Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hover.com: we store & email passwords in plaintext for usability

help.hover.com

Post reply on HN
Print view View original

61–70 of 190 posts

Re: Hover.com: we store & email passwords in plaintext for usability

#61

Post by geon »

tptacek wrote: post #51
raganwald wrote: post #31

Blaming Hover.com is shooting the messenger. The problem here is that this is what customers want . As long as you ask Hover to compete for business in a race to the bottom of the "convenience" barrel, you are going to have this problem. If Hover stop doing this, someone else wil come along and take Hover's business by sending plaintext passwords around in email. So. You either live with it and do your business with…

Trenchant, but ultimately orthogonal. The Big Problem here isn't that Hover has decided that user convenience warrants storing passwords insecurely. That is a problem, of course, but it is not as big a problem as The Big Problem here. The Big Problem is the grafs spent defending the soundness of Hover's password storage strategy. Hover does not appear to understand that they have conceded user security. They believe…

> They believe that a combination of their network security and physical security† mitigates these flaws.

That is not how I read it. You could argue the other way:

If they have to send password reset URL:s anyway, they can just as well send the password itself.

That makes sense. It's just that by storing the passwords at all, you risk losing them if someone gains access to your database.

Re: Hover.com: we store & email passwords in plaintext for usability

#62

Post by city41 »

raganwald wrote: post #31

Blaming Hover.com is shooting the messenger. The problem here is that this is what customers want . As long as you ask Hover to compete for business in a race to the bottom of the "convenience" barrel, you are going to have this problem. If Hover stop doing this, someone else wil come along and take Hover's business by sending plaintext passwords around in email. So. You either live with it and do your business with…

I find it very interesting that a domain registrar has a customer base demanding this. In my anecdotal experience domain registrar customers do vary a bit in their technical knowledge, but overall are above average.

As for being what the customers want, not this customer. I'll definitely never become their customer if they are this insecure.

Re: Hover.com: we store & email passwords in plaintext for usability

#65

Post by AdamGibbins »

mishmash wrote: post #60
markbao wrote: post #20

This isn't a microblogging service or pet social network. A domain registrar is storing your password in plaintext? Really? Didn't we go over this a thousand times? If I was on Hover (which I considered), I'd transfer my domains immediately. Moving to a plaintext password system to get fewer support requests is like removing the door from your house so you don't have to keep fumbling for the key.

After some positive research, I just purchased two domains from Hover. This is unacceptable however and I will be moving them away. What registrar would anyone say is the most security focused and/or government resistant? Maybe it should be a 2011 AskHN?

I can't vouch for "security focused" - but Gandi.net have so far never let me down. They're based in France, so not susceptible to US law (dependent on the TLD you use of course) and have a huge variety of TLDs.

Can't recommend Gandi enough, they do exactly what they say on the tin - "no bullshit".

Re: Hover.com: we store & email passwords in plaintext for usability

#66

Post by sbierwagen »

geon wrote: post #61
tptacek wrote: post #51

Earlier quoted context omitted.

Trenchant, but ultimately orthogonal. The Big Problem here isn't that Hover has decided that user convenience warrants storing passwords insecurely. That is a problem, of course, but it is not as big a problem as The Big Problem here. The Big Problem is the grafs spent defending the soundness of Hover's password storage strategy. Hover does not appear to understand that they have conceded user security. They believe…

> They believe that a combination of their network security and physical security† mitigates these flaws. That is not how I read it. You could argue the other way: If they have to send password reset URL:s anyway, they can just as well send the password itself. That makes sense. It's just that by storing the passwords at all , you risk losing them if someone gains access to your database.

You appear to not understand how password hashing works. A well designed hashing function is one-way, it cannot practically be reversed. With a large salt, even very weak passwords ("cat") cannot be reversed.

https://secure.wikimedia.org/wikipedia/en/wiki/Password_hash...

Re: Hover.com: we store & email passwords in plaintext for usability

#68

Post by mquander »

raganwald wrote: post #31

Blaming Hover.com is shooting the messenger. The problem here is that this is what customers want . As long as you ask Hover to compete for business in a race to the bottom of the "convenience" barrel, you are going to have this problem. If Hover stop doing this, someone else wil come along and take Hover's business by sending plaintext passwords around in email. So. You either live with it and do your business with…

It's not what customers want! Customers don't have a clue. They trust the provider to look out for their interests, since they are not experts. Customers don't understand that receiving a password instead of a reset link means that someone else can take their password. Customers don't know that probably any technical 16-year-old who doesn't like them (or any Hover employee) can figure out a way to break into Hover.com and steal their account. Hover is taking advantage of their knowledge to exploit the ignorance of customers.

I agree that we probably can't stop them from doing it short of government regulation, but that doesn't mean it's not a fucked-up thing to do.

Re: Hover.com: we store & email passwords in plaintext for usability

#69

Post by pavpanchekha »

geon wrote: post #61
tptacek wrote: post #51

Earlier quoted context omitted.

Trenchant, but ultimately orthogonal. The Big Problem here isn't that Hover has decided that user convenience warrants storing passwords insecurely. That is a problem, of course, but it is not as big a problem as The Big Problem here. The Big Problem is the grafs spent defending the soundness of Hover's password storage strategy. Hover does not appear to understand that they have conceded user security. They believe…

> They believe that a combination of their network security and physical security† mitigates these flaws. That is not how I read it. You could argue the other way: If they have to send password reset URL:s anyway, they can just as well send the password itself. That makes sense. It's just that by storing the passwords at all , you risk losing them if someone gains access to your database.

The URLs are usually time-linked, one-time, and service-specific, as opposed to the password, which 1) is permanent, 2) can be used without the user knowing, and 3) is likely to be used on other services as well.

Re: Hover.com: we store & email passwords in plaintext for usability

#70

Post by raganwald »

StavrosK wrote: post #55
raganwald wrote: post #31

Blaming Hover.com is shooting the messenger. The problem here is that this is what customers want . As long as you ask Hover to compete for business in a race to the bottom of the "convenience" barrel, you are going to have this problem. If Hover stop doing this, someone else wil come along and take Hover's business by sending plaintext passwords around in email. So. You either live with it and do your business with…

I disagree. All they did (edit: to clarify, it seems to me that they only tried two alternatives) was try sending a password reset link and the unencrypted password itself. I don't think sending the user a new password would be that big a deal (we're assuming they receive the email, as both methods will fail if not), and you could show them the password reset page immediately after they logged in with the new passwor…

If the password reset function sends a temporary password just as you say, THEN it is not that big a deal. On the other hand, if they are storing every user's original password in such a way that they send the user their existing password...

I believe this is the scenario most people here think is happening.

Post reply on HN