Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pandora doesn't hash their passwords

plus.google.com

Post reply on HN
Print view View original

121–130 of 160 posts

Re: Pandora doesn't hash their passwords

#121

Post by [deleted] »

cbsmith wrote: post #76
telecuda wrote: post #18

I wish someone would make a one-pager that says: "Hey CEO, your site doesn't hash passwords. Here's why it's bad. Here's how it got other companies in hot water. Here's how simple it is to fix. Forward this to your tech guy. Oh, and until you do, we'll put your company on this wall of shame." Every time I receive a welcome email showing my password in plain-text, I'd gladly spend 5 minutes finding the email of an exe…

Someone shouldn't do that, because a) though the poster thinks they have proof that the site doesn't hash passwords, it increasingly seems like they do, and b) the CEO isn't the person to send this to anyway.

[deleted]

Re: Pandora doesn't hash their passwords

#123

Post by mrb »

cbsmith wrote: post #116
mrb wrote: post #106

Earlier quoted context omitted.

The attribute name may be obfuscated, but it appears to be always the same (at least in my browsers): bc673ea54a2b7153aaafbf178e9b0892e1f2e56be5aaa5a7

It's a different attribute name on my system. Looks like it is different for each account, as it should be. It's just sad seeing Pandora raked over the coals for this when they clearly have put in a lot of thought and done things as right as possible given their constraints.

I know why it is different on each system, it is because the numeric user ID is encoded in it.

I am 99% sure I am right, all the fields/values are merely obfuscated with a constant key. Not proper encryption at all.

Re: Pandora doesn't hash their passwords

#125

Post by cbsmith »

telecuda wrote: post #118
cbsmith wrote: post #76

Earlier quoted context omitted.

Someone shouldn't do that, because a) though the poster thinks they have proof that the site doesn't hash passwords, it increasingly seems like they do, and b) the CEO isn't the person to send this to anyway.

I disagree from personal experience. On (a) if you receive an email confirming your registration that displays your password, I guess it could be hashed later but probably wasn't, right? And (b), this happened with my city's utility bill service (has a lot of my personal info) and an email to the mayor's office got it addressed. My larger point is that telling a non-technical higher-up can go a long way for things wh…

I agree that if you get the password in an e-mail plain text, there could be an issue... unless your e-mail client is rendering that section using a browser... which happens to have an encrypted version of the password stored locally.

However, in Pandora's case, this isn't what is happening, and it appears they've taken pretty extensive security measures given their constraints.

Telling a non-technical higher-up there is a problem, is also a good way to get a technical person in to trouble. If it is merited, no problem, but if you are wrong, you've just rewarded good work with a load of crap. It is much more appropriate to follow up with the appropriate party and at least give them a chance to respond before sounding the klaxon.

Re: Pandora doesn't hash their passwords

#126

Post by mkopinsky »

tgrass wrote: post #113
revelation wrote: post #101

Earlier quoted context omitted.

And why exactly would they go to all this trouble for displaying the correct number of stars in a password field? Unless, of course, they use this local data for actual security purposes. In which case this is a huge gaping security hole and I wouldn't trust them with a bit of my data.

I wouldn't trust them with a bit of my data I too would hate for anyone to know I have a Maroon 5 station. [EDIT] I don't.

Did I just learn how I will torture my coworkers tomorrow? (We have a shared Pandora computer in the office - each day someone gets to choose what plays.)

Re: Pandora doesn't hash their passwords

#127

Post by aiiane »

cbsmith wrote: post #120
aiiane wrote: post #112

Earlier quoted context omitted.

For the record, the title was actually edited from what I submitted it as.

...and it is still wrong. They do hash their passwords.

Encryption is not the same as hashing.

That said, when I said the title was edited, I was not referring to myself editing it.

Re: Pandora doesn't hash their passwords

#128

Post by mrb »

mrb wrote: post #91
cbsmith wrote: post #71

There may be a security issue here, but I think there is a distinct possibility that it certainly isn't what people think. Pandora needn't store the password on their servers. Just posted this to the Google+ thread: Okay, I just did a simple test of what happens when I change my Pandora password. There is a record of HTML local storage keyed on "jStorage" which appears to be a giant JSON blob. A specific attribute wh…

There appears to be a real security issue that every one missed in this thread: the password does not appear to be encrypted, but merely obfuscated , using the same obfuscation technique as the one used to obfuscate the randomly generated JSON attribute names. Which means that even after logging out of pandora, the password would remain in the HTML local storage, and could be de-obfuscated, and log back into pandora.…

Update 04:49 UTC: I am done reverse-engineering Pandora's javascript code!

And I was right: the JSON object that it stores in the HTML local storage is merely obfuscated with static keys, not encrypted. I was able to decrypt the full object, including my Pandora password:

  lastUserId: "xxxxxxxxx"
  storedUserIds: ["xxxxxxxxx"]
  Uxxxxxxxxx.StationSortOrderAlpha: false
  Uxxxxxxxxx.isAnonymous: false
  Uxxxxxxxxx.Username: "xxx@xxx.com"
  Uxxxxxxxxx.Password: "myCleartextPassword"
  hasLoggedIn: true

  (xxxxxxxxx) is the numeric Pandora user ID.
I will publish an tool for decryption as a proof-of-concept, in the next hour.

What were Pandora's developers thinking? This is not a huge flaw, but they should certainly not store sensitive data like the user's password in the local storage.

Re: Pandora doesn't hash their passwords

#129

Post by cbsmith »

aiiane wrote: post #127
cbsmith wrote: post #120

Earlier quoted context omitted.

...and it is still wrong. They do hash their passwords.

Encryption is not the same as hashing. That said, when I said the title was edited, I was not referring to myself editing it.

> Encryption is not the same as hashing.

UPDATE: http://news.ycombinator.com/item?id=4552358

If mrb is right, it looks like they are storing it locally without encryption, which is indeed bad.

What I had written before seeing that:

======================================

Yes it is not. As a consequence, they are not mutually exclusive.

The title would be correct if it said, "Pandora stores encrypted passwords locally". Guess how much less interesting your post would be with that title? ;-)

They hash their passwords. They encrypt their passwords.

I'd prefer they only did the former, but the fact that they do the former at all is NOT what most people commenting on this thread understand.

Re: Pandora doesn't hash their passwords

#130

Post by just2n »

I see __USE_EXISTING__. I promise that's not my password, either. It seems that the server interprets this as an implication that it should keep your existing password. So I would expect if it's ever using a different value on the client, it's an accident, because this feature implies there's no reason for the client to ever save the password (not that there's a valid reason to do that anyway).

That is, unless I'm actually seeing this after they've patched the issue?

Post reply on HN