91–100 of 116 posts
Earlier quoted context omitted.
Even if it's not stored at their end in plaintext it's a security issue that it's emailed in plaintext.
There was an article on HN in the last week (or so) claiming that both inbound and outbound encryption of email was happening. http://readwrite.com/2014/06/06/google-gmail-encryption-fail... Correct me if I'm wrong but wouldn't this mean that only the email stored on the recipient's email provider's server was then unencrypted.
A lot of talk of passwording concentrates on threats at the technology end, and they ignore threats at the user end. Emailed Passwords are a failure from a tech point of view, but they allow users to create more complex passwords without punishing them when they forget that password. As it is, I have situations now when the complexity requirements of a password combined with the fact that I need to sign in to a separ…
Additionally, allowing passwords to be e-mailed is even worse than this, because there's a good chance the password is not encrypted in transit, which means that it can be intercepted on the way to your mailbox. In that case, the attacker doesn't even need to compromise the database to get your password, no matter how complex it is. Storing passwords in plaintext removes security even if it makes people use less complicated passwords.
Earlier quoted context omitted.
How would one gather that information? What form of evidence would you accept? We'd like to refrain from asking people to hack into sites just to figure out their hashing scheme :)
It is harder than with plain text, yes, but it can show through at times. For example, a while back I was looking through my profile settings on a forum I have an account on, and saw a "check password security" link on it. Out of curiosity, I clicked it, and was greeted with "if a Google search for [unsalted MD5 hash of your password] returns results, your password is not secure." I reported it to the site and turns…
Earlier quoted context omitted.
But that has nothing to do with the fact that just because the site emails you a password doesn't mean that they store the password in plaintext. The catch here is that if they email the password upon the user having entered it (made an account or changed their password, or had password generated for them, ...). If user requests a lost password and it's returned in plaintext, then one can be sure that the password is…
No problem here? It goes through so many servers, unencrypted…
HN passwords are not high security. If we lose an HN account, not only can it be easily restored by an admin, it's really not a huge loss - start again. There doesn't need to be extreme practices.
Oh, you use the same password across sites? (which is the source of 99% of password security concerns). That is crazy, and you shouldn't do that. That's on you. (You being the conceptual person up in arms)
Earlier quoted context omitted.
I am a Digital Ocean customer and the only password they've ever emailed me is the root password for the server I just bought. Arguably this isn't as safe as AWS' process of making you download a kaypair and only letting you login with that. However, VPS owners should get in the habit of logging on to any server they buy and immediately disabling password auth and root login via SSH, which helps negate the root passw…
How is downloading a key pair generated by someone else safer? If this is only for login purposes (I don't use AWS, so maybe there is another reason), you should generate your own key pair and send them only your public key (which doesn't require an encrypted transfer, BTW). If AWS knows your private key and can view it or provide it to you at anytime, that's no different than storing passwords in plaintext.
AWS cannot view or provide you your private key at any time - once you click 'ok' on that javascript window, that private key is gone for good.
Earlier quoted context omitted.
I agree that from a security standpoint it's better not to send the password in plain text at all. But then you can start listing non-HTTPS sites, too. You disclose your password in plaintext to many servers every time you login on those.
Those should be listed too. I'm not sure I follow your point: Because there exists this other really bad but common practice, why are we harping on this bad practice?
Earlier quoted context omitted.
Those should be listed too. I'm not sure I follow your point: Because there exists this other really bad but common practice, why are we harping on this bad practice?
Being overly concerned about having your email sniffed as its passed along internet peer is just misplaced anxiety. Anyone who can successfully sniff your password from your email in transit can already own if they chose to. The convenience factor of having your password emailed and having a record of it in many cases trumps this concern. "But what if someone hacks your email, they know all your passwords!" What if s…
Should really start doing this for sites using MD5/SHA1 for password hashing too, as using them is barely above plain text in terms of security these days.
> as using them is barely above plain text in terms of security these days How so?