Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pandora doesn't hash their passwords

plus.google.com

Post reply on HN
Print view View original

111–120 of 160 posts

Re: Pandora doesn't hash their passwords

#111

Post by labizaboffle »

cbsmith wrote: post #94
aiiane wrote: post #92

Earlier quoted context omitted.

#1 - yes, which is also a problem! But is actually less serious, because that doesn't give you knowledge of the old password which could be shared with another site. (Obviously in the ideal case it wouldn't be, but let's face it, it is for the vast majority of users.) #2 - which is something that browser vendors are working to address (e.g. by displaying non-ascii characters in slightly different ways, e.g. punycode,…

#1: It might be a problem, but it is also a clear indication to even a naive user that if they leave their browser logged in to Pandora, their account be compromised. #2: Right. So there is a possibility that some day in the future, if you are really careful and check your TLS certificate every time you do something with your password, Pandora will be exposing you to a huge gaping hole, that you would otherwise only…

#1: How many times is too much when replying with #1 and #2?

#2: Answer: this many times.

So anyway, everyone change your Pandora password and be done with it. You can't buy anything with a Pandora account except to be able to listen to Pandora. That is not worth stealing, even if it is a great service. I pay for it, and I'm not going to stop because of Apple. They may have the library, but they don't have the years of experience that Pandora has in its market. I do think Apple will own the high-end home entertainment market eventually.

Re: Pandora doesn't hash their passwords

#112

Post by aiiane »

cbsmith wrote: post #107
ecaron wrote: post #45

Earlier quoted context omitted.

Proof that 99% of generating good conversation on HN comes from a well-phrased title.

Actually, proof that a provocative but false headline on HN will still get the sheep to vote up your article. ;-)

For the record, the title was actually edited from what I submitted it as.

Re: Pandora doesn't hash their passwords

#113

Post by tgrass »

revelation wrote: post #101
cbsmith wrote: post #71

There may be a security issue here, but I think there is a distinct possibility that it certainly isn't what people think. Pandora needn't store the password on their servers. Just posted this to the Google+ thread: Okay, I just did a simple test of what happens when I change my Pandora password. There is a record of HTML local storage keyed on "jStorage" which appears to be a giant JSON blob. A specific attribute wh…

And why exactly would they go to all this trouble for displaying the correct number of stars in a password field? Unless, of course, they use this local data for actual security purposes. In which case this is a huge gaping security hole and I wouldn't trust them with a bit of my data.

I wouldn't trust them with a bit of my data

I too would hate for anyone to know I have a Maroon 5 station.

[EDIT] I don't.

Re: Pandora doesn't hash their passwords

#114

Post by cbsmith »

labizaboffle wrote: post #111
cbsmith wrote: post #94

Earlier quoted context omitted.

#1: It might be a problem, but it is also a clear indication to even a naive user that if they leave their browser logged in to Pandora, their account be compromised. #2: Right. So there is a possibility that some day in the future, if you are really careful and check your TLS certificate every time you do something with your password, Pandora will be exposing you to a huge gaping hole, that you would otherwise only…

#1: How many times is too much when replying with #1 and #2? #2: Answer: this many times. So anyway, everyone change your Pandora password and be done with it. You can't buy anything with a Pandora account except to be able to listen to Pandora. That is not worth stealing, even if it is a great service. I pay for it, and I'm not going to stop because of Apple. They may have the library, but they don't have the years…

#!: 42. The answer is always 42.

Re: Pandora doesn't hash their passwords

#115

Post by labizaboffle »

cbsmith wrote: post #114
labizaboffle wrote: post #111

Earlier quoted context omitted.

#1: How many times is too much when replying with #1 and #2? #2: Answer: this many times. So anyway, everyone change your Pandora password and be done with it. You can't buy anything with a Pandora account except to be able to listen to Pandora. That is not worth stealing, even if it is a great service. I pay for it, and I'm not going to stop because of Apple. They may have the library, but they don't have the years…

#!: 42. The answer is always 42.

Bring your towel much? ;)

Re: Pandora doesn't hash their passwords

#116

Post by cbsmith »

mrb wrote: post #106
cbsmith wrote: post #93

Earlier quoted context omitted.

The attribute name is obfuscated, which makes it harder to programmatically find the password (presuming it is under a different name for each account). The password itself is stored encrypted. Here's the thing: if someone has this kind of access to your browser, wouldn't it be simpler to install a simple browser plug-in that scrapes off any data typed in to a password input field?

The attribute name may be obfuscated, but it appears to be always the same (at least in my browsers): bc673ea54a2b7153aaafbf178e9b0892e1f2e56be5aaa5a7

It's a different attribute name on my system. Looks like it is different for each account, as it should be.

It's just sad seeing Pandora raked over the coals for this when they clearly have put in a lot of thought and done things as right as possible given their constraints.

Re: Pandora doesn't hash their passwords

#117

Post by [deleted] »

revelation wrote: post #101
cbsmith wrote: post #71

There may be a security issue here, but I think there is a distinct possibility that it certainly isn't what people think. Pandora needn't store the password on their servers. Just posted this to the Google+ thread: Okay, I just did a simple test of what happens when I change my Pandora password. There is a record of HTML local storage keyed on "jStorage" which appears to be a giant JSON blob. A specific attribute wh…

And why exactly would they go to all this trouble for displaying the correct number of stars in a password field? Unless, of course, they use this local data for actual security purposes. In which case this is a huge gaping security hole and I wouldn't trust them with a bit of my data.

[deleted]

Re: Pandora doesn't hash their passwords

#118

Post by telecuda »

cbsmith wrote: post #76
telecuda wrote: post #18

I wish someone would make a one-pager that says: "Hey CEO, your site doesn't hash passwords. Here's why it's bad. Here's how it got other companies in hot water. Here's how simple it is to fix. Forward this to your tech guy. Oh, and until you do, we'll put your company on this wall of shame." Every time I receive a welcome email showing my password in plain-text, I'd gladly spend 5 minutes finding the email of an exe…

Someone shouldn't do that, because a) though the poster thinks they have proof that the site doesn't hash passwords, it increasingly seems like they do, and b) the CEO isn't the person to send this to anyway.

I disagree from personal experience. On (a) if you receive an email confirming your registration that displays your password, I guess it could be hashed later but probably wasn't, right? And (b), this happened with my city's utility bill service (has a lot of my personal info) and an email to the mayor's office got it addressed. My larger point is that telling a non-technical higher-up can go a long way for things where customer service may not see the bigger problem.

Re: Pandora doesn't hash their passwords

#119

Post by IgorPartola »

Evbn wrote: post #98
rapind wrote: post #85

Earlier quoted context omitted.

This. For more information on why this is the case, here's a pretty good article on it. http://arstechnica.com/security/2012/08/passwords-under-assa... The simplified version: Every time a password is cracked it is added to a database of hashes used to hack other databases. Essentially crowdsourced cracking.

That only works on broken sites that don't salt.

If I was to try to break salted passwords, my first inclination would be to find the largest set of known passwords and try those before resolving to a pure brute-force approach. Thus if you password "ILikePuppies" is ever exposed as a password, then I would consider it insecure.

Re: Pandora doesn't hash their passwords

#120

Post by cbsmith »

aiiane wrote: post #112
cbsmith wrote: post #107

Earlier quoted context omitted.

Actually, proof that a provocative but false headline on HN will still get the sheep to vote up your article. ;-)

For the record, the title was actually edited from what I submitted it as.

...and it is still wrong. They do hash their passwords.
Post reply on HN