Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Boycott websites that send you email with your password in clear text

imsaar.posterous.com

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Boycott websites that send you email with your password in clear text

#21

Post by tedunangst »

tptacek wrote: post #13
edmccaffrey wrote: post #4

> Anybody sending you back your password in clear text is also storing it that way in their database Incredibly ignorant statement. If it's encrypted in a reversible format then it's not cleartext. If it's being sent in a confirmation email, then it could even be stored as a one-way hash: password extracted from the form, inserted into email, hashed and stored (This is what WordPress, for example, does). A case can b…

If the app can "reverse" the encryption, so can an attacker. The case against storing passwords this way is pretty strong.

If the key is embedded in the app and you don't keep the source on the server, reversing the binary (if the attacker even thinks to steal it) is enough of a hassle to deter most people. And maybe the attack only allowed them to copy the database.

It's not foolproof, but for stupid free websites (that's what we're talking about right?), storing encrypted passwords isn't an automatic gimme for the attacker.

Re: Boycott websites that send you email with your password in clear text

#22

Post by vaksel »

imajes wrote: post #15
vaksel wrote: post #14

The key is to just use a different password on every site by employing a special password structure. For example, for HN, you can use: orycPASSWORDy [2 last letters][2 first letters][master password][1 first letter] Good idea to mix and match numbers in the master password for added security. So for HN it can be: orycpassword1y The good thing is that you only need to remember a single password for all your sites, yet…

at this point there's no real reason not to use a random password generator for _every_ site. There are plenty of apps out there for auto login, and / or most browsers will do this for you. Yes, there's some pain syncing with mobile devices but this will go away at some point (modified oauth to validate devices?). Password schemes like this are still inherently breakable; as soon as someone gets your key password the…

until your computer crashes and you find yourself locked out of every site on the internet. No thank you.

+ what do you do when you aren't using your own computer. Want to check your email at work? Nope sorry, gotta provide the 25 digit randomly generated password.

Nothing is unbreakable, if someone wants your password they'll get it. For the password generator case they can just break into your house and steal your computer. Or organize a group of mercenaries to take hostages at AT&T to gain access to your packets....hey we are talking about a nemesis right?

And here is an added bonus...how do you know that random password generator app isn't sending all your passwords to a master file? Whoa, did I just blow your mind?

Different passwords is all you need for protection. That way if the company loses your username/passwords, the bots that will be using that information to check the passwords on other sites, won't get a hit.

Re: Boycott websites that send you email with your password in clear text

#23

Post by tptacek »

tedunangst wrote: post #21
tptacek wrote: post #13

Earlier quoted context omitted.

If the app can "reverse" the encryption, so can an attacker. The case against storing passwords this way is pretty strong.

If the key is embedded in the app and you don't keep the source on the server, reversing the binary (if the attacker even thinks to steal it) is enough of a hassle to deter most people. And maybe the attack only allowed them to copy the database. It's not foolproof, but for stupid free websites (that's what we're talking about right?), storing encrypted passwords isn't an automatic gimme for the attacker.

It's a pernicious myth that passwords on "free" websites don't matter, because no money is changing hands. Most people use the same password for random apps as they do for their email account.

I don't even want to get into the rat-trap of "what kinds" of attackers are stopped by reversably encrypted passwords. There's no kind of attacker that can reverse a properly hashed password, and so that's what you should use.

Re: Boycott websites that send you email with your password in clear text

#24

Post by [deleted] »

imajes wrote: post #15
vaksel wrote: post #14

The key is to just use a different password on every site by employing a special password structure. For example, for HN, you can use: orycPASSWORDy [2 last letters][2 first letters][master password][1 first letter] Good idea to mix and match numbers in the master password for added security. So for HN it can be: orycpassword1y The good thing is that you only need to remember a single password for all your sites, yet…

at this point there's no real reason not to use a random password generator for _every_ site. There are plenty of apps out there for auto login, and / or most browsers will do this for you. Yes, there's some pain syncing with mobile devices but this will go away at some point (modified oauth to validate devices?). Password schemes like this are still inherently breakable; as soon as someone gets your key password the…

[deleted]

Re: Boycott websites that send you email with your password in clear text

#25

Post by imajes »

[deleted] wrote: post #24
imajes wrote: post #15

Earlier quoted context omitted.

at this point there's no real reason not to use a random password generator for _every_ site. There are plenty of apps out there for auto login, and / or most browsers will do this for you. Yes, there's some pain syncing with mobile devices but this will go away at some point (modified oauth to validate devices?). Password schemes like this are still inherently breakable; as soon as someone gets your key password the…

[deleted]

fairly certain you weren't trying to reply to me?

Re: Boycott websites that send you email with your password in clear text

#27

Post by imajes »

vaksel wrote: post #22
imajes wrote: post #15

Earlier quoted context omitted.

at this point there's no real reason not to use a random password generator for _every_ site. There are plenty of apps out there for auto login, and / or most browsers will do this for you. Yes, there's some pain syncing with mobile devices but this will go away at some point (modified oauth to validate devices?). Password schemes like this are still inherently breakable; as soon as someone gets your key password the…

until your computer crashes and you find yourself locked out of every site on the internet. No thank you. + what do you do when you aren't using your own computer. Want to check your email at work? Nope sorry, gotta provide the 25 digit randomly generated password. Nothing is unbreakable, if someone wants your password they'll get it. For the password generator case they can just break into your house and steal your…

So, you made all kinds of awesome points that I went thru before i switched to random passwords...

a. (on not having access to your passwords). iPhone with them helps. (yes, i have to unlock that db with my hashing password). But in reality, I prefer that I can't get access to my email/facebook/whatever without having my machine. If i'm at work, I should be working... but it's the same machine anyhow ;)

b. true about stealing my machine. But again, my passwords are locked by my one key control password (which i don't easily remember either... yay for muscle memory ;)). Yes, it's a SPoF.

c. I clarified with Little Snitch. I don't really care that much. Because you're right: if one company screws you over and unveils your passwords, then having a scenario where people could then log into your email or bank means end of identity and a life of credit hell.

I just think that having a predictable password scheme is about the same as having the same password. If it's easy to guess, then you may as well have the same. IMHO, the only way to guarantee against any problems if one of your passwords is exposed is to go random. :)

Re: Boycott websites that send you email with your password in clear text

#28

Post by colonelxc »

tedunangst wrote: post #21
tptacek wrote: post #13

Earlier quoted context omitted.

If the app can "reverse" the encryption, so can an attacker. The case against storing passwords this way is pretty strong.

If the key is embedded in the app and you don't keep the source on the server, reversing the binary (if the attacker even thinks to steal it) is enough of a hassle to deter most people. And maybe the attack only allowed them to copy the database. It's not foolproof, but for stupid free websites (that's what we're talking about right?), storing encrypted passwords isn't an automatic gimme for the attacker.

Why, oh why, do any websites need to be able to reverse an encrypted password to the plaintext? 99.99% of the time, simply resetting the password to something different is a much better way to go (in the case the user forgets).

I'm sure there are exceptions to this rule, but we shouldn't encourage a design that has the potential to hurt users (if the database + password encryption key are compromised), when the solution (seeded hashing) takes just about the same amount of work (probably less).

Re: Boycott websites that send you email with your password in clear text

#29

Post by carbocation »

imajes wrote: post #18
carbocation wrote: post #9

Earlier quoted context omitted.

I store passwords as a hash in the database, but send it to the user in plaintext when they register. Why? 1. I didn't used to do this, but I got so many requests that I eventually caved. 2. No money changes hands on the site.

Without education, people won't learn. I'm a fan of thoughtful UX but, frankly.. this is an area where caving sucks. Sorry. I'd have spent the time improving my password recovery service.

Hmm. Fair point. Maybe I'll reconsider sooner rather than later.

Re: Boycott websites that send you email with your password in clear text

#30

Post by imsaar »

_cbsz wrote: post #17

I posted a similar screed about iPhone/Twitter apps that send passwords in the clear or with broken encryption a few days ago: [link redacted] Not sure what is difference that made people care about this but not that, but open to enlightenment.

May be it was my 'incredibly ignorant statement' :-) May be it was the title of the post.

Your post looks pretty relevant, related and good. I have voted it up if that helps.

Post reply on HN