Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hover.com: we store & email passwords in plaintext for usability

help.hover.com

Post reply on HN
Print view View original

101–110 of 190 posts

Re: Hover.com: we store & email passwords in plaintext for usability

#101

Post by shantanubala »

mishmash wrote: post #60
markbao wrote: post #20

This isn't a microblogging service or pet social network. A domain registrar is storing your password in plaintext? Really? Didn't we go over this a thousand times? If I was on Hover (which I considered), I'd transfer my domains immediately. Moving to a plaintext password system to get fewer support requests is like removing the door from your house so you don't have to keep fumbling for the key.

After some positive research, I just purchased two domains from Hover. This is unacceptable however and I will be moving them away. What registrar would anyone say is the most security focused and/or government resistant? Maybe it should be a 2011 AskHN?

I absolutely love NearlyFreeSpeech.net for domain registration (and also cheap hosting).

I wouldn't say they're security focused, but they allow you to be totally anonymous in your registration, and have a policy of hosting anything that isn't illegal.

Re: Hover.com: we store & email passwords in plaintext for usability

#102

Post by freejack »

bluedanieru wrote: post #97
freejack wrote: post #88

Earlier quoted context omitted.

"why would your team not opt for things that ARE vetted as being secure, trusted, open, and have widespread adoption?" It was a classic case of letting product management opinion over-ride engineering implications. Namely, on behalf of customer service, I went to bat - hard - with the engineers, to give our CSRs a completely effective way to handle inbound password requests in cases where customers no longer had acce…

Hover customer here. Please don't do this again.

Absolutely.

Re: Hover.com: we store & email passwords in plaintext for usability

#103

Post by freejack »

PonyGumbo wrote: post #64

FYI - Hover is a front end for Tucows / OpenSRS, which also store passwords in plain text.

Nope, this issue is uniquely ours and has nothing to do with OpenSRS. I usually try not to speak for them, but I can say authoritatively that this simply isn't the case.

Re: Hover.com: we store & email passwords in plaintext for usability

#104

Post by 8ig8 »

freejack wrote: post #83

tl;dr: guy from hover, mea culpa, new code on the way. I thought it might help to provide some further deets on that blog post. I don't think we're making a case there, or providing an excuse - it certainly wasn't my intent to try and convince anyone of anything when I wrote that, but rather, it was an exercise to explain where we were (with that and other development projects) and where we were going. We've gone bac…

Thanks for taking the time to respond. At a minimum, it's good to know that you're a HN reader.

I've got 100+ business domains at GoDaddy. I've had a todo to move these somewhere for a while now and Hover is (was?) my top target. Coincidently, about a week ago I opened a Hover account and registered my first domain there.

Hover got my attention because you seemed to be the anti-GoDaddy. Now I may re-evaluate my options. Hopefully security may get a re-look from you guys by the time I get to that pesky todo on my list.

BTW: I'd love some kind of corporate level account for customers with my level of domains. I'm small potatoes for some of the other corporate domain registrars. Thanks.

Re: Hover.com: we store & email passwords in plaintext for usability

#106

Post by tptacek »

Dylan16807 wrote: post #82
sbierwagen wrote: post #66

Earlier quoted context omitted.

You appear to not understand how password hashing works. A well designed hashing function is one-way, it cannot practically be reversed. With a large salt, even very weak passwords ("cat") cannot be reversed. https://secure.wikimedia.org/wikipedia/en/wiki/Password_hash...

Salts only protect against rainbow tables. If you want to stop brute forcing you need a very slow hash like bcrypt. And you'll still be able to brute force "cat" in under a day.

Not only that, but the size of the "salt" has nothing to do with how long it takes to brute force a password. We should stop saying "salt" and start saying "randomizer" so at least people understand what that thing is doing; I think everyone understands intuitively that a hash can be "randomized enough" so that further randomization isn't a win.

Re: Hover.com: we store & email passwords in plaintext for usability

#107

Post by dsl »

xorglorb wrote: post #15
geuis wrote: post #8

I've considered using Hover and switching away from Godaddy, particularly since Hover is recommended frequently on the TWiT network. That thought has instantly evaporated. You absolutely cannot store passwords in plain text. There is no level of security you can wrap around the database that will ever be 100%. It only takes one mistake for everything to get exposed. To try and reason that there is a trade off between…

DreamHost also stores passwords in a recoverable fashion, FYI.

I dropped DreamHost after a week when I called up about an issue and the customer service person wanted me to verify my identity by telling him my password.

I explained that I didn't trust him to know my password (assuming he was just typing it into a box), and he said "well its right here in front of me, im just making sure it matches."

Re: Hover.com: we store & email passwords in plaintext for usability

#108

Post by makmanalp »

Cushman wrote: post #90
mmatants wrote: post #87

Earlier quoted context omitted.

Companies like Hover have a user/password scenario unlike e.g. an email provider: users only visit their site one/two times a year (to renew a domain or whatever). So I wonder if they should instead allow "authentication-by-email". Basically, make it work just like current reset emails (with an embedded randomized link that allows access), but prevent the link from expiring. Obviously that suggestion has a lot of hol…

I love this idea. 90% of the time when I use a forgot password link, I'm really trying to auth-by-email. I'm not sure how it would work for reusable links, since that becomes auth-by-URL, which seems significantly less secure— maybe putting HTTP auth in the url would be less likely to be logged at any point?

Isn't this basically the same thing as e-mailing yourself your password?

Re: Hover.com: we store & email passwords in plaintext for usability

#109

Post by freejack »

8ig8 wrote: post #104
freejack wrote: post #83

tl;dr: guy from hover, mea culpa, new code on the way. I thought it might help to provide some further deets on that blog post. I don't think we're making a case there, or providing an excuse - it certainly wasn't my intent to try and convince anyone of anything when I wrote that, but rather, it was an exercise to explain where we were (with that and other development projects) and where we were going. We've gone bac…

Thanks for taking the time to respond. At a minimum, it's good to know that you're a HN reader. I've got 100+ business domains at GoDaddy. I've had a todo to move these somewhere for a while now and Hover is (was?) my top target. Coincidently, about a week ago I opened a Hover account and registered my first domain there. Hover got my attention because you seemed to be the anti-GoDaddy. Now I may re-evaluate my optio…

Thanks for the note. We're lining up to knock this out quickly. Drop me a note to ross@hover.com if you like and i can fire you an update when we update password security and the rest of the related tools. We can set you up with a corporate level account of course, just let me know if/when you are ready.

Re: Hover.com: we store & email passwords in plaintext for usability

#110

Post by 8ig8 »

freejack wrote: post #109
8ig8 wrote: post #104

Earlier quoted context omitted.

Thanks for taking the time to respond. At a minimum, it's good to know that you're a HN reader. I've got 100+ business domains at GoDaddy. I've had a todo to move these somewhere for a while now and Hover is (was?) my top target. Coincidently, about a week ago I opened a Hover account and registered my first domain there. Hover got my attention because you seemed to be the anti-GoDaddy. Now I may re-evaluate my optio…

Thanks for the note. We're lining up to knock this out quickly. Drop me a note to ross@hover.com if you like and i can fire you an update when we update password security and the rest of the related tools. We can set you up with a corporate level account of course, just let me know if/when you are ready.

Thanks, Ross. I'll drop you a line. I appreciate the offer.
Post reply on HN