If your Pandora password is extremely sensitive perhaps you should re-evaluate how anal you are about privacy. As long as your CC details are secure, who cares?
Pandora doesn't hash their passwords
21–30 of 160 posts
Re: Pandora doesn't hash their passwords
#22Re: Pandora doesn't hash their passwords
#23Is there a need for the password to even be printed there? Usually the flow for changing the password is inputting the current password, then typing the new password twice.
Exactly. That brings up another bonehead move by Pandora - if you've made it here on someone else's account (presumably they left it logged in), you can change their password without knowing their password (ignoring the fact that you can already get their password from the DOM).
But I guess that's a minor issue compared to exposing your password. Either way, the whole programming dept. at Pandora needs a lesson in passwords.
Re: Pandora doesn't hash their passwords
#24If your Pandora password is extremely sensitive perhaps you should re-evaluate how anal you are about privacy. As long as your CC details are secure, who cares?
It's the job of the web developer to do everything within their control to protect a user. There is no excuse for not hashing/salting passwords.
Re: Pandora doesn't hash their passwords
#25Is there a need for the password to even be printed there? Usually the flow for changing the password is inputting the current password, then typing the new password twice.
Nope! They're just bad at their jobs.
Re: Pandora doesn't hash their passwords
#26This is very bad from a security standpoint but you'd be surprised how many websites do this.
Here is a list http://plaintextoffenders.com/
I would have expected Pandora to know better. Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text.
The websites that do it right cannot tell you your password (because they don't know it); they can only let you reset it.
Re: Pandora doesn't hash their passwords
#27Earlier quoted context omitted.
I just checked, my password was visible in the source. Pretty shitty, Pandora.
EDIT: Found it. It was in the settings page. What is the source code surrounding the password? Is it the same as the screenshot? I'm trying to find mine but can't. Also, what browsers are you guys using? Mine is Chrome.
Just right-click the password field and choose 'Inspect Element' in the menu.
Re: Pandora doesn't hash their passwords
#28My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for y…
What kind of profitable attacks could one perform with a large collection of Pandora passwords? The best I can think of is for a small band to have millions of people "like" them.
Re: Pandora doesn't hash their passwords
#29My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for y…
Even if they are just using saving it in session they aren't using https
Re: Pandora doesn't hash their passwords
#30My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for y…
What kind of profitable attacks could one perform with a large collection of Pandora passwords? The best I can think of is for a small band to have millions of people "like" them.
Many users reuse passwords across their web presence.
So there's the chance of gaining access to other accounts as a result of the data leak... such as their bank accounts, etc.