Is a plaintext (heh) list of all the sites available?
Soon :)
But why can't I send people their passwords?
111–120 of 181 posts
Re: But why can't I send people their passwords?
#112For [11]: I think it makes sense to also highlight other approaches than OpenID such as https://passwordless.net which is a sort of way in the middle (disclaimer: I'm the author)
Added. Thanks :)
Re: But why can't I send people their passwords?
#113You've got a typo in the link in dev FAQ #7. Main-In-The-Middle
Fixed. Thanks :)
Re: But why can't I send people their passwords?
#114Re: But why can't I send people their passwords?
#115Question 8 on the dev faq should emphasize using multiple layers when doing a password reset, partially to avoid the inherent problems with e-mail security (especially as your last bastion of security). Security questions, browser heuristics, login attempts, out-of-band communication (SMS confirmation code, secondary e-mail account, etc). Question 9 should include a sub-section .3 which explains that if you unrestric…
Re: Q8. Security questions are an anti-pattern and the rest are outside our mandate. I do not claim to have written the penultimate guide to password security :)
Re: Q9. Again, that's a great pattern, but is not a requirement to not be on our list.
This is linked to from the non-dev FAQ, but I'll make sure to add a section about 2FA to the dev section.
Thanks!
Re: But why can't I send people their passwords?
#116Let's say I register for a Web Hosting solution. And then I receive a email containing a username built upon the information I gave them and a generated password to access the cPanel. Is this offending? Let's also pretend that I have to change this password upon my first login.
Yes, because you might not be the first to use that password.
Re: But why can't I send people their passwords?
#117I've been trying to learn the best practices on password "storage" and verification lately. I thought this was a really good step-by-step technical breakdown of the right way to hash passwords (I have no opinion/knowledge of the hashing algorithms in the article, but I've found a lot of other positive mentions of PBKDF2, bcrypt, and scrypt)
http://nakedsecurity.sophos.com/2013/11/20/serious-security-...
Re: But why can't I send people their passwords?
#118I've been trying to learn the best practices on password "storage" and verification lately. I thought this was a really good step-by-step technical breakdown of the right way to hash passwords (I have no opinion/knowledge of the hashing algorithms in the article, but I've found a lot of other positive mentions of PBKDF2, bcrypt, and scrypt) http://nakedsecurity.sophos.com/2013/11/20/serious-security-...
I'd appreciate it if you could post this as a comment to the Dev FAQ page :)
Re: But why can't I send people their passwords?
#119Earlier quoted context omitted.
I agree with you - using the same password in multiple places is a dumb thing to do. However, you seem to be totally missing the point made in the previous post, namely that people are, on the whole, pretty dumb. The vast majority do not share your understanding of computers and security and hence see no real issue, although this is very very slowly changing. I disagree entirely with your statement that: "This isn't…
However, you seem to be totally missing the point made in the previous post, namely that people are, on the whole, pretty dumb. The whole discussion revolves around a fundamental principal that is simply broken to begin with, akin to "How to try not to die when you eat rotting meat". Don't eat rotting meat. Use a fridge. Etc. In the case of passwords- -Use a shared authentication platform -or on sign-up implore that…
I love this analogy. But, to continue it a little further, the article and discussion are about "preventing meat from rotting during transportation," and you seem to be saying, "screw it, the customer should know not to buy the meat if it's gone bad." Going even further: most countries have consumer protection laws that prevent things like selling rotting meat.
Re: But why can't I send people their passwords?
#120> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…
Most of the other points, while correct miss the big issue: the server should not store the password in case they themselves get hacked. If an attacker gains access to one persons email then he gets 1 password. If he gains access to a server then he can potentially gain access to thousands of passwords. Therefore, having plaintext passwords makes you a target for attackers.