Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

But why can't I send people their passwords?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 181 posts

Re: But why can't I send people their passwords?

#61

Post by throwaway48372 »

kenny_r wrote: post #48
weaksauce wrote: post #7

Earlier quoted context omitted.

A lot of people use only one password for everywhere... You'd be giving the attacker the keys to the kingdom.

Which is still true if you don't know their passwords but if you have their email. You can reset the passwords for just about every conceivable account they have.

Back when I was a teen I used to fraud people and scam ebay sellers through paypal. If I were to somehow gain access to an email (via RAT, Cookie hijacking), one of the easiest ways to recover a password was to look for a provider that sent out a plaintext password. Chances are the unfortunate target used the same password on every site (or if it was lowercase and alpha, that password + "1").

That would grant continued access to the email, and other sites that took protection a little more seriously like Paypal and Bank Logins (you can't reset a Paypal password with just an email, and if you could, such an action would make Paypal fraud detection software go nuts).

Re: But why can't I send people their passwords?

#62

Post by weaksauce »

MrTortoise wrote: post #50
weaksauce wrote: post #7

Earlier quoted context omitted.

A lot of people use only one password for everywhere... You'd be giving the attacker the keys to the kingdom.

in which case they wouldnt be using the password reset mechanism

One scenario of many: The attacker has brief access to the email of the victim. Hacker resets the password and now has the password for all accounts tied to that email address.

Re: But why can't I send people their passwords?

#64

Post by iopq »

gpvos wrote: post #32
powatom wrote: post #27

Earlier quoted context omitted.

True - but you can add an additional layer of security to the password reset request if this is a concern, such as personal questions.

Using personal questions for security is the worst thing ever. Whenever I encounter them, I paste the output of "dd if=/dev/random bs=1k count=1 |uuencode x" into the field.

If you can use Facebook and Linkedin to hack someone's bank account you know that this is a bad idea. What's that, the make of your first car and the name of your first boss are actually freely posted on the Internet? You don't say.

Re: But why can't I send people their passwords?

#65

Post by eldelshell »

This is something that came to mind while reading the comments: Why should me, the owner/developer of some service, care if somehow your password is stolen/guessed by any mean?

I'm not saying we shouldn't take care of our users, but how's our fault that their email is hacked? We can't do anything to protect against this and placing more complex policies would hurt users who have enough common sense to this properly and expecting the same from us.

P.S. I'm in no way saying to to ditch all security procedures we can, but to one point security is about trust, and if you can't trust your users to keep their freaking passwords and email accounts secured, then hell with them. Put it in plain text in your TOS and be done with it.

Re: But why can't I send people their passwords?

#66

Post by personZ »

weaksauce wrote: post #7
jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

A lot of people use only one password for everywhere... You'd be giving the attacker the keys to the kingdom.

You'd be giving the attacker the keys to the kingdom.

No, the people who use a common password gave out the keys.

There is simply no excusing it. The apologism for it has to stop. NEVER use the same password across multiple services. If one service gets compromised, the extent of their culpability is their own service. Anyone whose password exposes other things was the cause of their own demise.

EDIT: I will not back down from this (and you shouldn't feel too ashamed for reusing passwords and falling in the above buckets, desperately hitting down arrow. Just correct your mistakes). It is utter idiocy to constantly defend the habit of shared passwords, when people give it to services of zero trust, and with unknown habits and practices. When some service of no consequence stores your password in plaintext, that is them being dumb. If you then complain because it's the same password used elsewhere, that is you being dumb.

Re: But why can't I send people their passwords?

#67

Post by larrybrid »

krambs wrote: post #45
jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

You shouldn't send the password because you shouldn't be storing the password. Worries about email security, etc. are secondary.

Yeah, I was surprised to see that this bit wasn't mentioned anywhere. If you are emailing someone their password in plaintext, that means you know their password in plaintext -- which you should not.

Re: But why can't I send people their passwords?

#68

Post by 6d0debc071 »

powatom wrote: post #27
jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

True - but you can add an additional layer of security to the password reset request if this is a concern, such as personal questions.

I can never remember the answers to those damned things.

Re: But why can't I send people their passwords?

#69

Post by unreal37 »

personZ wrote: post #66
weaksauce wrote: post #7

Earlier quoted context omitted.

A lot of people use only one password for everywhere... You'd be giving the attacker the keys to the kingdom.

You'd be giving the attacker the keys to the kingdom. No, the people who use a common password gave out the keys. There is simply no excusing it. The apologism for it has to stop. NEVER use the same password across multiple services. If one service gets compromised, the extent of their culpability is their own service. Anyone whose password exposes other things was the cause of their own demise. EDIT: I will not back…

I'm not going to presume to know anything about you, but as soon as your system interfaces with human beings, your system needs to adapt to human nature. You can't say "there's no excusing it" and "cause of their own demise". Humans act as humans tend to do - why should the security of your system rely on humans changing their natural behavior?

Re: But why can't I send people their passwords?

#70

Post by herge »

mechanical_fish wrote: post #53
x86_64Ubuntu wrote: post #47

Earlier quoted context omitted.

I have never thought of that, ever. I'm not being sarcastic. Usually I think of email as existing on some secure server, I never thought that backups are kept, maybe in a different medium which is then open to vulnerabilities.

This is why, for example, Amazon S3 has a little checkbox on each bucket to encrypt the contents of the bucket. At first glance this might seem a little silly. Amazon has the key. (You don't even get to see the key yourself.) So Amazon can read all your data. And every time you read from the bucket it's automatically decrypted, so the encryption won't protect you from anyone who has somehow achieved permission to rea…

I'd even make the effort of encrypting yourself any data you want to protect that you send to s3. GnuPG is not that hard to use with RSA.
Post reply on HN