Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords in plain text

plaintextoffenders.com

Post reply on HN
Print view View original

21–30 of 116 posts

Re: Passwords in plain text

#21

Post by runn1ng »

omervk wrote: post #12

Hey guys, I'm @omervk, one of the co-founders and the maintainer of PTO. Always a pleasure to be featured on the front page of HN. You're welcome to ask me questions, though we've covered most on our about page ( http://plaintextoffenders.com/about ). The one we haven't is usually "Is there an API/better search/new site coming?" to which the answer is that we're both doing this in our spare time and though we really…

You are also listing websites that send you your password when registering or changing password.

I am not sure that's appropriate. I know systems that send you the mail with your password after registration/password change and then save the passwords to database hashed.

You cannot deduce that they save passwords in plaintext because they send you the password after registration/password reset.

Example: http://plaintextoffenders.com/image/89463394135

Re: Passwords in plain text

#22

Post by heinrich5991 »

zxcdw wrote: post #16
pjscott wrote: post #8

Earlier quoted context omitted.

There are some ways to do that sort of thing safely, for some value of 'safe', but they're non-trivial. Sticking the plaintext passwords in a database row is trivial. Which do you think is more common? :-(

But that has nothing to do with the fact that just because the site emails you a password doesn't mean that they store the password in plaintext. The catch here is that if they email the password upon the user having entered it (made an account or changed their password, or had password generated for them, ...). If user requests a lost password and it's returned in plaintext, then one can be sure that the password is…

No problem here? It goes through so many servers, unencrypted…

Re: Passwords in plain text

#23

Post by runn1ng »

pjscott wrote: post #8
Monkeyget wrote: post #5

The case where you get your new password by mail when you just changed it does not necessarily mean it is stored in plain text. They could keep it around in memory just long enough to send it by mail. Doesn't mean it is a good idea though.

There are some ways to do that sort of thing safely, for some value of 'safe', but they're non-trivial. Sticking the plaintext passwords in a database row is trivial. Which do you think is more common? :-(

I am not sure what you mean.

If you are changing the password/registering, the password is in plaintext in the memory on the server anyway; it just has to be. So they can just mail it to you.

Re: Passwords in plain text

#24

Post by omervk »

runn1ng wrote: post #21
omervk wrote: post #12

Hey guys, I'm @omervk, one of the co-founders and the maintainer of PTO. Always a pleasure to be featured on the front page of HN. You're welcome to ask me questions, though we've covered most on our about page ( http://plaintextoffenders.com/about ). The one we haven't is usually "Is there an API/better search/new site coming?" to which the answer is that we're both doing this in our spare time and though we really…

You are also listing websites that send you your password when registering or changing password. I am not sure that's appropriate. I know systems that send you the mail with your password after registration/password change and then save the passwords to database hashed. You cannot deduce that they save passwords in plaintext because they send you the password after registration/password reset. Example: http://plainte…

Yes, this is also explained in a link from our About page here: http://plaintextoffenders.com/post/7006690494/whats-so-wrong...

TL;DR - it's still a security issue (albeit smaller), we've included it in our mandate, please don't do it.

Re: Passwords in plain text

#26

Post by kremlin »

pjscott wrote: post #8
Monkeyget wrote: post #5

The case where you get your new password by mail when you just changed it does not necessarily mean it is stored in plain text. They could keep it around in memory just long enough to send it by mail. Doesn't mean it is a good idea though.

There are some ways to do that sort of thing safely, for some value of 'safe', but they're non-trivial. Sticking the plaintext passwords in a database row is trivial. Which do you think is more common? :-(

There's a fairly trivial way to do it in Django I think (whether it's still safe to send an email with pw in plaintext is still questionable at best):

Say a user forgot their password and they click some link to reset their password:

Generate the password text, then create an email with that password, send the email, and then store the password, connected to the User object, in the default Django way, which is SHA'd.

Re: Passwords in plain text

#27

Post by gpvos »

heinrich5991 wrote: post #22
zxcdw wrote: post #16

Earlier quoted context omitted.

But that has nothing to do with the fact that just because the site emails you a password doesn't mean that they store the password in plaintext. The catch here is that if they email the password upon the user having entered it (made an account or changed their password, or had password generated for them, ...). If user requests a lost password and it's returned in plaintext, then one can be sure that the password is…

No problem here? It goes through so many servers, unencrypted…

It's no problem, as long as it's a one-time-only password and has a limited lifetime (ideally only a day or so). It's similar to a password reset URL, which is also a password equivalent, but only usable once.

At least it's better than asking for your mother's maiden name.

Re: Passwords in plain text

#28

Post by vijayaggarwal »

We already have a fairly good solution to this problem in OAuth. However, current popular implementations of OAuth are third-party owned which is not desirable for many reasons (for example, google won't use facebook owned OAuth, and vice-versa).

Ideally, we should have a self-owned OAuth service implemented by browsers or operating systems. And the APIs of this service should be standardized. Also, the storage should be locally available with remote sync optionally available for backup and cross-device syncing.

Re: Passwords in plain text

#29

Post by rimantas »

heinrich5991 wrote: post #22
zxcdw wrote: post #16

Earlier quoted context omitted.

But that has nothing to do with the fact that just because the site emails you a password doesn't mean that they store the password in plaintext. The catch here is that if they email the password upon the user having entered it (made an account or changed their password, or had password generated for them, ...). If user requests a lost password and it's returned in plaintext, then one can be sure that the password is…

No problem here? It goes through so many servers, unencrypted…

Well, what would you do with an encrypted password sent to you by email? How do you propose to solve this? Using password reset links instead changes very little.

Re: Passwords in plain text

#30

Post by lyndonh »

omervk wrote: post #24
runn1ng wrote: post #21

Earlier quoted context omitted.

You are also listing websites that send you your password when registering or changing password. I am not sure that's appropriate. I know systems that send you the mail with your password after registration/password change and then save the passwords to database hashed. You cannot deduce that they save passwords in plaintext because they send you the password after registration/password reset. Example: http://plainte…

Yes, this is also explained in a link from our About page here: http://plaintextoffenders.com/post/7006690494/whats-so-wrong... TL;DR - it's still a security issue (albeit smaller), we've included it in our mandate, please don't do it.

> If someone were to hack into any mail account, all they need to do is search for ‘password’ and they have all of the user’s passwords.

Only if you're dumb enough to not delete any password emails.

Granted, preferable any site sending you your password in an email should either send a reset link or "your password is 'red*'"

Post reply on HN