Why are people still relying on developers to implement proper password security instead of using unique passwords?
Pandora doesn't hash their passwords
31–40 of 160 posts
Re: Pandora doesn't hash their passwords
#32It also seems the password is being passed in the clear...
Re: Pandora doesn't hash their passwords
#33If your Pandora password is extremely sensitive perhaps you should re-evaluate how anal you are about privacy. As long as your CC details are secure, who cares?
It's the job of the web developer to do everything within their control to protect a user. There is no excuse for not hashing/salting passwords.
It's a radio station. I would never expect a web developer to do 'everything within their control' to secure it. Not even banks do that.
Honestly, what are you worried about? So they have your plaintext password. You didn't reuse it for any other service, right? So what use is it to anybody other than logging into your Pandora account and fucking with your stations? (And why the hell would anyone do that?)
People need to be more realistic about security.
Re: Pandora doesn't hash their passwords
#34This is very bad from a security standpoint but you'd be surprised how many websites do this. Here is a list http://plaintextoffenders.com/ I would have expected Pandora to know better. Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. The websites that do it right cannot tell you your password (because they don't know it); they can only let you reset…
> Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text.
No it doesn't. They could be using the strongest encryption known to man and still show you your password or e-mail it to you by simply decrypting it when needed.
Re: Pandora doesn't hash their passwords
#35My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for y…
What kind of profitable attacks could one perform with a large collection of Pandora passwords? The best I can think of is for a small band to have millions of people "like" them.
People typically use variants of the same password across the web. It's a huge starting place for breaking into an email account.
Also, since it's vanilla http, you could sniff these passwords at a coffee shop's wifi all day and just wait for someone to log in to Pandora.
Re: Pandora doesn't hash their passwords
#36Re: Pandora doesn't hash their passwords
#37This is very bad from a security standpoint but you'd be surprised how many websites do this. Here is a list http://plaintextoffenders.com/ I would have expected Pandora to know better. Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. The websites that do it right cannot tell you your password (because they don't know it); they can only let you reset…
> Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. No it doesn't. They could be using the strongest encryption known to man and still show you your password or e-mail it to you by simply decrypting it when needed.
And then someone looks at your screen and takes your account.
Re: Pandora doesn't hash their passwords
#38My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for y…
What kind of profitable attacks could one perform with a large collection of Pandora passwords? The best I can think of is for a small band to have millions of people "like" them.
Simple, for every user that the hackers have, try their password for the associated email account, guaranteed they will gain access to many email accounts. Now they have access to their banking accounts.
Re: Pandora doesn't hash their passwords
#39Earlier quoted context omitted.
It's the job of the web developer to do everything within their control to protect a user. There is no excuse for not hashing/salting passwords.
It's a radio station. I would never expect a web developer to do 'everything within their control' to secure it. Not even banks do that. Honestly, what are you worried about? So they have your plaintext password. You didn't reuse it for any other service, right? So what use is it to anybody other than logging into your Pandora account and fucking with your stations? (And why the hell would anyone do that?) People nee…
Which would be a reasonable argument except that hashing passwords is effortless in terms of development.
The cost/benefit of implementing this functionality makes it a rule of thumb for front facing web pages.
Re: Pandora doesn't hash their passwords
#40This is very bad from a security standpoint but you'd be surprised how many websites do this. Here is a list http://plaintextoffenders.com/ I would have expected Pandora to know better. Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. The websites that do it right cannot tell you your password (because they don't know it); they can only let you reset…
> Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. No it doesn't. They could be using the strongest encryption known to man and still show you your password or e-mail it to you by simply decrypting it when needed.
Which is almost as bad. A service provider does not need to know your password, just a salted hash of it.