Hover.com: we store & email passwords in plaintext for usability • Hacker News Board

Re: Hover.com: we store & email passwords in plaintext for usability

#11

Post by HaloZero » Mon, Jul 04, 2011, 6:39 PM UTC

ori_b wrote: post #6

JohnsonB wrote: post #4

Couldn't they at least encrypt it, and store the key on a separate file? *edit: I just want to be clear, I don't actually think encryption would a sufficient replacement for a good hashing function, the question was just pointing out how bad this decision by Hover was; not only do they decide to make the password recoverable, but they don't even take whatever meager opportunities there are to make it at least somewha…

What good would that do? If an attacker gets in, they can get the key just as easily as they can get the database.

But if you encrypt it with a key, then SQL injection attacks can't collect passwords as easily. You need to hack in and get the actual key to decrypt.

Re: Hover.com: we store & email passwords in plaintext for usability

#12

Post by scottkrager » Mon, Jul 04, 2011, 6:41 PM UTC

geuis wrote: post #8

I've considered using Hover and switching away from Godaddy, particularly since Hover is recommended frequently on the TWiT network. That thought has instantly evaporated. You absolutely cannot store passwords in plain text. There is no level of security you can wrap around the database that will ever be 100%. It only takes one mistake for everything to get exposed. To try and reason that there is a trade off between…

One word: sendgrid

Re: Hover.com: we store & email passwords in plaintext for usability

#13

Post by politician » Mon, Jul 04, 2011, 6:42 PM UTC

scottkrager wrote: post #2

At least they make a case for it. Security isn't just how you store passwords.

Personally, I've decided to take the position that password security is the "canary in the coalmine" of a business's awareness about security concerns. The degree to which they aren't protecting user passwords correctly likely predicts the degree to which they aren't aware of SQL injection or XSS vulnerabilities.

Re: Hover.com: we store & email passwords in plaintext for usability

#14

Post by reitzensteinm » Mon, Jul 04, 2011, 6:43 PM UTC

scottkrager wrote: post #2

At least they make a case for it. Security isn't just how you store passwords.

They are sacrificing the security of their customers for business reasons (usability will increase retention).

If they get hacked, if/when they send out a disclosure they'll just say that personal information may have been leaked.

Sure, they've made their case for it, but it's only slightly less disconcerting than if they didn't know what a hash is.

Actually, it's probably worse, because at least someone that doesn't know about hashing could be educated - these guys have shown that they put profit above protecting their customers.

Re: Hover.com: we store & email passwords in plaintext for usability

#15

Post by xorglorb » Mon, Jul 04, 2011, 6:45 PM UTC

geuis wrote: post #8

I've considered using Hover and switching away from Godaddy, particularly since Hover is recommended frequently on the TWiT network. That thought has instantly evaporated. You absolutely cannot store passwords in plain text. There is no level of security you can wrap around the database that will ever be 100%. It only takes one mistake for everything to get exposed. To try and reason that there is a trade off between…

DreamHost also stores passwords in a recoverable fashion, FYI.

Re: Hover.com: we store & email passwords in plaintext for usability

#16

Post by edgardcastro » Mon, Jul 04, 2011, 6:46 PM UTC

I knew bcrypt/scrypt was just a hype! ;)

Re: Hover.com: we store & email passwords in plaintext for usability

#17

Post by scottkrager » Mon, Jul 04, 2011, 6:46 PM UTC

politician wrote: post #13

scottkrager wrote: post #2

At least they make a case for it. Security isn't just how you store passwords.

Personally, I've decided to take the position that password security is the "canary in the coalmine" of a business's awareness about security concerns. The degree to which they aren't protecting user passwords correctly likely predicts the degree to which they aren't aware of SQL injection or XSS vulnerabilities.

That's a very good point.

Re: Hover.com: we store & email passwords in plaintext for usability

#18

Post by shennyg » Mon, Jul 04, 2011, 6:47 PM UTC

xorglorb wrote: post #15

geuis wrote: post #8

I've considered using Hover and switching away from Godaddy, particularly since Hover is recommended frequently on the TWiT network. That thought has instantly evaporated. You absolutely cannot store passwords in plain text. There is no level of security you can wrap around the database that will ever be 100%. It only takes one mistake for everything to get exposed. To try and reason that there is a trade off between…

DreamHost also stores passwords in a recoverable fashion, FYI.

Which ones? the panel?

Re: Hover.com: we store & email passwords in plaintext for usability

#19

Post by xorglorb » Mon, Jul 04, 2011, 6:49 PM UTC

shennyg wrote: post #18

xorglorb wrote: post #15

Earlier quoted context omitted.

DreamHost also stores passwords in a recoverable fashion, FYI.

Which ones? the panel?

Yes. They will email your password to you if you click the "forgot my password" link.

Re: Hover.com: we store & email passwords in plaintext for usability

#20

Post by markbao » Mon, Jul 04, 2011, 6:51 PM UTC

This isn't a microblogging service or pet social network. A domain registrar is storing your password in plaintext? Really? Didn't we go over this a thousand times?

If I was on Hover (which I considered), I'd transfer my domains immediately. Moving to a plaintext password system to get fewer support requests is like removing the door from your house so you don't have to keep fumbling for the key.