Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pandora doesn't hash their passwords

plus.google.com

Post reply on HN
Print view View original

41–50 of 160 posts

Re: Pandora doesn't hash their passwords

#41

Post by hahainternet »

dangrossman wrote: post #34
seanconaty wrote: post #26

This is very bad from a security standpoint but you'd be surprised how many websites do this. Here is a list http://plaintextoffenders.com/ I would have expected Pandora to know better. Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. The websites that do it right cannot tell you your password (because they don't know it); they can only let you reset…

> Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. No it doesn't. They could be using the strongest encryption known to man and still show you your password or e-mail it to you by simply decrypting it when needed.

It's true that he worded it badly, but symmetrically encrypted passwords are no safer than plaintext in practical use.

Re: Pandora doesn't hash their passwords

#42

Post by ciupicri »

nilved wrote: post #31

Why are people still relying on developers to implement proper password security instead of using unique passwords?

I fail to see the tragedy, too. Every service should have an unique password. Also even if the password are hashed, if hackers get control of the web server, they could sniff the passwords when users log in.

Re: Pandora doesn't hash their passwords

#43

Post by RokStdy »

To me the funniest thing is that they rely on the 'password' input type to obfuscate the password. If you change it to 'text' its just a plain text password sitting there. So... somebody thought, "well we're going to have the password here, better make this input 'password' so people can't just see it over your shoulder, it's private!"

Re: Pandora doesn't hash their passwords

#46

Post by mikeash »

dangrossman wrote: post #34
seanconaty wrote: post #26

This is very bad from a security standpoint but you'd be surprised how many websites do this. Here is a list http://plaintextoffenders.com/ I would have expected Pandora to know better. Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. The websites that do it right cannot tell you your password (because they don't know it); they can only let you reset…

> Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. No it doesn't. They could be using the strongest encryption known to man and still show you your password or e-mail it to you by simply decrypting it when needed.

Encrypted passwords are functionally equivalent to "stored in plain text".

Re: Pandora doesn't hash their passwords

#47

Post by ryanwaggoner »

JohnsonB wrote: post #38
qq66 wrote: post #28

Earlier quoted context omitted.

What kind of profitable attacks could one perform with a large collection of Pandora passwords? The best I can think of is for a small band to have millions of people "like" them.

Simple, for every user that the hackers have, try their password for the associated email account, guaranteed they will gain access to many email accounts. Now they have access to their banking accounts.

This could happen, but do we have any evidence that it has? I'm being serious...I constantly hear about widespread leaks of passwords, but the most I hear about it is people having their email hacked by a botnet to...send spam. Have their been any large scale attacks to gain access to bank accounts to then clean them out somehow?

On top of that, how does getting access to someone's bank account even help you? You have to transfer the money to another account, which leaves a trail...

Re: Pandora doesn't hash their passwords

#48

Post by samspot »

fruchtose wrote: post #17

My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for y…

It has to be plaintext in the db, because they can't reverse the hash back to plaintext to send to you.

Re: Pandora doesn't hash their passwords

#49

Post by macchina »

This is very shocking.

It's just ASTOUNDING to me that in the year 2012 — one of the largest and most well-known companies on the internet (listed on NYSE, Alexa Rank 306, $100 Billion+ in revenue) could allow such a stupid vulnerability to persist.

Re: Pandora doesn't hash their passwords

#50

Post by pbreit »

samspot wrote: post #48
fruchtose wrote: post #17

My jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for y…

It has to be plaintext in the db, because they can't reverse the hash back to plaintext to send to you.

Not quite true. It could be (and probably is) encrypted in the database.
Post reply on HN