11–20 of 138 posts
How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
The IEEE is an association, and doesn't actually have any engineers working for it. Likely, their website is outsourced to one of the local web development firms in town.
How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
Because it's not that important. In most cases what someone could do with my account is to view articles I have paid for, either piecemeal or as a subscription. It's much more in their interest than my interest to keep that private. They've sent me my cleartext password several times before I finally wrote it down in a place I could keep it safe, and I was always thankful. Also, the default password is something very…
yes, it very much is.
> In most cases what someone could do with my account is to view articles I have paid for
That's not the problem with leaking plaintext accounts. If the user database is compromised, you can safely assume all of the site is and the site's data is leaked as well (or would be if anyone gave a fuck).
The problem of cleatext (or easy to reverse) password databases is twofold:
1. Most users reuse the same password again and again and again. Having their password leaked on site 1 means all of their accounts are now wide open to whoever got the passwords.
2. Even if only the passwords themselves are leaked, this provides a huge dataset of effective, real-world password. This is a treasure trove of human behaviors and enables the improvement of brute-forcing mutators. In fact, one of the most substantial and important events in modern hacking history was the RockYou password leak.
I checked the ieee.org website and nothing about this has been mentioned yet. Not even a "We're investigating the allegation" snippet of news.
How is that this esteemed organization of technical people doesn't know how to md5 passwords before storing them in the database?
Because it's not that important. In most cases what someone could do with my account is to view articles I have paid for, either piecemeal or as a subscription. It's much more in their interest than my interest to keep that private. They've sent me my cleartext password several times before I finally wrote it down in a place I could keep it safe, and I was always thankful. Also, the default password is something very…
given that people signed up using corporate email addresses, this could be used to hack internal networks of companies.
I think it's time for web browsers to step up and start showing a visual indication for websites that store passwords in plaintext.
Earlier quoted context omitted.
Because it's not that important. In most cases what someone could do with my account is to view articles I have paid for, either piecemeal or as a subscription. It's much more in their interest than my interest to keep that private. They've sent me my cleartext password several times before I finally wrote it down in a place I could keep it safe, and I was always thankful. Also, the default password is something very…
> Because it's not that important. yes, it very much is. > In most cases what someone could do with my account is to view articles I have paid for That's not the problem with leaking plaintext accounts. If the user database is compromised, you can safely assume all of the site is and the site's data is leaked as well (or would be if anyone gave a fuck). The problem of cleatext (or easy to reverse) password databases…
It was plainly obvious to any user of IEEE that they were storing your password in clear text. Because they would, y'know, mail it to you. And the mail would have live hyperlinks to access your account, which generally means GET requests.
I think it's time for web browsers to step up and start showing a visual indication for websites that store passwords in plaintext.
Earlier quoted context omitted.
> Because it's not that important. yes, it very much is. > In most cases what someone could do with my account is to view articles I have paid for That's not the problem with leaking plaintext accounts. If the user database is compromised, you can safely assume all of the site is and the site's data is leaked as well (or would be if anyone gave a fuck). The problem of cleatext (or easy to reverse) password databases…
You seem unfamiliar with the specific case. It wasn't the user database that was compromised. It was plainly obvious to any user of IEEE that they were storing your password in clear text. Because they would, y'know, mail it to you . And the mail would have live hyperlinks to access your account, which generally means GET requests.
Which isn't really relevant. A password leak is a password leak, whatever its source is.
> It was plainly obvious to any user of IEEE that they were storing your password in clear text
And nobody every took issue with that?
> And the mail would have live hyperlinks to access your account, which generally means GET requests.
That doesn't mean anything, the hyperlink could have contained a nonce allowing log-in.