Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords in plain text

plaintextoffenders.com

Post reply on HN
Print view View original

111–116 of 116 posts

Re: Passwords in plain text

#111

Post by Excavator »

vijayaggarwal wrote: post #55
icebraining wrote: post #34

Earlier quoted context omitted.

I think that was Microsoft Passport. More recently, it's Mozilla Persona. The problem has always been a lack of incentives for websites to implement them, coupled with user indifference.

[Edit]: added comment on Mozilla Persona. I would disagree. It's common knowledge (backed by many A/B tests) that shorter sign-up forms see less traffic drop. So, if OAuth can replace a number of things (name, email, password, email verification, and so on) by a couple of clicks, I as a website owner will be very happy. Also, when sending interesting emails to inactive users, I see quite a few come back but drop agai…

> Mozilla persona is a good initiative. Hope they prefer standardization over trying to use it to promote their own browser.

Well, there's this:

https://groups.google.com/forum/#!topic/mozilla.dev.identity...

Re: Passwords in plain text

#113

Post by scott_karana »

ddebernardy wrote: post #108
oakwhiz wrote: post #92

I wish websites would actually use client certificate authentication instead of having to play hot potato with secret passwords.

This a thousand times. And ssh keys for servers. But then, how would you log into e.g. gmail from a cybercoffee in a foreign country? (Assuming you dare do so in spite of the risk of key loggers.)

> But then, how would you log into e.g. gmail from a cybercoffee in a foreign country? (Assuming you dare do so in spite of the risk of key loggers.)

This still applies with any other authentication schemes...

Re: Passwords in plain text

#114

Post by lyndonh »

icebraining wrote: post #35
lyndonh wrote: post #30

Earlier quoted context omitted.

> If someone were to hack into any mail account, all they need to do is search for ‘password’ and they have all of the user’s passwords. Only if you're dumb enough to not delete any password emails. Granted, preferable any site sending you your password in an email should either send a reset link or "your password is 'red *'"

Only if you're dumb enough to not delete any password emails. You delete it from your MUA, but how can you be sure that it wasn't stored in any of the intermediate servers?

The natural assumption is that the hacker has got your password, not hacked gmail or hotmail, etc.

Re: Passwords in plain text

#115

Post by IbJacked »

fooyc wrote: post #50
omervk wrote: post #12

Hey guys, I'm @omervk, one of the co-founders and the maintainer of PTO. Always a pleasure to be featured on the front page of HN. You're welcome to ask me questions, though we've covered most on our about page ( http://plaintextoffenders.com/about ). The one we haven't is usually "Is there an API/better search/new site coming?" to which the answer is that we're both doing this in our spare time and though we really…

For good measure you should list websites allowing you to enter a password on a non-https page, too. That's plain text, too.

Not necessarily. The login page could be http, but as long as it posts to an https address, the password is never transmitted in plain text.

Re: Passwords in plain text

#116

Post by fooyc »

IbJacked wrote: post #115
fooyc wrote: post #50

Earlier quoted context omitted.

For good measure you should list websites allowing you to enter a password on a non-https page, too. That's plain text, too.

Not necessarily. The login page could be http, but as long as it posts to an https address, the password is never transmitted in plain text.

If your login page is HTTP, your HTTPS receiver is useless. A MITM can just change the form's target URL in the HTTP login page. On inject any scripts.
Post reply on HN