Hover.com: we store & email passwords in plaintext for usability • Hacker News Board

Re: Hover.com: we store & email passwords in plaintext for usability

#71

Post by tectonic » Mon, Jul 04, 2011, 8:49 PM UTC

mquander wrote: post #68

raganwald wrote: post #31

Blaming Hover.com is shooting the messenger. The problem here is that this is what customers want . As long as you ask Hover to compete for business in a race to the bottom of the "convenience" barrel, you are going to have this problem. If Hover stop doing this, someone else wil come along and take Hover's business by sending plaintext passwords around in email. So. You either live with it and do your business with…

It's not what customers want! Customers don't have a clue. They trust the provider to look out for their interests, since they are not experts. Customers don't understand that receiving a password instead of a reset link means that someone else can take their password. Customers don't know that probably any technical 16-year-old who doesn't like them (or any Hover employee) can figure out a way to break into Hover.co…

Agreed, it's not what someone wants if they're fully educated about the trade offs.

Re: Hover.com: we store & email passwords in plaintext for usability

#72

Post by [deleted] » Mon, Jul 04, 2011, 8:49 PM UTC

mquander wrote: post #68

raganwald wrote: post #31

Blaming Hover.com is shooting the messenger. The problem here is that this is what customers want . As long as you ask Hover to compete for business in a race to the bottom of the "convenience" barrel, you are going to have this problem. If Hover stop doing this, someone else wil come along and take Hover's business by sending plaintext passwords around in email. So. You either live with it and do your business with…

It's not what customers want! Customers don't have a clue. They trust the provider to look out for their interests, since they are not experts. Customers don't understand that receiving a password instead of a reset link means that someone else can take their password. Customers don't know that probably any technical 16-year-old who doesn't like them (or any Hover employee) can figure out a way to break into Hover.co…

[deleted]

Re: Hover.com: we store & email passwords in plaintext for usability

#73

Post by jarin » Mon, Jul 04, 2011, 8:54 PM UTC

AdamGibbins wrote: post #65

mishmash wrote: post #60

Earlier quoted context omitted.

After some positive research, I just purchased two domains from Hover. This is unacceptable however and I will be moving them away. What registrar would anyone say is the most security focused and/or government resistant? Maybe it should be a 2011 AskHN?

I can't vouch for "security focused" - but Gandi.net have so far never let me down. They're based in France, so not susceptible to US law (dependent on the TLD you use of course) and have a huge variety of TLDs. Can't recommend Gandi enough, they do exactly what they say on the tin - "no bullshit".

Gandi is pretty awesome, but just be aware that your credit card company might freeze your card the first time you buy from them (apparently buying domain names in other countries is a fraud trigger) :D

Re: Hover.com: we store & email passwords in plaintext for usability

#74

Post by pavpanchekha » Mon, Jul 04, 2011, 8:55 PM UTC

naner wrote: post #29

This really isn't that uncommon. When forced to choose between easier customer support or ostensibly better security practices, easier customer support usually wins. Stolen passwords through email/eavesdropping are rare enough that they can deal with it on a case-by-case basis. If someone somehow gets access to the entire database of passwords (also rare) then they have other security issues that likely would have be…

You miss the problem --- it's not that hackers get access to your Hover password. It's that for most people, they get access to all of their other passwords, since they're all the same. Also, stealing Hover passwords by wiresniffing must be done on a case-by-case basis, or at least by small geographic neighborhood; stealing them via a database dump can be done en mass.

Re: Hover.com: we store & email passwords in plaintext for usability

#75

Post by eru » Mon, Jul 04, 2011, 8:55 PM UTC

pavpanchekha wrote: post #69

geon wrote: post #61

Earlier quoted context omitted.

> They believe that a combination of their network security and physical security† mitigates these flaws. That is not how I read it. You could argue the other way: If they have to send password reset URL:s anyway, they can just as well send the password itself. That makes sense. It's just that by storing the passwords at all , you risk losing them if someone gains access to your database.

The URLs are usually time-linked, one-time, and service-specific, as opposed to the password, which 1) is permanent, 2) can be used without the user knowing, and 3) is likely to be used on other services as well.

Also a legitimate user will notice when somebody resets their password, because their old password won't work any more.

Re: Hover.com: we store & email passwords in plaintext for usability

#76

Post by pavpanchekha » Mon, Jul 04, 2011, 9:03 PM UTC

dexen wrote: post #33

Please correct me if I'm wrong, but... storing password hashes (actually key derived from password) is only meant to secure up password re-use. If there is any other reason, please disregard the text below and just correct me ;-) Isn't password re-use a social problem rather than technical one? Perhaps we ought to use a different -- social -- measure to prevent password reuse. Throwing technical solutions onto social…

Social problems can get technical solutions. That distinction in bullshit and should be educated out of the Hacker populace. Password reuse (which, BTW, is not why we hash passwords) can be solved otherwise; for example, you can hash passwords client-side and then again server-side, both times salting with a unique salt. That way, the password itself is uniquified in a non-reversible way by your salt (which is presumably not used elsewhere). Your client-side hash can be very expensive, since it's done on the client, and the password you recieve (the hash, that is), is guaranteed unique.

Re: Hover.com: we store & email passwords in plaintext for usability

#77

Post by pavpanchekha » Mon, Jul 04, 2011, 9:06 PM UTC

pwaring wrote: post #53

My hosting provider (Bytemark) sends out passwords in plaintext, though I'm not sure if they're stored that way. It is a lot more convenient that having to follow a password reset link, though I'm not entirely convinced by the security/usability trade-off (there's not much on my accounts, since the password simply allows access to the control panel, not root access on the machines).

If you can retrieve the plaintext, it doesn't matter how you store them. Keep in mind, access to the control panel probably means they can CNAME your address over to their own and start dispensing viruses and malware from a look-alike site.

Storing passwords recoverably is more or less and unforgivable sin; thinking that it is in any case a good idea is a mark of terrible naivete. Because you're compromising the security of yourself, your users, and any other accounts on any other services that your user uses.

Re: Hover.com: we store & email passwords in plaintext for usability

#78

Post by StavrosK » Mon, Jul 04, 2011, 9:13 PM UTC

raganwald wrote: post #70

StavrosK wrote: post #55

Earlier quoted context omitted.

I disagree. All they did (edit: to clarify, it seems to me that they only tried two alternatives) was try sending a password reset link and the unencrypted password itself. I don't think sending the user a new password would be that big a deal (we're assuming they receive the email, as both methods will fail if not), and you could show them the password reset page immediately after they logged in with the new passwor…

If the password reset function sends a temporary password just as you say, THEN it is not that big a deal. On the other hand, if they are storing every user's original password in such a way that they send the user their existing password... I believe this is the scenario most people here think is happening.

Oh, I'm sure it is. I'm saying that they should send a temporary password instead.

Re: Hover.com: we store & email passwords in plaintext for usability

#79

Post by benbeltran » Mon, Jul 04, 2011, 9:14 PM UTC

From reading the post, I think the post says that they'll give users the option to choose if they want their password to be encrypted (and any reset request will contain a URL) or not to be encrypted (and they'll send the plaintext).

This way they'll satisfy all users (or so they think.)

I hope they default to the secure method.

Re: Hover.com: we store & email passwords in plaintext for usability

#80

Post by drivebyacct2 » Mon, Jul 04, 2011, 9:20 PM UTC

Oh jeez. I was enjoying the conversation about looking out for dumb users and just giving dumb users what they want.

Hover is a domain registrar. I'd rather use GoDaddy than give someone business that tells me that my passwords are stored in plaintext because customers want it. I'd like to login everywhere with just my full name and phone number, are they going to implement that?