11–20 of 136 posts
Of course the password is in plaintext. Logins are done via HTTP, not via HTTPS. You know, there isn't that little yellow lock thingy in the bottom left corner of the window? Is this really news to anyone?
I'm surprised that the crowd here would even blink when hearing this. cperciva is right with his rhetorical question: this shouldn't be news to anyone, especially hackers.
Of course the password is in plaintext. Logins are done via HTTP, not via HTTPS. You know, there isn't that little yellow lock thingy in the bottom left corner of the window? Is this really news to anyone?
2. Never use the same login for 2 websites
The fact this has been upvoted to top position is more worrying than any security worries.
Indeed. md5 hash on password + random token is industry standard now. It would be good to have that here.
If you use the salt that you're using in your database as the token to concatenate instead of a random token, an attacker will only be able to use the data they capture to login on your site as opposed to all the sites the user has used the same password on. That sounds like it could work, but it might have security implications I haven't thought through yet.
Of course the password is in plaintext. Logins are done via HTTP, not via HTTPS. You know, there isn't that little yellow lock thingy in the bottom left corner of the window? Is this really news to anyone?
Seriously, this isn't your bank account... what if someone breaks in and steals all your karma! I'm surprised that the crowd here would even blink when hearing this. cperciva is right with his rhetorical question: this shouldn't be news to anyone, especially hackers.
1. Go read up on HTTP vs HTTPS 2. Never use the same login for 2 websites The fact this has been upvoted to top position is more worrying than any security worries.
Indeed. md5 hash on password + random token is industry standard now. It would be good to have that here.
Maybe I'm not thinking this completely through here, but to do that, wouldn't you have to store your users' passwords in plaintext to verify the hashes? That's just replacing one problem with another. If you use the salt that you're using in your database as the token to concatenate instead of a random token, an attacker will only be able to use the data they capture to login on your site as opposed to all the sites…
This protects against both replay and rainbow attacks.
Earlier quoted context omitted.
Maybe I'm not thinking this completely through here, but to do that, wouldn't you have to store your users' passwords in plaintext to verify the hashes? That's just replacing one problem with another. If you use the salt that you're using in your database as the token to concatenate instead of a random token, an attacker will only be able to use the data they capture to login on your site as opposed to all the sites…
No. The server stores salted hashes, and serves the salt and a nonce as part of the login page. The client then submits hash(nonce + hash(salt + pass)). This protects against both replay and rainbow attacks.
Of course the password is in plaintext. Logins are done via HTTP, not via HTTPS. You know, there isn't that little yellow lock thingy in the bottom left corner of the window? Is this really news to anyone?
users have million sites where they have logins and passwords - they can't have million password - even pattern can be guessed. If the risk is to low it's ok to not use HTTPS. But some blurring would give positive results - as like some hackers commented already.
1. Go read up on HTTP vs HTTPS 2. Never use the same login for 2 websites The fact this has been upvoted to top position is more worrying than any security worries.
Look at the title of post - i'm not showing you HTTP is plaintext based - I said exactly "Never use the same login for 2 websites"
I call BS to that. Fair enough for websites that use your banking or credit card information, but for the rest? I don't think so.
For irrelevant sites such as Hacker News, Reddit, whatever other minor web 2 site you can think of, you should ALWAYS use the same password. Why fart around with a ridiculous number of passwords for websites that are nothing more than minor daily distractions?