Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK government's password checker sends plaintext password in the URL over HTTP

getsafeonline.org

Post reply on HN
Print view View original

51–60 of 117 posts

Re: UK government's password checker sends plaintext password in the URL over HTTP

#51

Post by sdernley »

gtirloni wrote: post #11

(Never enter your real password into a password checker In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use. They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.

It's implied at first glance that it's for testing your password though.

Most people wouldn't even know the mistake they've made and are probably sending the results link on too.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#54

Post by Tyrannosaurs »

opendais wrote: post #15
ZoFreX wrote: post #7

Earlier quoted context omitted.

> Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel. There are adverts everywhere about it with obvious government endorsement. It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a…

I'm not from the UK and I never believe anything a company puts on its about us page. ;) If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are. Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. Also: "(Never enter your real password into a pas…

> Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page.

That's genius because scammers would never say something like that because that would be lying and people don't lie because it's naughty.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#55

Post by passfree »

This is so wrong in some many levels.

1. They should not ask for any password first of all 2. They post the password to their server when they could have checked it on the client 3. The password is sent as GET meaning that it is in the URL and it will be recorded in your history and perhaps anything else that keeps log of the URLs you visit

100% fail

Re: UK government's password checker sends plaintext password in the URL over HTTP

#56

Post by zhte415 »

rikkus wrote: post #24

This is what I wrote in their 'Contact' form, which returned an error: 'The form you submitted contained the following errors Missing Data.(DIFFERENT_IP) Return to Previous Page' I used your password checker here: http://www.getsafeonline.org/themes/passwrdcheck/index.html I notice that it has set the form field to hide my password as I type it, that there are two lock symbols next to the password box, and that the b…

I did a WHOIS, and seeing a domain registration date back to 2005 gave an air of credibility. So then I visited Internet Archive and browsed several pages https://web.archive.org/web/20080701000000*/http://getsafeon...

They seem like experts... experts in subtle verbal manipulation for those without technical understanding, at least that is how it reads for me.

Over years of archives, including the OP post, 'protect your family' continually appears as a headline. Monetisation is not explicitly outlined, it appears to be government or PPP funded.

Scare tactics, targeted at those probably less internet aware then the HN crowd, rather than education, appear to fund this website by whatever means.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#57

Post by roywiggins » 

    password1234
    50%: Sufficient
    
    a12345678910
    92%: Exceptional
So, they try to give you negative points for "sequential numbers" but you get more points for having numbers than you lose, so it's useless. As long as you have a 12-character string with at least one number and one letter, your password will probably pass.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#58

Post by crashandburn4 »

opendais wrote: post #15
ZoFreX wrote: post #7

Earlier quoted context omitted.

> Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel. There are adverts everywhere about it with obvious government endorsement. It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a…

I'm not from the UK and I never believe anything a company puts on its about us page. ;) If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are. Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. Also: "(Never enter your real password into a pas…

> Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason.

I'd agree but I don't think anyone who reads hacker news is likely to use a password checker anyway. We all, however, know less technical people who could and would get compromised by something like this and to have it endorsed by the government sends the message that it is safe. That's the problem as far as I'm concerned.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#59

Post by unfunco »

jacquesm wrote: post #52
maaarghk wrote: post #10

Hahahahaha. This is a total embarrassment and it is why we can't have nice things. There is always this for a decent alternative: https://howsecureismypassword.net/

'abcdefghij' would take 9 hours to crack?

Thankfully correcthorsebatterystaple takes a quintillion years. I'm safe.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#60

Post by romaniv »

pdpi wrote: post #32

Considering how they deduct points for "bad practices", and how avoiding those "bad practices" actually makes for a smaller password space, I have half a mind to spend some time figuring out exactly how much smaller the password space is for a given length if you follow all of their advice.

Any password rules decrease the overall possibility space. The point is that they try to move your password away from the high-probability areas of that space that hackers try first.

It's like kicking someone out of apartment. Yes, you know for sure they aren't anywhere in that apartment, but it still makes it harder to locate them in the city with high probability.

Post reply on HN