Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Toronto Utility Company Stores Customers' Passwords in Plain Text

old.reddit.com

Post reply on HN
Print view View original

61–70 of 89 posts

Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text

#61

Post by MathMonkeyMan »

I've never designed a system that needed to be secure, nor have I been tasked with breaking one, but...

Is plaintext really that much worse than hashed/salted/whatever storage? If the user generated a hard-to-guess password, then the user is also unlikely to reuse it. If the user generated or reused a memorable password, then it would be not too costly to guess most of them using a dictionary attack or whatever the state of the art is for guessing non-random passwords.

Is this just defense in depth, or deterrence, or is there something I'm missing that makes the plaintext storage really much more dangerous?

Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text

#63

Post by surfpel »

MathMonkeyMan wrote: post #61

I've never designed a system that needed to be secure, nor have I been tasked with breaking one, but... Is plaintext really that much worse than hashed/salted/whatever storage? If the user generated a hard-to-guess password, then the user is also unlikely to reuse it. If the user generated or reused a memorable password, then it would be not too costly to guess most of them using a dictionary attack or whatever the s…

Look into "rainbow tables" and "salting & peppering" in the context of password storage.

Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text

#64

Post by SamuelAdams »

Is Reddit considered a news source now? Half of the posts on the front page are made up fictional writing, and the other half are politics and repeated questions, for the purposes of karma farming.

How do we know that the OP of this post did not make these claims up?

Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text

#65

Post by firen777 »

MathMonkeyMan wrote: post #61

I've never designed a system that needed to be secure, nor have I been tasked with breaking one, but... Is plaintext really that much worse than hashed/salted/whatever storage? If the user generated a hard-to-guess password, then the user is also unlikely to reuse it. If the user generated or reused a memorable password, then it would be not too costly to guess most of them using a dictionary attack or whatever the s…

> Is plaintext really that much worse than hashed/salted/whatever storage?

Bruh...

Any random rouge employee (and judging from OP's post, it's accessible to not just DB admin/IT but also regular supports) can easily scrape any password they want.

Considering OP was told the password on a call, I'd guess a low tech social engineer could easily extract any password they want as well.

> Is this just defense in depth

You use "just" as if "defense in depth" is just some security theater term with no substance.

Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text

#66

Post by joecool1029 »

MathMonkeyMan wrote: post #61

I've never designed a system that needed to be secure, nor have I been tasked with breaking one, but... Is plaintext really that much worse than hashed/salted/whatever storage? If the user generated a hard-to-guess password, then the user is also unlikely to reuse it. If the user generated or reused a memorable password, then it would be not too costly to guess most of them using a dictionary attack or whatever the s…

Assume the database gets dumped. Plaintext you immediately have a password.

If hashed/salted, this would need to be cracked and takes time/resources. It's not perfect/ideal but it buys time. A raw pw dump you're good to go to start testing them on other sites.

In short, its like having a kia/hyundai vs. any sane car manufacturer. All cars can be stolen, some just make it easy.

Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text

#67

Post by lotsoweiners »

kristopolous wrote: post #51
II2II wrote: post #48

Earlier quoted context omitted.

For some of us, finding our mother's maiden name is as simple as looking at our name, either because it is a hyphenated name or because there was a time when the government refused to acknowledge the existence of the father in certain cases. It is very hard to come up with universally good security questions.

It should be web of trust. You add let's say, up to 3 peoples names and mobile numbers for recovery and then they are contacted requesting to reach out to you to authenticate. Something like "You've been added to X's web of trust for account recovery at example.com. If X needs to recover their account, we may ask you to confirm with them that it's genuine." Then something like "X is trying to recover their account fo…

A lot of people don’t want their trusted web to know what websites they are looking at? Think Grinder/other dating sites, financial/crypto, pornhub, certain message boards etc.

Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text

#68

Post by MathMonkeyMan »

firen777 wrote: post #65
MathMonkeyMan wrote: post #61

I've never designed a system that needed to be secure, nor have I been tasked with breaking one, but... Is plaintext really that much worse than hashed/salted/whatever storage? If the user generated a hard-to-guess password, then the user is also unlikely to reuse it. If the user generated or reused a memorable password, then it would be not too costly to guess most of them using a dictionary attack or whatever the s…

> Is plaintext really that much worse than hashed/salted/whatever storage? Bruh... Any random rouge employee (and judging from OP's post, it's accessible to not just DB admin/IT but also regular supports) can easily scrape any password they want. Considering OP was told the password on a call, I'd guess a low tech social engineer could easily extract any password they want as well. > Is this just defense in depth You…

I say "just" because if I'm missing something fundamental about how passwords are properly stored, then defense in depth might not be the point.

I read up a bit more on salting passwords, and now I see that it makes guessing the passwords _way_ harder, because it adds a factor of O(n) to the guessing (n is the number of passwords leaked).

Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text

#69

Post by lotsoweiners »

Loughla wrote: post #28
hooverd wrote: post #21

Earlier quoted context omitted.

I guess there's no one person to hold accountable. They probably just get a small fine and move on.

Whoever is in charge. That's who you charge. They're the boss. They pay the penalty.

They might not know what is being done. They might not even know it is a bad practice. I work in government and you wouldn’t believe how many people are clueless about good practices.

Re: Major Toronto Utility Company Stores Customers' Passwords in Plain Text

#70

Post by kristopolous »

lotsoweiners wrote: post #67
kristopolous wrote: post #51

Earlier quoted context omitted.

It should be web of trust. You add let's say, up to 3 peoples names and mobile numbers for recovery and then they are contacted requesting to reach out to you to authenticate. Something like "You've been added to X's web of trust for account recovery at example.com. If X needs to recover their account, we may ask you to confirm with them that it's genuine." Then something like "X is trying to recover their account fo…

A lot of people don’t want their trusted web to know what websites they are looking at? Think Grinder/other dating sites, financial/crypto, pornhub, certain message boards etc.

Well don't use it for porno sites then or just give different personal email addresses for your web.

Also there's a 100+ year old workaround for that which used to be used in the postal service so people didn't have boxes on their doorstep with giant labels on it reading things like "Dildos Direct": Either leave the company name off or use some alias.

Including the company name is really just a user interface flourish to dealienate the feature

Post reply on HN