Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hover.com: we store & email passwords in plaintext for usability

help.hover.com

Post reply on HN
Print view View original

111–120 of 190 posts

Re: Hover.com: we store & email passwords in plaintext for usability

#111

Post by keeperofdakeys »

freejack wrote: post #88
jat850 wrote: post #85

Earlier quoted context omitted.

Quoting you here: "I'd also like to point out that the scope of the risk isn't trivial. For example, URL-based password resets are only as secure as the mailbox they are sent to. i.e. a significant number of domains are stolen and threatened to be stolen through email account exploits (re-registering previously used addresses, forwarding attacks, etc.) This is made even more complex when a domain expires and email on…

"why would your team not opt for things that ARE vetted as being secure, trusted, open, and have widespread adoption?" It was a classic case of letting product management opinion over-ride engineering implications. Namely, on behalf of customer service, I went to bat - hard - with the engineers, to give our CSRs a completely effective way to handle inbound password requests in cases where customers no longer had acce…

"...to give our CSRs a completely effective way to handle inbound password requests in cases where customers no longer had access to their email account."

I personally don't see how having the plain-text passwords help in the case where the person owning the account doesn't have access to their email account. Since they don't have access, you can't exactly email them their password.

Re: Hover.com: we store & email passwords in plaintext for usability

#112

Post by ohashi »

8ig8 wrote: post #104
freejack wrote: post #83

tl;dr: guy from hover, mea culpa, new code on the way. I thought it might help to provide some further deets on that blog post. I don't think we're making a case there, or providing an excuse - it certainly wasn't my intent to try and convince anyone of anything when I wrote that, but rather, it was an exercise to explain where we were (with that and other development projects) and where we were going. We've gone bac…

Thanks for taking the time to respond. At a minimum, it's good to know that you're a HN reader. I've got 100+ business domains at GoDaddy. I've had a todo to move these somewhere for a while now and Hover is (was?) my top target. Coincidently, about a week ago I opened a Hover account and registered my first domain there. Hover got my attention because you seemed to be the anti-GoDaddy. Now I may re-evaluate my optio…

With 100 domains you may want to try contacting Fabulous.com. They live up to their name. You're a bit low on the required names but worth a shot. If you get in, you'll be saving a lot more money and the service is the best in the business.

Re: Hover.com: we store & email passwords in plaintext for usability

#113

Post by masterzora »

xorglorb wrote: post #15
geuis wrote: post #8

I've considered using Hover and switching away from Godaddy, particularly since Hover is recommended frequently on the TWiT network. That thought has instantly evaporated. You absolutely cannot store passwords in plain text. There is no level of security you can wrap around the database that will ever be 100%. It only takes one mistake for everything to get exposed. To try and reason that there is a trade off between…

DreamHost also stores passwords in a recoverable fashion, FYI.

Disclaimer: I am an ex-DH intern and my information is only as good as August 2010, but it is likely to still be accurate.

At the very least, DH does not store passwords as plaintext, but it's only very marginally better than that. Passwords are stored using a custom-rolled symmetric encryption algorithm created by... I never found out if it was a founder or just one of the earlier admins, but that doesn't really change much. For what it's worth, I never ran across the key to this, which is at least somewhat good in terms of security, but it's quite possible that this is true only because I never actually went searching for it, especially given that all of the devs and dev interns have root on most of the systems.

Re: Hover.com: we store & email passwords in plaintext for usability

#114

Post by clobber »

mishmash wrote: post #60
markbao wrote: post #20

This isn't a microblogging service or pet social network. A domain registrar is storing your password in plaintext? Really? Didn't we go over this a thousand times? If I was on Hover (which I considered), I'd transfer my domains immediately. Moving to a plaintext password system to get fewer support requests is like removing the door from your house so you don't have to keep fumbling for the key.

After some positive research, I just purchased two domains from Hover. This is unacceptable however and I will be moving them away. What registrar would anyone say is the most security focused and/or government resistant? Maybe it should be a 2011 AskHN?

Moniker

Re: Hover.com: we store & email passwords in plaintext for usability

#115

Post by Joakal »

Cushman wrote: post #90
mmatants wrote: post #87

Earlier quoted context omitted.

Companies like Hover have a user/password scenario unlike e.g. an email provider: users only visit their site one/two times a year (to renew a domain or whatever). So I wonder if they should instead allow "authentication-by-email". Basically, make it work just like current reset emails (with an embedded randomized link that allows access), but prevent the link from expiring. Obviously that suggestion has a lot of hol…

I love this idea. 90% of the time when I use a forgot password link, I'm really trying to auth-by-email. I'm not sure how it would work for reusable links, since that becomes auth-by-URL, which seems significantly less secure— maybe putting HTTP auth in the url would be less likely to be logged at any point?

Auth emails are like plaintext passwords. Best combo would be your public key stored on their server. Any future requests, they send you the PGP'd email.

Re: Hover.com: we store & email passwords in plaintext for usability

#116

Post by freejack »

keeperofdakeys wrote: post #111
freejack wrote: post #88

Earlier quoted context omitted.

"why would your team not opt for things that ARE vetted as being secure, trusted, open, and have widespread adoption?" It was a classic case of letting product management opinion over-ride engineering implications. Namely, on behalf of customer service, I went to bat - hard - with the engineers, to give our CSRs a completely effective way to handle inbound password requests in cases where customers no longer had acce…

"...to give our CSRs a completely effective way to handle inbound password requests in cases where customers no longer had access to their email account." I personally don't see how having the plain-text passwords help in the case where the person owning the account doesn't have access to their email account. Since they don't have access, you can't exactly email them their password.

Most of our customer inquiries come in over the phone.

Re: Hover.com: we store & email passwords in plaintext for usability

#117

Post by woodall »

makmanalp wrote: post #108
Cushman wrote: post #90

Earlier quoted context omitted.

I love this idea. 90% of the time when I use a forgot password link, I'm really trying to auth-by-email. I'm not sure how it would work for reusable links, since that becomes auth-by-URL, which seems significantly less secure— maybe putting HTTP auth in the url would be less likely to be logged at any point?

Isn't this basically the same thing as e-mailing yourself your password?

Not if the link can time-out or expire after X [days, minutes, seconds, ect]. When I think of emailing my self the password, I think of storing it in plain text in my email account. When I think of authentication via email I think of a one time use link that allows me to log into a session.

Re: Hover.com: we store & email passwords in plaintext for usability

#118

Post by 8ig8 »

ohashi wrote: post #112
8ig8 wrote: post #104

Earlier quoted context omitted.

Thanks for taking the time to respond. At a minimum, it's good to know that you're a HN reader. I've got 100+ business domains at GoDaddy. I've had a todo to move these somewhere for a while now and Hover is (was?) my top target. Coincidently, about a week ago I opened a Hover account and registered my first domain there. Hover got my attention because you seemed to be the anti-GoDaddy. Now I may re-evaluate my optio…

With 100 domains you may want to try contacting Fabulous.com. They live up to their name. You're a bit low on the required names but worth a shot. If you get in, you'll be saving a lot more money and the service is the best in the business.

Thanks. I took a look at Fabulous.com. I recall checking them out once before based on a HN recommendation. They're out of my league. When I say I have 100+ domains, I mean like around 105 (give or take). I'm not really a 'domain professional.'

For the reference:

  > To be eligible for a Fabulous account we
  > require that you meet at least one of the
  > following:
  > Domain portfolio must generate US$750+ per month
  > Transfer 750+ domains to Fabulous
Source: https://secure.fabulous.com/signup.htm?formcode[event]=signu...

Edit: Fixed my wacky quote formatting.

Re: Hover.com: we store & email passwords in plaintext for usability

#119

Post by Jach »

Interesting use of emoticons in that section.

I think we've found a suitable candidate for a first-pass Internet Driver's License test. Filling out a few forgot password forms, checking email, checking spam in case it went there, clicking on a link, and changing to a new password that's >= 10 characters and not a dictionary word...

Post reply on HN