61–70 of 160 posts
Earlier quoted context omitted.
It has to be plaintext in the db, because they can't reverse the hash back to plaintext to send to you.
Not quite true. It could be (and probably is) encrypted in the database.
Thoughts? https://news.ycombinator.com/item?id=3798597
Earlier quoted context omitted.
> Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. No it doesn't. They could be using the strongest encryption known to man and still show you your password or e-mail it to you by simply decrypting it when needed.
Encrypted passwords are functionally equivalent to "stored in plain text".
Earlier quoted context omitted.
Not quite true. It could be (and probably is) encrypted in the database.
That doesn't make sense. Three days after you sign-up (i.e. no cache), if they are sending you your password, it can only be because it's plaintext. Unless they are bruteforcing the hash for your convenience... :-)
This is very shocking. It's just ASTOUNDING to me that in the year 2012 — one of the largest and most well-known companies on the internet (listed on NYSE, Alexa Rank 306, $100 Billion+ in revenue) could allow such a stupid vulnerability to persist.
If your Pandora password is extremely sensitive perhaps you should re-evaluate how anal you are about privacy. As long as your CC details are secure, who cares?
Some companies just do not give a shit about (your) security,
Earlier quoted context omitted.
Encrypted passwords are functionally equivalent to "stored in plain text".
Intuitively that makes no sense so I'm wondering if someone could explain?
However, it is still safer from a straight db dump type of attack. The concern for me, though, is if a company can reverse my password, I have no faith they are doing anything correctly WRT security.
If your Pandora password is extremely sensitive perhaps you should re-evaluate how anal you are about privacy. As long as your CC details are secure, who cares?
Earlier quoted context omitted.
It's a radio station. I would never expect a web developer to do 'everything within their control' to secure it. Not even banks do that. Honestly, what are you worried about? So they have your plaintext password. You didn't reuse it for any other service, right? So what use is it to anybody other than logging into your Pandora account and fucking with your stations? (And why the hell would anyone do that?) People nee…
Which would be a reasonable argument except that hashing passwords is effortless in terms of development. The cost/benefit of implementing this functionality makes it a rule of thumb for front facing web pages.
Assuming every web developer implemented a crappy password hash and then checked off the 'security' box on their compliance form. Are users more secure? No, because they didn't consider exactly how secure it needed to be.
Are you using a sha1 hash? Great. Is it salted? Oh shit, forgot that, let's salt it. Ok, now I just cracked it. Oh shit, let's use pbkdf2. Uh oh, it's cpu expensive and not very strong, let's use bcrypt. Shit, it's easy to crack with a big FPGA array, let's use scrypt. Shit, now it can be used for replay attacks, let's add a MAC. Password hashing is easy, right?
Europeans have chip-and-pin credit/debit cards. Are they more secure than Americans without chips in the cards? Yes. They probably feel they're more secure. Yet it's been known for a decade that you can intercept the communication, and millions of dollars/euros have been lost because customers and companies believed in the blind faith of their perceived security.
"oh, i have an anti-virus, i'm secure now."
"oh, i have a vpn, i'm secure now."
"oh, i have tls, i'm secure now."
"oh, i have a password hash, i'm secure now."