Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

But why can't I send people their passwords?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 181 posts

Re: But why can't I send people their passwords?

#41

Post by peterwwillis »

Question 8 on the dev faq should emphasize using multiple layers when doing a password reset, partially to avoid the inherent problems with e-mail security (especially as your last bastion of security). Security questions, browser heuristics, login attempts, out-of-band communication (SMS confirmation code, secondary e-mail account, etc).

Question 9 should include a sub-section .3 which explains that if you unrestrict the password field, you need to include a basic password cracker or strength requirement, usually along with a client-side "strength" meter. The backend should reject all simple passwords and the frontend should help the user pick a simple yet strong password.

And ideally this page would also link the dev to http://twofactorauth.org/ as an example of how many more places are implementing 2FA. Passwords are dead; long live passwords with 2FA.

Re: But why can't I send people their passwords?

#42

Post by thesumofall »

scrollaway wrote: post #26
thesumofall wrote: post #17

For [11]: I think it makes sense to also highlight other approaches than OpenID such as https://passwordless.net which is a sort of way in the middle (disclaimer: I'm the author)

As a huge supporter of Persona, I am intrigued. Can you sell me on how this may be better?

Also, Persona still relies on passwords which are usually too weak and re-used across the web

Re: But why can't I send people their passwords?

#43

Post by kateperry »

jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

my roomate's sister-in-law earned $14851 last month. she is getting paid on the laptop and moved in a $499100 house. All she did was get blessed and put to work the clues exposed on this web site ,,,,,,,, ,,,,,,,, WWW.MAX43.COM

Re: But why can't I send people their passwords?

#44

Post by sp332 »

troels wrote: post #15
LukeB_UK wrote: post #6

I disagree with point 11. You shouldn't rely on someone else's service to be the way for users to access yours.

It's pretty hard not to though. You rely on your hosting provider for service and probably on a multitude of software services too. Of course you have to weigh the value of each further point of failure in your setup, but it's a tradeoff and may well be worth it.

Yeah, but I can switch hosting providers. What happens when I switch login providers?

Re: But why can't I send people their passwords?

#45

Post by krambs »

jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

You shouldn't send the password because you shouldn't be storing the password. Worries about email security, etc. are secondary.

Re: But why can't I send people their passwords?

#46

Post by scrollaway »

thesumofall wrote: post #39
scrollaway wrote: post #26

Earlier quoted context omitted.

As a huge supporter of Persona, I am intrigued. Can you sell me on how this may be better?

I think Persona is great and can be the right choice for many scenarios. Browser support, the JS requirement, and the reliance on email (whereas tokens can e.g. be distributed via text message) might however be points that convince developers to go with one-time passwords.

> Browser support

Persona is just a protocol though, it's implicitly supported by all browsers. Though in-browser auth (which is the ideal case) is only in Firefox so far...

> JS requirement

Granted. Though theoretically, you don't need javascript.

> reliance on email

Granted again, but this is a completely acceptable tradeoff for 99% of services which will require an email and usually even use it as the user's identification.

Still not sold, but I'll keep your solution in mind. Thanks for alternatives! :)

Re: But why can't I send people their passwords?

#47

Post by x86_64Ubuntu »

jaredmcateer wrote: post #14
jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

Another thing to consider is if your email provider's offline backups get jacked in transit would you rather your emails contain your plain text passwords or links to a password reset with expired tokens?

I have never thought of that, ever. I'm not being sarcastic. Usually I think of email as existing on some secure server, I never thought that backups are kept, maybe in a different medium which is then open to vulnerabilities.

Re: But why can't I send people their passwords?

#48

Post by kenny_r »

weaksauce wrote: post #7
jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

A lot of people use only one password for everywhere... You'd be giving the attacker the keys to the kingdom.

Which is still true if you don't know their passwords but if you have their email. You can reset the passwords for just about every conceivable account they have.

Re: But why can't I send people their passwords?

#49

Post by jwl »

x86_64Ubuntu wrote: post #47
jaredmcateer wrote: post #14

Earlier quoted context omitted.

Another thing to consider is if your email provider's offline backups get jacked in transit would you rather your emails contain your plain text passwords or links to a password reset with expired tokens?

I have never thought of that, ever. I'm not being sarcastic. Usually I think of email as existing on some secure server, I never thought that backups are kept, maybe in a different medium which is then open to vulnerabilities.

It is frighteningly common to neglect backups when thinking in security. I have seen a couple of examples where the technical aspects of security with good firewalls, good access control to servers and so on were in place, but backup media could still be found laying around for everyone to grab.

Re: But why can't I send people their passwords?

#50

Post by MrTortoise »

weaksauce wrote: post #7
jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

A lot of people use only one password for everywhere... You'd be giving the attacker the keys to the kingdom.

in which case they wouldnt be using the password reset mechanism
Post reply on HN