Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

McGill will double your password if you don’t do it first

mcgill.ca

Post reply on HN
Print view View original

31–40 of 152 posts

Re: McGill will double your password if you don’t do it first

#31

Post by temuze »

rspeer wrote: post #9

The fact that they're able to "double your password" is a bad sign. Here's what this implies to me: * McGill had a database of everyone's password in plaintext at the time of Heartbleed * McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once * Despite this concern, McGill still has a databa…

Theoretically, they could have HAD the password in plaintext, then doubled it, salted it and hashed it in the new DB.

Re: McGill will double your password if you don’t do it first

#32

Post by Aldo_MX »

ChristianBundy wrote: post #17
Cerium wrote: post #13

No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first half of the input correctly match the hash, but the first half the input should match the second half.

How is that helpful for mitigating security issues though?

Unless you are being specifically targeted (ie. the attacker knows that you have to repeat the password twice), you mitigate the easiest possible attack: user/password combination from a stolen database.

Although I suppose this was done to force the users to change their password.

Re: McGill will double your password if you don’t do it first

#33

Post by steve-howard »

zackify wrote: post #28
primitivesuave wrote: post #22

Earlier quoted context omitted.

It's quite easy to come up with a scheme to manipulate the password client-side. I'd assume an organization with any technology credence whatsoever knows not to store unencrypted passwords by now.

take a look at pearson's blackboard, they store passwords in plain text.

I'd really rather not. Blackboard has a reputation among students and faculty alike for being nigh-impossible to understand.

Re: McGill will double your password if you don’t do it first

#34

Post by Dylan16807 »

rspeer wrote: post #9

The fact that they're able to "double your password" is a bad sign. Here's what this implies to me: * McGill had a database of everyone's password in plaintext at the time of Heartbleed * McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once * Despite this concern, McGill still has a databa…

They can put a flag on the database and check that the cleartext you send them when logging in is doubled before hashing half of it.

I can't count how many times I've seen something that could easily be done at login time and people conclude that the service must be storing plaintext or multiple hashes.

This isn't even a direct security measure in the first place. This is to annoy people into updating their passwords.

Re: McGill will double your password if you don’t do it first

#36

Post by smlacy »

Although highly suspect and troubling, this does not necessarily require that they have all users original passwords stored in plain text. If they had originally used a hashing function that obeyed the following:

Hash(pw) + Hash(pw) := Hash(pw + pw)

(NB: Where '+' above is really just a stand-in for any pair of combining functions, not necessarily arithmetic addition or string concatenation.)

But, I agree with many others here that the likelihood of stored plain text passwords is very high.

Re: McGill will double your password if you don’t do it first

#37

Post by username »

zackify wrote: post #28
primitivesuave wrote: post #22

Earlier quoted context omitted.

It's quite easy to come up with a scheme to manipulate the password client-side. I'd assume an organization with any technology credence whatsoever knows not to store unencrypted passwords by now.

take a look at pearson's blackboard, they store passwords in plain text.

Pearson does this in all of their services.

Re: McGill will double your password if you don’t do it first

#38

Post by jszymborski »

primitivesuave wrote: post #22
rspeer wrote: post #9

The fact that they're able to "double your password" is a bad sign. Here's what this implies to me: * McGill had a database of everyone's password in plaintext at the time of Heartbleed * McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once * Despite this concern, McGill still has a databa…

It's quite easy to come up with a scheme to manipulate the password client-side. I'd assume an organization with any technology credence whatsoever knows not to store unencrypted passwords by now.

The problem is that these passwords are used on everything from printer services to cisco vpn access to federated network ("eduroam") where "client-side" isn't somethin McGill controls.

McGill does some beautiful IT admin stuff. And then it does some scary-ass shit like this.

Re: McGill will double your password if you don’t do it first

#39

Post by tempestn »

ChristianBundy wrote: post #17
Cerium wrote: post #13

No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first half of the input correctly match the hash, but the first half the input should match the second half.

How is that helpful for mitigating security issues though?

Because it annoys the holdout users into changing their passwords.

Re: McGill will double your password if you don’t do it first

#40

Post by [deleted] »

Nogwater wrote: post #19
rspeer wrote: post #9

The fact that they're able to "double your password" is a bad sign. Here's what this implies to me: * McGill had a database of everyone's password in plaintext at the time of Heartbleed * McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once * Despite this concern, McGill still has a databa…

I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your password. They could just update the application logic to check that your password is of the form if your last change date is before X. Then to check the password, they just take the first half and check that against the hash.

[deleted]
Post reply on HN