Dropmyemail's security • Hacker News Board

Re: Dropmyemail's security

#31

Post by prusswan » Fri, Sep 28, 2012, 3:23 AM UTC

laurenceputra wrote: post #30

nubis wrote: post #25

Earlier quoted context omitted.

I fail to see the point made by that commenter that has not been made yet in this thread, other than the funny accusation of malice. We don't store plaintext passwords, and we are very aware of mass assignment bugs. (being suspected of such naive practices is why I mentioned the incompetence thing earlier). If security is a chain, then we strive not to be the weakest link. People have to learn what's the risk involve…

yea, you are now aware of the mass assignment bugs, but what about previously? even github got affected by it. are you saying that they are incompetent? what about bugs that have yet to be revealed? what i am saying is that there may be some things that you forget about, because we are all humans. and in order to mitigate the risk from us being humans, we should not store passwords in a way that is easily recovered.

Have you stopped beating your wife? Are you now aware of the mass assignment bugs?

Aside from the fallacy, it is a false argument to pose all risk as bad. Given what is presumed to be your idea of acceptable risk, I would expect you to surf the net behind 7 proxies: http://knowyourmeme.com/memes/good-luck-im-behind-7-proxies

Re: Dropmyemail's security

#32

Post by newman314 » Fri, Sep 28, 2012, 5:01 AM UTC

laurenceputra wrote: post #24

nubis wrote: post #23

Earlier quoted context omitted.

Indeed, no system is fully secure, and we don't try to hide that fact, that's one of the reasons Dropmyemail exists in the first place. We offer people an off-site backup at the cost of trusting a third party with their password. This is a risk assessment discussion, and I believe although good for raising awareness about what dropmyemail offers, the original articles fails to make a distinction between the objective…

And again, I am not doubting your competence. What I am saying is that we are all humans. Google might have hired the best computer scientists around the world but they still got hacked. It might even be a problem with the programming language you are using (rmb mass assignment on ROR?) "We offer people an off-site backup at the cost of trusting a third party with their password." Yes, this is my main point. People h…

Oh come on.

IFTTT does the same exact thing for some of their "connectors" services. Maybe you should go after them to.

Where IFTTT fails is that they have not IMO adequately explained just how they store these passwords.

http://www.quora.com/How-does-ifttt-securely-store-passwords...

Don't just read some web article talking about "always hash passwords" and repeat it as mantra. This is good practice for 90% of the time but there are definite use cases where having reversible encryption of passwords is necessary.

Re: Dropmyemail's security

#33

Post by indiangeek » Fri, Sep 28, 2012, 3:54 PM UTC

One thing I fail to understand is the experience of the author in making such a statement. As per his profile, he is an undergraduate student at NUS. I did check NUS's courses offered and there is hardly any course in hacking or teaching much about security. They just have a basic module on security which is not even mandatory. ANd the author is questioning the security practises of a company whose CTO has a 25+ years of work experience (Team page). He fails to understand the fact that it is not possible to do regular backups without the password. Something the user totally skippd in his article.

Re: Dropmyemail's security

#34

Post by nubis » Fri, Sep 28, 2012, 11:22 PM UTC

laurenceputra wrote: post #30

nubis wrote: post #25

Earlier quoted context omitted.

I fail to see the point made by that commenter that has not been made yet in this thread, other than the funny accusation of malice. We don't store plaintext passwords, and we are very aware of mass assignment bugs. (being suspected of such naive practices is why I mentioned the incompetence thing earlier). If security is a chain, then we strive not to be the weakest link. People have to learn what's the risk involve…

yea, you are now aware of the mass assignment bugs, but what about previously? even github got affected by it. are you saying that they are incompetent? what about bugs that have yet to be revealed? what i am saying is that there may be some things that you forget about, because we are all humans. and in order to mitigate the risk from us being humans, we should not store passwords in a way that is easily recovered.

You're repeating yourself now, do remember that all systems are built by humans, and as far as encryption goes do remember that unless your email is encrypted on the server using a password requested from you in order to encrypt and decrypt it every time you read it, then you are not safe. We are professionals offering a professional service. And FYI, Rails developers have been aware of mass assignment bugs a long time before github got bitten.