Re: Plain Text Offenders - Did you just email me back my own password?

#119

Post by blauwbilgorgel »

hmemcpy wrote: post #24
colinhowe wrote: post #19

I've been wanting to make this for ages. Very pleased to see it made! Would be awesome to have a notable offenders section. A chrome plugin that hooks into this would also be cool: "This site has rubbish password security. Don't use your usual passwords"

It's already planned :) Stay tuned!

Better add rel="nofollow" too. Or do you want to vouch for all these pages? If your PR rises, expect people to create plain-text systems just to get a dofollow link.

Also, do you check each and every service you put up? Or do you trust the random internet visitor to always do the right thing? Are you ready for and ok with any collateral damage?

Re: Plain Text Offenders - Did you just email me back my own password?

#120

Post by JoachimSchipper »

Dylan16807 wrote: post #93
JoachimSchipper wrote: post #65

Earlier quoted context omitted.

Just look at http://news.ycombinator.com/item?id=2343330 . Tumblr has piles of money, and a misplaced 'i' still gave away all their passwords (fortunately, just their passwords for external APIs...) Keeping the source code secret is usually not security goal #1, and not needing to is a good idea. Also, un-salted encrypted passwords are still bad. Just compare the top 10 most popular encryptions with a table of the to…

Still, you can have your passwords very securely stored in bcrypt AND mail the plain text out when the account is created. If your email isn't secure that should really be dealt with, and separately.

No. E-mail is an unencrypted, unauthenticated protocol; how could sending out plain text passwords over a plain text protocol ever be a good idea?
Post reply on HN