Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords in plain text

plaintextoffenders.com

Post reply on HN
Print view View original

31–40 of 116 posts

Re: Passwords in plain text

#31

Post by __david__ »

rimantas wrote: post #29
heinrich5991 wrote: post #22

Earlier quoted context omitted.

No problem here? It goes through so many servers, unencrypted…

Well, what would you do with an encrypted password sent to you by email? How do you propose to solve this? Using password reset links instead changes very little.

> Using password reset links instead changes very little.

Actually it changes a lot. Password reset links are one time only, and they get sent before you change your password. Mailing your password in plaintext after you've just changed it means it's good even if someone gets a hold of it months or years later. That's significantly worse.

Re: Passwords in plain text

#32

Post by Excavator »

vijayaggarwal wrote: post #28

We already have a fairly good solution to this problem in OAuth. However, current popular implementations of OAuth are third-party owned which is not desirable for many reasons (for example, google won't use facebook owned OAuth, and vice-versa). Ideally, we should have a self-owned OAuth service implemented by browsers or operating systems. And the APIs of this service should be standardized. Also, the storage shoul…

Something like the Firefox Accounts¹ project? Which has Oauth2 support² in the works.

1: https://wiki.mozilla.org/Identity/Firefox_Accounts

2: https://github.com/mozilla/fxa-oauth-server

Re: Passwords in plain text

#33

Post by __david__ »

runn1ng wrote: post #23
pjscott wrote: post #8

Earlier quoted context omitted.

There are some ways to do that sort of thing safely, for some value of 'safe', but they're non-trivial. Sticking the plaintext passwords in a database row is trivial. Which do you think is more common? :-(

I am not sure what you mean. If you are changing the password/registering, the password is in plaintext in the memory on the server anyway; it just has to be. So they can just mail it to you.

That doesn't mean it's good practice. In fact it's a pretty bad practice.

Re: Passwords in plain text

#34

Post by icebraining »

vijayaggarwal wrote: post #28

We already have a fairly good solution to this problem in OAuth. However, current popular implementations of OAuth are third-party owned which is not desirable for many reasons (for example, google won't use facebook owned OAuth, and vice-versa). Ideally, we should have a self-owned OAuth service implemented by browsers or operating systems. And the APIs of this service should be standardized. Also, the storage shoul…

I think that was Microsoft Passport. More recently, it's Mozilla Persona. The problem has always been a lack of incentives for websites to implement them, coupled with user indifference.

Re: Passwords in plain text

#35

Post by icebraining »

lyndonh wrote: post #30
omervk wrote: post #24

Earlier quoted context omitted.

Yes, this is also explained in a link from our About page here: http://plaintextoffenders.com/post/7006690494/whats-so-wrong... TL;DR - it's still a security issue (albeit smaller), we've included it in our mandate, please don't do it.

> If someone were to hack into any mail account, all they need to do is search for ‘password’ and they have all of the user’s passwords. Only if you're dumb enough to not delete any password emails. Granted, preferable any site sending you your password in an email should either send a reset link or "your password is 'red *'"

Only if you're dumb enough to not delete any password emails.

You delete it from your MUA, but how can you be sure that it wasn't stored in any of the intermediate servers?

Re: Passwords in plain text

#36

Post by aunty_helen »

CiaranMcNulty wrote: post #14
Monkeyget wrote: post #5

The case where you get your new password by mail when you just changed it does not necessarily mean it is stored in plain text. They could keep it around in memory just long enough to send it by mail. Doesn't mean it is a good idea though.

Even if it's not stored at their end in plaintext it's a security issue that it's emailed in plaintext.

There was an article on HN in the last week (or so) claiming that both inbound and outbound encryption of email was happening. http://readwrite.com/2014/06/06/google-gmail-encryption-fail...

Correct me if I'm wrong but wouldn't this mean that only the email stored on the recipient's email provider's server was then unencrypted.

Re: Passwords in plain text

#37

Post by oneeyedpigeon »

omervk wrote: post #12

Hey guys, I'm @omervk, one of the co-founders and the maintainer of PTO. Always a pleasure to be featured on the front page of HN. You're welcome to ask me questions, though we've covered most on our about page ( http://plaintextoffenders.com/about ). The one we haven't is usually "Is there an API/better search/new site coming?" to which the answer is that we're both doing this in our spare time and though we really…

Great stuff, although it would be nice to have the list of sites in a more usable format - browsing through individual blog posts looking for a domain isn't particularly efficient.

Have you thought about reporting on other aspects of password security, such as misguided length limits or character requirements?

Edit: sorry, I guess you've just about covered my first point.

Re: Passwords in plain text

#38

Post by aunty_helen »

omervk wrote: post #12

Hey guys, I'm @omervk, one of the co-founders and the maintainer of PTO. Always a pleasure to be featured on the front page of HN. You're welcome to ask me questions, though we've covered most on our about page ( http://plaintextoffenders.com/about ). The one we haven't is usually "Is there an API/better search/new site coming?" to which the answer is that we're both doing this in our spare time and though we really…

A couple of simple client-server type graphics would do a lot in explaining why this is an issue to the layman.

Re: Passwords in plain text

#39

Post by Daiz »

Should really start doing this for sites using MD5/SHA1 for password hashing too, as using them is barely above plain text in terms of security these days.

Re: Passwords in plain text

#40

Post by [deleted] »

gpvos wrote: post #27
heinrich5991 wrote: post #22

Earlier quoted context omitted.

No problem here? It goes through so many servers, unencrypted…

It's no problem, as long as it's a one-time-only password and has a limited lifetime (ideally only a day or so). It's similar to a password reset URL, which is also a password equivalent, but only usable once. At least it's better than asking for your mother's maiden name.

[deleted]
Post reply on HN