Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK government's password checker sends plaintext password in the URL over HTTP

getsafeonline.org

Post reply on HN
Print view View original

31–40 of 117 posts

Re: UK government's password checker sends plaintext password in the URL over HTTP

#31

Post by tyho »

opendais wrote: post #4

Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and sho…

I just called who I think is the head of the site, a little ironic that the head of a site that is funded by the government to educate how to secure ones privacy online publishes his mobile number in the WHOIS data for said site, he asked me to email him with my concerns, which I have now done.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#32

Post by pdpi »

Considering how they deduct points for "bad practices", and how avoiding those "bad practices" actually makes for a smaller password space, I have half a mind to spend some time figuring out exactly how much smaller the password space is for a given length if you follow all of their advice.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#33

Post by gpvos »

gtirloni wrote: post #11

(Never enter your real password into a password checker In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use. They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.

Not very clearly. Most people would read over that sentence (I did at first, although I of course wouldn't dream of entering my real password into that site). It should at least be displayed in bold red.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#35

Post by bkurtz13 »

Pass#123 is "exceptional". It worries me that people are slow to accept the realities of the xkcd comic on pass phrases (http://xkcd.com/936/). We are training people to think they are secure with passwords that are ridiculously easy to brute force.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#38

Post by usefulcat »

gtirloni wrote: post #11

(Never enter your real password into a password checker In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use. They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.

And immediately after they tell you not to enter your real password, they say "Why not get your family, friends and workmates to test their passwords too?"

Re: UK government's password checker sends plaintext password in the URL over HTTP

#39

Post by Donzo »

gtirloni wrote: post #11

(Never enter your real password into a password checker In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use. They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.

If the sentence you quoted were the one that they used, I would agree with you that it was stated clearly. Unfortunately, they chose to word it this way:

"(Never enter your real password into a password checker, as unlike this one, some may be fake)"

The sentence is parenthetical, undermining it's importance, and it goes in two different directions, which makes it hard to follow. They should clearly advise users against entering their "real" password in one sentence, and then attest to the authenticity of their password checker in a separate sentence.

By the end of their sentence, it's hard to tell whether they mean that I shouldn't put my "real" password into other password checkers. The implication is that their password checker is real and safe. A clearer way to phrase it would be like this:

"Don't put your real password into this password checker."

Re: UK government's password checker sends plaintext password in the URL over HTTP

#40

Post by Anderkent »

pdpi wrote: post #32

Considering how they deduct points for "bad practices", and how avoiding those "bad practices" actually makes for a smaller password space, I have half a mind to spend some time figuring out exactly how much smaller the password space is for a given length if you follow all of their advice.

That's not quite right. Assuming you were picking passwords randomly discarding ones that have repeat letters etc makes for a smaller password space, certainly. However that's not how most passwords are generated, especially among the people that need this advice most. If your password generation algorithm is 'think out a random string' and produces 'aabbbbdccdc' then your password space is tiny.

Those practices are meant to address the most common 'patterns' in human-generated passwords, therefore effectively enlarging the password space (any cracker has to enumerate more complicated patterns or brute-force, rather than the simple pattern that our brains would generate by defualt)

Post reply on HN