Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

But why can't I send people their passwords?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 181 posts

Re: But why can't I send people their passwords?

#101

Post by omervk »

eldelshell wrote: post #65

This is something that came to mind while reading the comments: Why should me, the owner/developer of some service, care if somehow your password is stolen/guessed by any mean? I'm not saying we shouldn't take care of our users, but how's our fault that their email is hacked? We can't do anything to protect against this and placing more complex policies would hurt users who have enough common sense to this properly a…

Because then users would lose faith in your service? Also, your service can then be abused. Think about a hacker ramping up charges on a credit card, only to have fraud detection activated and you losing money (and getting worse rates in the process).

Re: But why can't I send people their passwords?

#102

Post by omervk »

ten7 wrote: post #60

Thanks for doing this, it is greatly appreciated. The list of offenders with screenshots is nice, but what would be really useful is a table that is sortable and filterable so that people (i.e. me) can find out if any of our vendors are offenders. Also, a JSON API would be slick too. Just ideas.

Soon :)

Re: But why can't I send people their passwords?

#103

Post by omervk »

philk10 wrote: post #51

http://plaintextoffenders.com/faq/non-devs "We explain in everything our About page." - doesn't read right, maybe 'we explain everything on our About page"? "your post was deleted with prejudice" ?? needs rephrasing

1. You're right. Fixed.

2. Rephrased.

Re: But why can't I send people their passwords?

#104

Post by omervk »

stonemetal wrote: post #88
furyg3 wrote: post #33

Earlier quoted context omitted.

If someone wants to use a 250 character truly random password with crazy characters, let them do it. If they used a long password with an excellent mix of upper-case, lower-case, and special characters, but no numbers, it's a good password, take it. I had a password for a credit card account which could not be more than 8 characters and couldn't contain 'special' characters or punctuation. This was probably done to e…

Have fun running bcrypt on 100TB of /dev/urandom. Insanely large password limit? Sure sounds like good business to me. No password length limit? Sounds like a DOS attack waiting to happen.

What would you suggest as a sane upper bound?

Re: But why can't I send people their passwords?

#105

Post by personZ »

PwdRsch wrote: post #98
personZ wrote: post #71

Earlier quoted context omitted.

You can't say "there's no excusing it" and "cause of their own demise". Yes, you absolutely can and should say that. This isn't human nature, but is simply accepted and defended behavior that gets caught out again, and again, and again. I have absolutely no doubt that many visitors to HN are guilty of this, and instead of confronting the reality of their insecurity, pretend it's someone else's fault. Each time some r…

It is complete idiocy to use passwords across services. Utter insanity. It is the worst possible practice imaginable, and is never, ever excusable. It's one thing to argue for improving people's password practices, but please don't pretend that there's no reason for their behavior. The vast majority of people who share passwords between sites experience no repercussions from their choice. And choosing not to create a…

The vast majority of people who share passwords between sites experience no repercussions from their choice.

More accurately, they have no awareness of the reprecussions from their choice. Yet endlessly on HN we hear stories of mysterious iTunes access, Steam takeovers, even Amazon AWS account compromises. It is no big mystery when this happens given this common, grossly insecure behavior.

But ultimately they are still going to weigh their perception of the risk and benefits to make their own decision.

I absolutely agree, absolutely and completely, but think that the risk portion is hugely underestimated. Among people who should know better there is a tendency to under-estimate what is an enormous, worst-possible-exploit problem. No one ever talks about education. No one wastes time trying to help users enjoy better behavior.

Instead we argue about whether some site operated by an unknown number of people of unknown trustworthiness, on a platform that might have been exploited and owned by hacker groups for years, properly hashed our password after we passed the keys to all services through plaintext. It is insanity.

Re: But why can't I send people their passwords?

#106

Post by deathcakes »

personZ wrote: post #89
deathcakes wrote: post #85

Earlier quoted context omitted.

I agree with you - using the same password in multiple places is a dumb thing to do. However, you seem to be totally missing the point made in the previous post, namely that people are, on the whole, pretty dumb. The vast majority do not share your understanding of computers and security and hence see no real issue, although this is very very slowly changing. I disagree entirely with your statement that: "This isn't…

However, you seem to be totally missing the point made in the previous post, namely that people are, on the whole, pretty dumb. The whole discussion revolves around a fundamental principal that is simply broken to begin with, akin to "How to try not to die when you eat rotting meat". Don't eat rotting meat. Use a fridge. Etc. In the case of passwords- -Use a shared authentication platform -or on sign-up implore that…

This is a disingenuous analogy - the reason people keep eating rotting meat is because there isn't a usable alternative for the vast majority. Fridges are unknown, to hopelessly overload the metaphor, to the masses and those that are aware of them are reluctant to shell out for the cost.

The problem needs to be solved at a more fundamental level - people should not have to be forced to perform a function that they are demonstrably bad at. Mitigation strategies like having randomised passwords and storing them in a shared authentication platform are only masking the reality that passwords are a bad way of performing authentication.

Not that I'm clever enough to come up with an alternative mind you, and not to suggest that I don't agree with your premise that using a password in multiple places is a bad idea.

Re: But why can't I send people their passwords?

#107

Post by hackuser »

pmjordan wrote: post #19
jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

If someone hacks into your email account, they can just trawl through the email archive and harvest passwords from past password reminder emails. With a temporary reset token, they have to initiate a password reset request, which you should notice: (a) you might notice the email if you have e.g. push notifications enabled, or if the attacker doesn't delete it quickly enough, and (b) your real password will suddenly s…

And if someone hacks the system administrator's account, they may find everyone's passwords (for systems where the admin sets the pw and emails it).

Re: But why can't I send people their passwords?

#108

Post by omervk »

Grue3 wrote: post #84
blueatlas wrote: post #20

I was a bit surprised by #9.2 - "Don’t put any limitations on the passwords people can use (maximum lengths, disallowing certain characters, etc.)". What's the thinking here?

In fact, very long passwords can be successfully used to DDOS some setups (i.e Django used to have such vulnerability). It's much simpler to put a sane upper limit, like 1024 characters.

Thanks, I used your number, too. :)

Re: But why can't I send people their passwords?

#109

Post by ajanuary »

makmanalp wrote: post #75

Your non-devs FAQ is still not quite informative. You still don't explain to laymen /why/ what the sites are doing is wrong, you just say "You should never see your password". edit: Maybe something along the lines of: > Modern cryptography allows websites to save passwords in a form that is un-decryptable even to the site itself. This works because to check the validity of logins, the unencrypted (plain) version of t…

That's a pretty technical explanation. I think something like this would suffice:

> If the website can pull out your password to show it to you, an attacker can pull out the password to steal it.

As ever, the issue is explaining hashing.

Re: But why can't I send people their passwords?

#110

Post by omervk »

scrollaway wrote: post #22

Can you please look into Persona and recommend that instead of openid connect? It is a much better approach at decentralized authentication.

I have. Please take a look at another comment that explains the issues with it here: https://news.ycombinator.com/item?id=7943695
Post reply on HN