Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…
UK government's password checker sends plaintext password in the URL over HTTP
21–30 of 117 posts
Re: UK government's password checker sends plaintext password in the URL over HTTP
#22Wow, their advice is terrible too: "86% Exceptional" http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
Re: UK government's password checker sends plaintext password in the URL over HTTP
#23http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
I wouldn't trust this site at all with actual passwords.
Re: UK government's password checker sends plaintext password in the URL over HTTP
#24'The form you submitted contained the following errors Missing Data.(DIFFERENT_IP) Return to Previous Page'
I used your password checker here:
http://www.getsafeonline.org/themes/passwrdcheck/index.html
I notice that it has set the form field to hide my password as I type it, that there are two lock symbols next to the password box, and that the box is surrounded by a metallic looking image.
These factors would probably lead one to believe that you were treating my password with care, ensuring that it would only be relayed to yourselves and no-one else would be able to read it.
As an untrusting person, I typed something which is not one of my passwords into the box, just to see what would happen. When I submitted the form, my password was transmitted in clear text over the Internet, where it could be read by anyone who happened to be in a position to sniff traffic. This includes my office network!
For a site named 'Get safe online', this seems like the most incredible irony. I will be spreading the word that this site is utterly unsafe to visit, as it is unlikely that I have co-incidentally found the single problem.
I notice you advise people that a password 'like' 'SP1D3Rm@n' is secure. This is patently false as such a password is very simple to crack.
Again, this one issue I found, after choosing a single page to test, gives me a complete lack in confidence in the advice of the site. I will also be telling people not to heed advice found here.
Please get some real expert advice on security as the advice you are giving to others, and the problem[s] with your site are likely to cause real problems for people.
Re: UK government's password checker sends plaintext password in the URL over HTTP
#25Wow, their advice is terrible too: "86% Exceptional" http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
XKCDs correct horse battery staple earns merely 40% ("Warning: Your passwords are weak and your digital life is at risk!") http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
Re: UK government's password checker sends plaintext password in the URL over HTTP
#26(Never enter your real password into a password checker In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use. They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.
Then they follow it up with "Why not get your family, friends and workmates to test their passwords too?"
And the placeholder in the input field is "Enter your password".
Re: UK government's password checker sends plaintext password in the URL over HTTP
#27Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…
https://www.cyberstreetwise.com is the website UK government used to get people to send them their passwords.
Re: UK government's password checker sends plaintext password in the URL over HTTP
#28Re: UK government's password checker sends plaintext password in the URL over HTTP
#29Re: UK government's password checker sends plaintext password in the URL over HTTP
#30My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.
Not sure how this works, but if I were writing something that checks "goodness" of passwords, I'd want to check it against a large, sorted list of like the 100 million most common passwords (since almost anyone attackers would start with a dictionary attack, and 10-100 million passwords is decently quick to run against a weak key derivation function). Such a database would be huge, so you'd prefer to do that server-s…