Hover.com: we store & email passwords in plaintext for usability • Hacker News Board

Re: Hover.com: we store & email passwords in plaintext for usability

#31

Post by raganwald » Mon, Jul 04, 2011, 7:29 PM UTC

Blaming Hover.com is shooting the messenger. The problem here is that this is what customers want. As long as you ask Hover to compete for business in a race to the bottom of the "convenience" barrel, you are going to have this problem. If Hover stop doing this, someone else wil come along and take Hover's business by sending plaintext passwords around in email.

So.

You either live with it and do your business with someone who has decided to offer a "premium" service and has a business model catering to educated customers,

Or:

You look for the government to regulate the marketplace as a public good. We do this with things like the safety of cars, we've decided that the marketplace cannot be left to decide this for itself. We attempt to do this with things like the content and handling of food, we've decided that the marketplace cannot be left to decide this for itself.

Perhaps the security of your account is not important enough to impose regulation. Perhaps it is. But as long as it's left up to the marketplace, the existence of companies like Hover is inevitable, and waggling our fingers at them is not going to do anything except make us feel smarter than the average bear.

Re: Hover.com: we store & email passwords in plaintext for usability

#32

Post by krashidov » Mon, Jul 04, 2011, 7:30 PM UTC

I guess these guys have taken a fondness to the Anti Security movement...

On a more serious note though its dangerous enough to store passwords in plain-text, announcing it to the world is a bit stupid.

Re: Hover.com: we store & email passwords in plaintext for usability

#33

Post by dexen » Mon, Jul 04, 2011, 7:33 PM UTC

Please correct me if I'm wrong, but... storing password hashes (actually key derived from password) is only meant to secure up password re-use. If there is any other reason, please disregard the text below and just correct me ;-)

Isn't password re-use a social problem rather than technical one? Perhaps we ought to use a different -- social -- measure to prevent password reuse. Throwing technical solutions onto social problems doesn't seem to work.

Proposal: let's store all passwords plaintext and force users not to re-use passwords, ever. Let's have every password-using service and system make available hashes (derived keys, to be exact, bcrypt() style) of the passwords completely public; when a person tries to create a new account, the service would check a good bunch other services against password hash matches. If the new password (used upon registration) hashes to the same value as on any checked service, the user is rejected and publicly shamed for endangering the service and his account. More checks cound be performed after the registration in background, to lessen the delay on registration.

That's it. Social problem, social solution.

Re: Hover.com: we store & email passwords in plaintext for usability

#34

Post by pittsburgh » Mon, Jul 04, 2011, 7:33 PM UTC

In the past few weeks, we’ve discussed a new approach that we think will strike a better balance by giving our customers greater control over password management and at the same time ensuring the basic security of those passwords. I’m personally very pleased that our approach will have appeal to customers that are concerned about password security and customers that appreciate the benefits of great usability (and for customers who are concerned about both, blow their socks off

Could anybody find the blog post they are referring to that explains their balance between simplicity and security? I was unable to. However, it does appear that they still send plaintext passwords via email: https://www.hover.com/send_password

If you're looking to switch registrars, I can't say enough good things about http://gandi.net. Their motto is literally "no bullshit" and it's the reason I switched to them a few years ago. They aren't the cheapest option, but their UI is very simple and aesthetically pleasing, they offer free DNS hosting, they don't clutter their checkout pages with any ads or ridiculous upsells, they don't kill elephants for fun ( http://mashable.com/2011/04/01/bob-parsons-elephant-story/ ), and they don't email your password in plaintext. There are very few companies I'm willing to rave about, but Gandi is one of them.

Re: Hover.com: we store & email passwords in plaintext for usability

#35

Post by AlexandrB » Mon, Jul 04, 2011, 7:34 PM UTC

scottkrager wrote: post #2

At least they make a case for it. Security isn't just how you store passwords.

Their rationale doesn't make sense to me. If they wanted the same recovery process, they could just send you a new, generated password in a recovery email instead of keeping your actual password in plaintext.

Re: Hover.com: we store & email passwords in plaintext for usability

#36

Post by shapeshed » Mon, Jul 04, 2011, 7:36 PM UTC

SQL injection anyone? I hope the app is secure

Re: Hover.com: we store & email passwords in plaintext for usability

#37

Post by eam » Mon, Jul 04, 2011, 7:39 PM UTC

>Very quickly, our customer service team was inundated by requests from people that weren’t receiving the email, found the process confusing, and a myriad of other related requests.

Wait a second, so customers wont receive an email with a password reset link, yet they'll receive an email with a plain text password? I guess it's possible, but interesting.

Re: Hover.com: we store & email passwords in plaintext for usability

#38

Post by frossie » Mon, Jul 04, 2011, 7:39 PM UTC

raganwald wrote: post #31

Blaming Hover.com is shooting the messenger. The problem here is that this is what customers want . As long as you ask Hover to compete for business in a race to the bottom of the "convenience" barrel, you are going to have this problem. If Hover stop doing this, someone else wil come along and take Hover's business by sending plaintext passwords around in email. So. You either live with it and do your business with…

The problem here is that this is what customers want

And I want a pony, they gonna give me that too?

A business transaction is a negotiation between seller and client. You don't always have to give them what they want, and if you are good enough, people won't leave you over that one thing.

If you are going to only use sites that store your password in plaintext because it is so damn convenient, you are not going to have much Internet left.

Re: Hover.com: we store & email passwords in plaintext for usability

#39

Post by kogir » Mon, Jul 04, 2011, 7:40 PM UTC

dexen wrote: post #33

Please correct me if I'm wrong, but... storing password hashes (actually key derived from password) is only meant to secure up password re-use. If there is any other reason, please disregard the text below and just correct me ;-) Isn't password re-use a social problem rather than technical one? Perhaps we ought to use a different -- social -- measure to prevent password reuse. Throwing technical solutions onto social…

You're wrong. I use hashes so that if somehow the hashes and salts leak the attacker can't now log in as any user with no additional effort. While it's true that a hash compromise typically means you're owned, not having plaintext passwords available still makes further exploitation slightly harder. For instance, read only SQL injection that leaks hashes won't let the attacker write anything.

Re: Hover.com: we store & email passwords in plaintext for usability

#40

Post by raganwald » Mon, Jul 04, 2011, 7:43 PM UTC

frossie wrote: post #38

raganwald wrote: post #31

Blaming Hover.com is shooting the messenger. The problem here is that this is what customers want . As long as you ask Hover to compete for business in a race to the bottom of the "convenience" barrel, you are going to have this problem. If Hover stop doing this, someone else wil come along and take Hover's business by sending plaintext passwords around in email. So. You either live with it and do your business with…

The problem here is that this is what customers want And I want a pony, they gonna give me that too? A business transaction is a negotiation between seller and client. You don't always have to give them what they want, and if you are good enough, people won't leave you over that one thing. If you are going to only use sites that store your password in plaintext because it is so damn convenient, you are not going to h…

You know this and I know this, but the way the marketplace works is that if nobody intervenes, people buy food that kills them, cribs that kill their babies, pajamas that catch on fire and stick burning plastic to their skin, and so forth.

So we draw a line somewhere and say that those products and services over there, caveat emptor. These over here, OTOH, must have a minimum standard of safety.

I am personally not convinced that domain registration should be left up to the marketplace. What if someone gets a user's password and then redirects their web addresses to a site that dispenses malware?

The victims in this case aren't even the domain registrar's customers, they're people who had absolutely no say in the question.

But any ways, I wasn't really trying to suggest we regulate it so much as suggest that laughing at Hover.com is looking in the wrong direction. There is a large social problem isomorphic to the "disable your security software if you want to see a video of dancing babies" problem. That problem is far more interesting and important than the "greedy businesspeople are greedy" problem.