If you're going to store passwords in clear text...
You're gonna have a bad time.
Tuts+ Premium Account Security Compromised
31–40 of 70 posts
Re: Tuts+ Premium Account Security Compromised
#32Still storing clear text passwords in 2012, how the hell do these people have businesses? I mean, I learned about this stuff at age 12 while learning PHP on my own, how hard can it be? Getting hacked happens, even to the best but come on, how many times will we have to read blog posts like this one before people wake up? How hard can it be to hash and salt your passwords? Glad I wasn't one of their customers (and nev…
In principle I agree: it is bad practice. But let's remember that either plain text or one-way hashed they will be broken eventually. The only thing hashing passwords buys you is a little bit of time before the "hacker" can use those passwords to access the compromised system. It doesn't, for example, protect you from password re-usage issues. You also have to reset the passwords either way. I think getting broken in…
False. Getting broken through will happen because there are so many holes to plug, while strong and slow hashing + salting (while being extremely easy to set up) will make it so it's not even worth it for the attacker to crack passwords when he/she inevitably gets in.
Of course we need to plug holes in security and prevent people from getting in (SQL injection vulnerabilities are just as important an offence) but might as well protect the user's information when a breach happens. Especially since it's so much easier than the other way around.
Re: Tuts+ Premium Account Security Compromised
#33We should start a new award for web sites with crap password security. Let's name it after Robert Morris (Senior) who essentially inventing password hashing. A Morris Award would be a bit like a Darwin Award for people who've failed to learn anything about password security and in doing so have been exposed. Recent Morris Award winners: LinkedIn, last.fm, eHarmony, Tuts+, ...
I have talked about & mentioned something similar before but bundeling the whole thing into a browser extension.
Every site you hit gets checked against a local list thats periodically updated. It throws up an information bar with bad security practices associated with the site you are browsing, everything from mailing plaintext password to the idiotic things like above.
If it becomes trusted enough it might move some developers/organisations to actually take action, if not it will at least warn individuals of the obvious problems before they signup and not afterwards like at the moment.
Edit: Last sentence didn't make sense.
Re: Tuts+ Premium Account Security Compromised
#34Earlier quoted context omitted.
>You have to be kidding me? Do I really need to start using unique passwords on every site that I use? Errr, ...yes!
I already do to an extent but come on, you can't tell me you use a completely unique password for EACH of the HUNDREDS of sites that use passwords? That just seems ridiculous, or maybe it's just me...
Pay for Lastpass. They're fucking awesome.
Wish they'd add a system for private/public key storage though.
Re: Tuts+ Premium Account Security Compromised
#35According to some comments the plugin in question is "amember" but there are several (old) posts on their forums say they don't use plaintext. I'd be surprised if it was, but then again ...
http://www.amember.com/forum/threads/db-password-encryption-... http://www.amember.com/forum/threads/password-on-resend-sign...
Re: Tuts+ Premium Account Security Compromised
#36Earlier quoted context omitted.
Serious question; all of these tutorial sites.. are any of them a reliable source for web dev or are they just another Smashing Magazine where people get paid to write about things they don't understand?
Honestly I don't think their tutorials are half bad and I enjoy reading Smashing Magazine. Mainly for fluffy stuff. For security & scaling stuff go elsewhere.
I guess half-bad is subjective. I don't feel like a site that allows such a vast array of decent information vs. downright terrible/wrong is worth my time trying to decipher between the two.
I know what I read on A List Apart is quality material from quality writers and people who have spent years and years in the field. Tommy the 17 year old graphic designer that only has mom-and-pop Wordpresses under his belt shouldn't be getting paid to tell thousands of people what's hot right now.
Re: Tuts+ Premium Account Security Compromised
#37Earlier quoted context omitted.
In principle I agree: it is bad practice. But let's remember that either plain text or one-way hashed they will be broken eventually. The only thing hashing passwords buys you is a little bit of time before the "hacker" can use those passwords to access the compromised system. It doesn't, for example, protect you from password re-usage issues. You also have to reset the passwords either way. I think getting broken in…
False. Getting broken through will happen because there are so many holes to plug, while strong and slow hashing + salting (while being extremely easy to set up) will make it so it's not even worth it for the attacker to crack passwords when he/she inevitably gets in. Of course we need to plug holes in security and prevent people from getting in (SQL injection vulnerabilities are just as important an offence) but mig…
What is "false?"
You deeply over-estimate how much effort it takes someone to break even correctly protected hashes. Most passwords are extremely poor and can be broken even without a rainbow table in less than a couple of hours.
Hell I can spin up an EC2 instance right now for free (AWS Free) running Linux and then just leave it there for 12 months at zero cost; giving me a nice formatted list of e-mail addresses and passwords to be used on third party sites.
At the end of the day most of these break-ins are news because the "hacker" got into a position to crack the user's passwords at all. What they do once they're in is not nearly as interesting from a learning perspective as how they got in originally.
Why, for example, are user's passwords on web-facing servers at all? Why not use several commonly available login API infrastructures to off-load that task to a firewall-ed box that can only be managed via VPN?
It isn't that crazy. It isn't that expensive either. A lot of software suites at minimum support a Kerberos protocol.
Re: Tuts+ Premium Account Security Compromised
#38http://net.tutsplus.com/tutorials/php/understanding-hash-fun...
Oh the sweet, sweet irony.
Re: Tuts+ Premium Account Security Compromised
#39This is ridiculous. In the email I received from Envato it says the following: "-- What To Do (1) Update passwords on ANY service you use that uses the same password as you had on Tuts+ Premium. (2) In particular you should consider your own email account, PayPal, Moneybookers, and other payment services. These are the most sensitive targets, and if you had the same password, you should consider this an urgent priori…
In my opinion, using unique passwords on every site you use is perhaps the key to keeping yourself safe.
Facts: 1)Most people have way too many accounts to keep track of passwords for. 2)A unique password is essential.
So, get a password manager and store them there! It's almost the only secure solution.
Re: Tuts+ Premium Account Security Compromised
#40According to some comments the plugin in question is "amember" but there are several (old) posts on their forums say they don't use plaintext. I'd be surprised if it was, but then again ... http://www.amember.com/forum/threads/db-password-encryption-... http://www.amember.com/forum/threads/password-on-resend-sign...
Posts are from spring this year, so it's not "old". The first post also references an upgrade from version 3 to version 4, so I guess they still use version 3 and didn't get around to updating to v4 yet, and now they pay the price.