Why you shoud never use your favorite password on News.YCombinator.com
1–10 of 136 posts
Re: Why you shoud never use your favorite password on News.YCombinator.com
#2Um, pg? Can we get a fix on this, please?
Re: Why you shoud never use your favorite password on News.YCombinator.com
#3Of course the password is in plaintext. Logins are done via HTTP, not via HTTPS. You know, there isn't that little yellow lock thingy in the bottom left corner of the window?
Is this really news to anyone?
Re: Why you shoud never use your favorite password on News.YCombinator.com
#4[deleted]
Re: Why you shoud never use your favorite password on News.YCombinator.com
#5Indeed. md5 hash on password + random token is industry standard now. It would be good to have that here.
Re: Why you shoud never use your favorite password on News.YCombinator.com
#6Of course the password is in plaintext. Logins are done via HTTP, not via HTTPS. You know, there isn't that little yellow lock thingy in the bottom left corner of the window? Is this really news to anyone?
There are still ways to add a little extra security for non-ssl logins. One way is by hashing the password via javascript with a random number provided by the server before posting it via HTTP. (see http://pajhome.org.uk/crypt/md5/auth.html)
Re: Why you shoud never use your favorite password on News.YCombinator.com
#7You can do this with most sites.
I don't know how much more load SSL would cause but a good solution would be to just use HTTPS for the login and then redirect back to the HTTP, like Twitter does.
Re: Why you shoud never use your favorite password on News.YCombinator.com
#8Of course the password is in plaintext. Logins are done via HTTP, not via HTTPS. You know, there isn't that little yellow lock thingy in the bottom left corner of the window? Is this really news to anyone?
Agreed--not news.
However, this is a common security problem that doesn't get enough attention. I would guess the easiest way to crack anyone's bank account is to create some flimsy website that requires users to register. Chances are good they will use the same user/password combo that they would use for their bank. Or you could crack one of the thousands of existing login websites to get passwords, which would be a lot easier than hacking a bank's database.
If I'm writing a minor login website, I'll assign a random password to users. I don't want to be liable if one of my servers is hacked and someone's bank account gets accessed because of it.
What do people out there generally do about this problem? Do you take a similar approach or make additional efforts to secure your servers?
Re: Why you shoud never use your favorite password on News.YCombinator.com
#9Of course the password is in plaintext. Logins are done via HTTP, not via HTTPS. You know, there isn't that little yellow lock thingy in the bottom left corner of the window? Is this really news to anyone?
Agreed--not news. However, this is a common security problem that doesn't get enough attention. I would guess the easiest way to crack anyone's bank account is to create some flimsy website that requires users to register. Chances are good they will use the same user/password combo that they would use for their bank. Or you could crack one of the thousands of existing login websites to get passwords, which would be a…
I don't want to be liable if one of my servers is hacked and someone's bank account gets accessed because of it.
Don't store user passwords in plaintext.
Re: Why you shoud never use your favorite password on News.YCombinator.com
#10I wish I could say I was surprised, but I'm not. If you look at websites that don't involve transferring money, you'll find a lot of passwords transferred in plain text. It should not be so, but it is.
I use the same password here that I use on other sites which aren't very critical and which wouldn't really do me any harm if my account were cracked.