Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hover.com: we store & email passwords in plaintext for usability

help.hover.com

Post reply on HN
Print view View original

161–170 of 190 posts

Re: Hover.com: we store & email passwords in plaintext for usability

#161

Post by freejack »

gnaritas wrote: post #121
freejack wrote: post #88

Earlier quoted context omitted.

"why would your team not opt for things that ARE vetted as being secure, trusted, open, and have widespread adoption?" It was a classic case of letting product management opinion over-ride engineering implications. Namely, on behalf of customer service, I went to bat - hard - with the engineers, to give our CSRs a completely effective way to handle inbound password requests in cases where customers no longer had acce…

I'd hope in the future, when your engineers throw a fit, you take some time to learn why you're wrong up front rather than overruling them. This was a huge mistake on your part and it's now public; you have a limited amount of time to fix it before you're hacked.

There was a bit more to it than that, but on this specific point, lesson well learned. I rushed this instead of looking for an agreement - as they say, measure twice, cut once.

Re: Hover.com: we store & email passwords in plaintext for usability

#162

Post by freejack »

GigabyteCoin wrote: post #131
freejack wrote: post #88

Earlier quoted context omitted.

"why would your team not opt for things that ARE vetted as being secure, trusted, open, and have widespread adoption?" It was a classic case of letting product management opinion over-ride engineering implications. Namely, on behalf of customer service, I went to bat - hard - with the engineers, to give our CSRs a completely effective way to handle inbound password requests in cases where customers no longer had acce…

What's to stop me (possible hover CSR, co-worker, whatever) from simply reading a high-profile customer's password and transferring all their million dollar domain names to me later that night when I get home from work? I have a pretty good memory. I bet I could remember 5-10 simple passwords and email addresses without writing anything down. Chances are the idiots use the same password for their email anyways. Muaha…

Industry secret - at the most basic level, registrar and registry staffers don't need access to a customer account to manipulate a domain name. We've implemented tons of controls to manage who can do what, etc. but relying on customer passwords to safeguard domain names from internal tampering isn't really a great tactic.

Re: Hover.com: we store & email passwords in plaintext for usability

#163

Post by freejack »

balloot wrote: post #148
freejack wrote: post #83

tl;dr: guy from hover, mea culpa, new code on the way. I thought it might help to provide some further deets on that blog post. I don't think we're making a case there, or providing an excuse - it certainly wasn't my intent to try and convince anyone of anything when I wrote that, but rather, it was an exercise to explain where we were (with that and other development projects) and where we were going. We've gone bac…

A couple things here: 1) I simply don't believe your claim that the number of stolen emails is so high that sending password retrieval links via email is unfeasible. This isn't a new problem that is just faced by hover.com, and most solve it without resorting to plain text passwords. 2) You aren't taking a wide enough view here. By storing and sending plaintext passwords you are doing more than making someone's hover…

I don't disagree with most of what you are saying, and would add that good security practice is a shared responsibility. Sharing passwords across sites is the user equivalent of storing passwords in plain text. i.e. It might be secure enough until its not.

Re: Hover.com: we store & email passwords in plaintext for usability

#164

Post by alinajaf »

robtoo wrote: post #151
alexmuller wrote: post #140

Earlier quoted context omitted.

Not exactly a list, but: http://plaintextoffenders.com/

As I'm sure you noticed, many of those sites are putting the password in the welcome/verification email, but this is not the same as actually storing it as plaintext in their database. The thing to look out for is your old password in password reset emails, not welcome emails. And another one to add to the list: my brother's small business uses British Telecom for email hosting. Their control panel stores the passwor…

> The thing to look out for is your old password in password reset emails, not welcome emails.

What's the use of encrypting your passwords when you're broadcasting them to every mail server between your and your customer?

Re: Hover.com: we store & email passwords in plaintext for usability

#165

Post by 8ig8 »

ohashi wrote: post #127
8ig8 wrote: post #118

Earlier quoted context omitted.

Thanks. I took a look at Fabulous.com. I recall checking them out once before based on a HN recommendation. They're out of my league. When I say I have 100+ domains, I mean like around 105 (give or take). I'm not really a 'domain professional.' For the reference: > To be eligible for a Fabulous account we > require that you meet at least one of the > following: > Domain portfolio must generate US$750+ per month > Tra…

I know what they quote on their page. If you're really interested contact me from my profile and I will see if I can help you out.

Thanks, Kevin. I'll take another look at Fabulous. I quickly wrote them off.

(Man, I wish I owned the Fabulous.com domain. My business cards would be bedazzled.)

Re: Hover.com: we store & email passwords in plaintext for usability

#168

Post by boot13 »

masterzora wrote: post #113
xorglorb wrote: post #15

Earlier quoted context omitted.

DreamHost also stores passwords in a recoverable fashion, FYI.

Disclaimer: I am an ex-DH intern and my information is only as good as August 2010, but it is likely to still be accurate. At the very least, DH does not store passwords as plaintext, but it's only very marginally better than that. Passwords are stored using a custom-rolled symmetric encryption algorithm created by... I never found out if it was a founder or just one of the earlier admins, but that doesn't really cha…

I can confirm that they're still doing this. I recently had a conversation with their support staff about it and I don't think they'll be changing it any time soon. I like Dreamhost, but if they don't change this I'll probably bail.

Re: Hover.com: we store & email passwords in plaintext for usability

#169

Post by ydm »

SkyMarshal wrote: post #134
freejack wrote: post #83

tl;dr: guy from hover, mea culpa, new code on the way. I thought it might help to provide some further deets on that blog post. I don't think we're making a case there, or providing an excuse - it certainly wasn't my intent to try and convince anyone of anything when I wrote that, but rather, it was an exercise to explain where we were (with that and other development projects) and where we were going. We've gone bac…

Fwiw, let me share some of the less predictable consequences of what could happen if your pwd database is hacked, and why it's important to use bcrypt, PBKDF2, or scrypt to secure your users passwords. ( http://codahale.com/how-to-safely-store-a-password/ ) I was one of the folks whose email and password were compromised in the recent MtGox.com bitcoin exchange attack. Until then I had been using a three-tier passwor…

I agree with you wholeheartedly. Unfortunately, there will always be a few services that will store passwords in plain text.

Would unique email addresses for each service have helped your situation at all?

For example:

Facebook email: uniqueemail1@gmail.com (forwards to your real email) Facebook password: password1

Hover email: uniqueemail2@gmail.com (forwards to your real email) Hover password: password1

Bank email: uniqueemail3@gmail.com (forwards to your real email) Bank password: password1

If any of those services get hacked (and the passwords are stored in plain text) then there's nothing connecting those accounts to each other since the email addresses are all different.

It's the system I use (along with 3 tiers of passwords not just 'password1' as used in the above example).

Re: Hover.com: we store & email passwords in plaintext for usability

#170

Post by PonyGumbo »

freejack wrote: post #103
PonyGumbo wrote: post #64

FYI - Hover is a front end for Tucows / OpenSRS, which also store passwords in plain text.

Nope, this issue is uniquely ours and has nothing to do with OpenSRS. I usually try not to speak for them, but I can say authoritatively that this simply isn't the case.

OpenSRS emails both username and password to the administrative address on file when a customer completes the "forgot your password" routine on reseller storefronts.
Post reply on HN