Wow, their advice is terrible too: "86% Exceptional" http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
Change a '5' to a '6' and add a '1' and you get 100%
http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
UK government's password checker sends plaintext password in the URL over HTTP
41–50 of 117 posts
Re: UK government's password checker sends plaintext password in the URL over HTTP
#42My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.
Not sure how this works, but if I were writing something that checks "goodness" of passwords, I'd want to check it against a large, sorted list of like the 100 million most common passwords (since almost anyone attackers would start with a dictionary attack, and 10-100 million passwords is decently quick to run against a weak key derivation function). Such a database would be huge, so you'd prefer to do that server-s…
Look at the list of things they check. It shows you how they calculate the score for the password. The actual scoring is in fact done in JavaScript, which you can see when you inspect the page.
They want the password on the server side purely for statistics or some other reason that has nothing to do with scoring how "secure" the password is.
Re: UK government's password checker sends plaintext password in the URL over HTTP
#43Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…
If you do visit the https version of the page, some of the links back to page still have a hard coded http:// instead of https://
Re: UK government's password checker sends plaintext password in the URL over HTTP
#44how safe is this password really? and is it better if I add a goat?
Gets 100% safe
Re: UK government's password checker sends plaintext password in the URL over HTTP
#45 The Data Protection Act
Under the Data Protection Act, we have a legal duty to protect any information we collect from you. We use encryption software to safeguard your data, and keep strict security standards to prevent any unauthorised access to it.
Re: UK government's password checker sends plaintext password in the URL over HTTP
#46Yep, and they add the password to the url:
https://www.getsafeonline.org/themes/passwrdcheck/results.ht...
Re: UK government's password checker sends plaintext password in the URL over HTTP
#47 Nice way for UKGov to harvest a load of passwords for their own use
Re: UK government's password checker sends plaintext password in the URL over HTTP
#48What a wonderful tool:
http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
Password12345
is ranked 93% Exceptional!
Re: UK government's password checker sends plaintext password in the URL over HTTP
#49My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.
Not sure how this works, but if I were writing something that checks "goodness" of passwords, I'd want to check it against a large, sorted list of like the 100 million most common passwords (since almost anyone attackers would start with a dictionary attack, and 10-100 million passwords is decently quick to run against a weak key derivation function). Such a database would be huge, so you'd prefer to do that server-s…
Like dasmoth says, use a Bloom filter.
Or run the length and character checks in Javascript, then hash the password and send the hashed version for dictionary lookup.
Re: UK government's password checker sends plaintext password in the URL over HTTP
#50Wow, their advice is terrible too: "86% Exceptional" http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
Password12345 gets 93%.