Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

But why can't I send people their passwords?

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 181 posts

Re: But why can't I send people their passwords?

#161

Post by cincinnatus »

eldelshell wrote: post #65

This is something that came to mind while reading the comments: Why should me, the owner/developer of some service, care if somehow your password is stolen/guessed by any mean? I'm not saying we shouldn't take care of our users, but how's our fault that their email is hacked? We can't do anything to protect against this and placing more complex policies would hurt users who have enough common sense to this properly a…

And when your server is inevitably compromised and your users passwords stolen from you due to your lack of dillgence and used to compromise logins on other services, what then? Still their problem?

Re: But why can't I send people their passwords?

#162

Post by chris_mahan »

weaksauce wrote: post #152
chris_mahan wrote: post #148

Earlier quoted context omitted.

I'm a software developer, but I'm done trying to remember passwords for every single site. What do I do? I just don't use the sites. I've restricted, and continue to pare down, the sites that I use on the internet. It's the truth. I do keep my amazon.com account, so I can order paper and cardboard books the local bookstores don't carry, and read them on the sofa at my house, next to my floor lamp.

there is a few solutions. use a password manager like lastpass or keepass or something like that. it generates passes for you and you don't have to remember them.(bonus: it logs you in automatically if you go to the vault and click login) use throwaway passwords for one off services and just use the password reset feature when you want to use it.

Except, well, I use several computers, plus smart phone.

Re: But why can't I send people their passwords?

#163

Post by pornel »

The dev FAQ perpetuates a common misconception about "broken" MD5 and SHA1.

MD5 and SHA1 are bad for password hashing indeed, but that's because they're fast, not because they have known collisions.

Collision attack has nothing to do with password security. For passwords the relevant attack is the preimage attack, which is a different thing and there are no feasible preimage attacks against these hashes (yet, of course).

Re: But why can't I send people their passwords?

#164

Post by pornel »

The dev FAQ perpetuates a common misconception about "broken" MD5 and SHA1.

MD5 and SHA1 are bad for password hashing indeed, but that's because they're fast, not because they have known collisions.

Collision attack has nothing to do with password security. For passwords the relevant attack is the preimage attack, which is a different thing and there are no feasible preimage attacks against these hashes (yet, of course).

Re: But why can't I send people their passwords?

#165

Post by shortstuffsushi »

cincinnatus wrote: post #159
shortstuffsushi wrote: post #156

Earlier quoted context omitted.

Does none of that responsibility lay with you for using the same password across all sites? What if, on the other side of the spectrum, their site was compromised, and your password was retrieved that way? You'd be vulnerable in the same way.

Blaming the victim. Yes of course, but no, not reasonable to expect users to be smart about passwords in general.

I don't mean to exclusively blame the victim, but you can only go so far to protect a user if they won't protect themselves. I haven't read through the suggestions on the site, but it seems like this should be the primary -- as a user, you need to take care of your own safety and not rely on good development practices to protect you.

Re: But why can't I send people their passwords?

#166

Post by sameerds »

shortstuffsushi wrote: post #165
cincinnatus wrote: post #159

Earlier quoted context omitted.

Blaming the victim. Yes of course, but no, not reasonable to expect users to be smart about passwords in general.

I don't mean to exclusively blame the victim, but you can only go so far to protect a user if they won't protect themselves. I haven't read through the suggestions on the site, but it seems like this should be the primary -- as a user, you need to take care of your own safety and not rely on good development practices to protect you.

You just blamed the victim. Again.

Re: But why can't I send people their passwords?

#167

Post by weaksauce »

chris_mahan wrote: post #162
weaksauce wrote: post #152

Earlier quoted context omitted.

there is a few solutions. use a password manager like lastpass or keepass or something like that. it generates passes for you and you don't have to remember them.(bonus: it logs you in automatically if you go to the vault and click login) use throwaway passwords for one off services and just use the password reset feature when you want to use it.

Except, well, I use several computers, plus smart phone.

lastpass works on all of them.

Re: But why can't I send people their passwords?

#169

Post by omervk »

mcovey wrote: post #158

instead of "shittysecurity.com" you might want to use something like "example.com", for one because some people will see it as inflammatory, and because some eager devs might be presenting this to bosses who will take offense, and based on that emotion, decide the whole thing is bullshit.

Good point.

Re: But why can't I send people their passwords?

#170

Post by Flenser »

omervk wrote: post #115
peterwwillis wrote: post #41

Question 8 on the dev faq should emphasize using multiple layers when doing a password reset, partially to avoid the inherent problems with e-mail security (especially as your last bastion of security). Security questions, browser heuristics, login attempts, out-of-band communication (SMS confirmation code, secondary e-mail account, etc). Question 9 should include a sub-section .3 which explains that if you unrestric…

Re: Q8. Security questions are an anti-pattern and the rest are outside our mandate. I do not claim to have written the penultimate guide to password security :) Re: Q9. Again, that's a great pattern, but is not a requirement to not be on our list. This is linked to from the non-dev FAQ, but I'll make sure to add a section about 2FA to the dev section. Thanks!

Re: Q9, you could at least put in a link to zxcvb[1] so that they can be aware that it's an issue and that there's libraries for implementing it.

[1] https://tech.dropbox.com/2012/04/zxcvbn-realistic-password-s...

Post reply on HN