Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pandora doesn't hash their passwords

plus.google.com

Post reply on HN
Print view View original

101–110 of 160 posts

Re: Pandora doesn't hash their passwords

#101

Post by revelation »

cbsmith wrote: post #71

There may be a security issue here, but I think there is a distinct possibility that it certainly isn't what people think. Pandora needn't store the password on their servers. Just posted this to the Google+ thread: Okay, I just did a simple test of what happens when I change my Pandora password. There is a record of HTML local storage keyed on "jStorage" which appears to be a giant JSON blob. A specific attribute wh…

And why exactly would they go to all this trouble for displaying the correct number of stars in a password field?

Unless, of course, they use this local data for actual security purposes. In which case this is a huge gaping security hole and I wouldn't trust them with a bit of my data.

Re: Pandora doesn't hash their passwords

#102

Post by cbsmith »

aiiane wrote: post #95
cbsmith wrote: post #94

Earlier quoted context omitted.

#1: It might be a problem, but it is also a clear indication to even a naive user that if they leave their browser logged in to Pandora, their account be compromised. #2: Right. So there is a possibility that some day in the future, if you are really careful and check your TLS certificate every time you do something with your password, Pandora will be exposing you to a huge gaping hole, that you would otherwise only…

The gist of your argument appears to be "you'll never be perfectly secure, so there's no reason to try to improve things incrementally".

No, the gist of my argument is that this isn't an additional security risk. Worrying about this is tantamount to looking at the lock on your front door, which itself is made out of plywood with a hollow center, and of course is attached to a house with several standard windows, not to mention sliding glass doors, one of which you tend to leave open all the time --and then screaming, "OH MY GOD I CAN'T BELIEVE THEY DID THIS! THIS LOCK COULD BE CRACKED BY A GUY WITH A HAND SAW IN 5 MINUTES!!! THEY REALLY SHOULD GET A STRONGER LOCK!"

Re: Pandora doesn't hash their passwords

#104

Post by nilved »

dangrossman wrote: post #34
seanconaty wrote: post #26

This is very bad from a security standpoint but you'd be surprised how many websites do this. Here is a list http://plaintextoffenders.com/ I would have expected Pandora to know better. Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. The websites that do it right cannot tell you your password (because they don't know it); they can only let you reset…

> Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. No it doesn't. They could be using the strongest encryption known to man and still show you your password or e-mail it to you by simply decrypting it when needed.

or by sending you the email while it's still stored in memory from you signing up

Re: Pandora doesn't hash their passwords

#105

Post by mikeash »

pbreit wrote: post #63
mikeash wrote: post #46

Earlier quoted context omitted.

Encrypted passwords are functionally equivalent to "stored in plain text".

Intuitively that makes no sense so I'm wondering if someone could explain?

Basically, encryption allows you to expose data to the public without disclosing its contents by keeping another, usually much smaller, piece of data private (the key).

In this case, your passwords should be private to begin with. If they are accidentally exposed, it's likely that the key is also exposed, so you gain little. You can't hide the key because you need to use it to e.g. authenticate people logging in.

It's a bit like a business keeping all of their cash in a safe to protect it, but because they have so many people who need to access the safe, they basically have to write the combination on the door.

Hashing passwords is like a sealed black box where you can go up to it and say, "Bob is here and claims his password is X, is that right?" and the box will give you a yes or no, but it's extremely difficult to crack it open and get at the actual passwords. Much more secure than the safe, which really does little in this case.

Re: Pandora doesn't hash their passwords

#106

Post by mrb »

cbsmith wrote: post #93
mrb wrote: post #91

Earlier quoted context omitted.

There appears to be a real security issue that every one missed in this thread: the password does not appear to be encrypted, but merely obfuscated , using the same obfuscation technique as the one used to obfuscate the randomly generated JSON attribute names. Which means that even after logging out of pandora, the password would remain in the HTML local storage, and could be de-obfuscated, and log back into pandora.…

The attribute name is obfuscated, which makes it harder to programmatically find the password (presuming it is under a different name for each account). The password itself is stored encrypted. Here's the thing: if someone has this kind of access to your browser, wouldn't it be simpler to install a simple browser plug-in that scrapes off any data typed in to a password input field?

The attribute name may be obfuscated, but it appears to be always the same (at least in my browsers): bc673ea54a2b7153aaafbf178e9b0892e1f2e56be5aaa5a7

Re: Pandora doesn't hash their passwords

#107

Post by cbsmith »

ecaron wrote: post #45
jmediast wrote: post #36

Thoughts? https://news.ycombinator.com/item?id=3798597

Proof that 99% of generating good conversation on HN comes from a well-phrased title.

Actually, proof that a provocative but false headline on HN will still get the sheep to vote up your article. ;-)

Re: Pandora doesn't hash their passwords

#108

Post by pearkes »

jlgreco wrote: post #96
peterwwillis wrote: post #88

Earlier quoted context omitted.

Your argument, then, is that Pandora should apply password hashing to keep people from being compromised elsewhere? Assuming they only had two online accounts this might make sense. Assuming every single one of their accounts, all the same credentials, had perfectly implemented password hashing, this might make sense. But that is bullshit and we both know it. There will always be a bad implementation, or a mistake, o…

> Assuming every single one of their accounts, all the same credentials, had perfectly implemented password hashing, this might make sense. It is Pandora's ethical duty to do their part. And it is the ethical duty of other sites to do their part. It is the user's duty to do their part. Any one of these parties slacking does not excuse slacking on the part of others. This is not a perfect world. We all know there are…

This is exactly what I meant when I said: "everything within their control to protect a user".

Re: Pandora doesn't hash their passwords

#109

Post by ciupicri »

dredmorbius wrote: post #51
nilved wrote: post #31

Why are people still relying on developers to implement proper password security instead of using unique passwords?

Why are we still relying on passwords rather than a secure PKI key-based access method in which unique keys are generated for each remote system accessed?

There's the possibility of authenticating with a SSL certificate. Fedora uses this method for a web service.

There is also OpenID, but not many sites are using it unfortunately.

Re: Pandora doesn't hash their passwords

#110

Post by NateDad »

Evbn wrote: post #100
pbreit wrote: post #64

Earlier quoted context omitted.

They could two-way encrypt which seems safer to me than plain text but some disagree (I'm not sure why).

Only if the keys are well controlled.

If the keys were well controlled, you wouldn't have to worry about plaintext passwords in the DB either. But passwords get leaked all the time. If the key is sitting somewhere locally, when they break in to steal the passwords, they can steal the key too. There's no way the program can reverse the password without having the key pretty easily accessible.
Post reply on HN