Is there a need for the password to even be printed there? Usually the flow for changing the password is inputting the current password, then typing the new password twice.
Pandora doesn't hash their passwords
11–20 of 160 posts
Re: Pandora doesn't hash their passwords
#12[deleted]
Are you looking at view-source: or are you looking at the actual DOM after it has been modified by JavaScript?
The password field is created by JavaScript based on a template from the HTML source, and the password is filled in via a script; it's not sent in the base page.
Re: Pandora doesn't hash their passwords
#13[deleted]
Try inspecting the element (in Chrome inspector or Firebug or whatever). My password is visible there. When doing a simple view-source, I just see "${password}" though.
Re: Pandora doesn't hash their passwords
#14[deleted]
My password isn't viewable in the source (cmd + opt + u), but when I inspect the password field with the Web Inspector, my password is visible in plain text as the value of the password field.
Re: Pandora doesn't hash their passwords
#15Re: Pandora doesn't hash their passwords
#16[deleted]
I just checked, my password was visible in the source. Pretty shitty, Pandora.
EDIT: Found it. It was in the settings page.
What is the source code surrounding the password? Is it the same as the screenshot? I'm trying to find mine but can't.
Also, what browsers are you guys using?
Mine is Chrome.
Re: Pandora doesn't hash their passwords
#17My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking?
It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for your session. I hope that this is the case. If it turns out to be anything else--plaintext passwords in database, etc.--then Pandora is worse than LinkedIn.
Re: Pandora doesn't hash their passwords
#18I wish someone would make a one-pager that says:
"Hey CEO, your site doesn't hash passwords. Here's why it's bad. Here's how it got other companies in hot water. Here's how simple it is to fix. Forward this to your tech guy. Oh, and until you do, we'll put your company on this wall of shame."
Every time I receive a welcome email showing my password in plain-text, I'd gladly spend 5 minutes finding the email of an exec, or simply sending the link to support. Why? If the service is valuable to me, it's probably worth 5 minutes to protect my account and others'.
Would pair up with someone here if you want to knock it out.
Re: Pandora doesn't hash their passwords
#19Re: Pandora doesn't hash their passwords
#20[deleted]
Are you looking at view-source: or are you looking at the actual DOM after it has been modified by JavaScript? The password field is created by JavaScript based on a template from the HTML source, and the password is filled in via a script; it's not sent in the base page.
Ahhh - there it is - you're right! Pretty lousy.