Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

But why can't I send people their passwords?

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 181 posts

Re: But why can't I send people their passwords?

#171

Post by pmjordan »

bartwe wrote: post #150
pmjordan wrote: post #19

Earlier quoted context omitted.

If someone hacks into your email account, they can just trawl through the email archive and harvest passwords from past password reminder emails. With a temporary reset token, they have to initiate a password reset request, which you should notice: (a) you might notice the email if you have e.g. push notifications enabled, or if the attacker doesn't delete it quickly enough, and (b) your real password will suddenly s…

You're current password shouldn't stop working because otherwise that can be used as a denial of service without otherwise compromising the security of either the user or the site if the email address is known.

Obviously it shouldn't stop working straight away, but presumably an attacker would actually use the password reset code, at which point they would set your password to something else, which you would notice.

Re: But why can't I send people their passwords?

#172

Post by personZ »

snth wrote: post #146
personZ wrote: post #140

Earlier quoted context omitted.

and you seem to be saying If you have given an untrusted third party site the credentials that you use on other sites, that meat is complete fetid. It is now deadly. This whole discussion is arguing about what to do once the meat is rotten, rather than daring to maybe discuss not selling rotten meat in the first place. When a site gets compromised and the passwords may get stolen (because of weak or no cryptography),…

> As an aside, I marvel that some defensive imbecile keeps coming deep into this thread to downvote me. Comments like this are the "rotting meat" of Hacker News. Please just leave them out of your posts.

Ignorance and the defense of the same is the rotting meat of Hacker News. This whole discussion is absolutely rife with it.

Re: But why can't I send people their passwords?

#173

Post by TallGuyShort »

omervk wrote: post #126
TallGuyShort wrote: post #121

This is really good, and I applaud your efforts in that site in general! My one suggestion would be to explain the term "representation" a little better to non-devs so they understand why the secure technique is secure. I like to use the term "one-way encryption" so that it's clearly not some simple derivation of a password, but a mathematical process with proven difficulty and uncertainty when reversing.

I thought of my mom and dad reading this and what they would best understand. I'm worried using something like "one-way encryption" would have their eyes glaze over :)

Probably. What about something to the effect of just adding, "The representation is created by shuffling and encrypting the password over and over so there's no way to reverse the process" or something like that?

Re: But why can't I send people their passwords?

#174

Post by shortstuffsushi »

sameerds wrote: post #166
shortstuffsushi wrote: post #165

Earlier quoted context omitted.

I don't mean to exclusively blame the victim, but you can only go so far to protect a user if they won't protect themselves. I haven't read through the suggestions on the site, but it seems like this should be the primary -- as a user, you need to take care of your own safety and not rely on good development practices to protect you.

You just blamed the victim. Again.

My comment implied that I was. I said it's not exclusively their fault, implying that it is partially their fault. In the case of reusing the same password between sites, the blame for reusing that password does lay with the victim. That's not to say that sites should be sending the password to them -- that's still a horrible idea. A site cannot prevent a user from reusing the same password, though.

I guess what I mean to say is that you need to play both sides of it. As a developer, you should be doing all you can to prevent anything from leaking user info. As a user, you should do anything you can to prevent leaks from one site affecting other parts of your internet identity. Isn't that the entire goal of the FAQ this guy is putting together?

Re: But why can't I send people their passwords?

#175

Post by [deleted] »

jere wrote: post #5

> 7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Also, users might have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). Would y…

[deleted]

Re: But why can't I send people their passwords?

#176

Post by lotyrin »

Frozenlock wrote: post #168

I don't see how sending a reset link is secure. Wouldn't anyone intercepting the email be able to use the reset link themselves and gain access to the account?

Reset links can at least time out, passwords generally don't.

Providers should send you notifications when you reset your password, they generally don't when you just log-in like normal.

Re: But why can't I send people their passwords?

#177

Post by tptacek »

The "Don't Use Bcrypt" article isn't a good source; the headline message you've taken from it isn't accurate. In fact, bcrypt is significantly better than PBKDF2, and PBKDF2 (with normal parameters) is probably the "least best" of the mainstream options for password hashing.

By citing an inside-baseball controversy, you're making it harder for developers to do a good job storing passwords, because you're creating the impression that developers need to carefully choose which password hashing algorithm they use, and be careful about making the wrong choice.

In reality, what developers need to be careful about is choosing a password hashing algorithm, and not a general-purpose cryptographic hash. The right message is that PBKDF2, bcrypt, and scrypt are all fine options.

So my feedback is that your developer FAQ is trying to be a little too clever for its own good. I'd revise it.

Re: But why can't I send people their passwords?

#179

Post by mreiland »

personZ wrote: post #66
weaksauce wrote: post #7

Earlier quoted context omitted.

A lot of people use only one password for everywhere... You'd be giving the attacker the keys to the kingdom.

You'd be giving the attacker the keys to the kingdom. No, the people who use a common password gave out the keys. There is simply no excusing it. The apologism for it has to stop. NEVER use the same password across multiple services. If one service gets compromised, the extent of their culpability is their own service. Anyone whose password exposes other things was the cause of their own demise. EDIT: I will not back…

I re-use passwords, but only for things I don't care about.

Not everything is critical, if someone gets into my HN account, for example, I'm not too fussed about it. It sucks, but whatever.

If someone gets into my bank account... different story.

It isn't that people re-use passwords that's the issue, it's that they do it for shit that actually matters.

Post reply on HN