Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UK government's password checker sends plaintext password in the URL over HTTP

getsafeonline.org

Post reply on HN
Print view View original

71–80 of 117 posts

Re: UK government's password checker sends plaintext password in the URL over HTTP

#71

Post by hawkharris »

RussianCow wrote: post #62
hawkharris wrote: post #61

We should stop using the term "password" and start emphasizing pass phrases . A full sentence is much easier to remember, yet harder to crack, than a shorter, cryptic password. Or, as XKCD put it: http://xkcd.com/936/ There's a widespread misconception that words are always bad because of dictionary attacks, but that concern is moot if you use unique words or simply use a long sentence. A major advantage of sentences…

I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.

I agree. It is frustrating when websites place arbitrary limits on characters in a passphrase. It's even more frustrating when they add specific rules (e.g. must use at least one number) that actually lower the number of possible combos in the string.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#72

Post by mikeash »

x1798DE wrote: post #25
middus wrote: post #22

Earlier quoted context omitted.

XKCDs correct horse battery staple earns merely 40% ("Warning: Your passwords are weak and your digital life is at risk!") http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

When in fact it should earn a 0%, because it's in most common password dictionaries now?

I like the password checkers which just say, "This password is completely insecure, because you just gave it to a strange computer on the internet."

Re: UK government's password checker sends plaintext password in the URL over HTTP

#73

Post by l-p »

RussianCow wrote: post #62
hawkharris wrote: post #61

We should stop using the term "password" and start emphasizing pass phrases . A full sentence is much easier to remember, yet harder to crack, than a shorter, cryptic password. Or, as XKCD put it: http://xkcd.com/936/ There's a widespread misconception that words are always bad because of dictionary attacks, but that concern is moot if you use unique words or simply use a long sentence. A major advantage of sentences…

I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.

Well, how would they fit the passwords in the database if there was no limit? =)

Re: UK government's password checker sends plaintext password in the URL over HTTP

#74

Post by DanBC »

It is depressing that money is spent on that website rather than on curating a list of good password managers for all platforms and persuading people to move to those.

UK government does do some great IT stuff. This isn't one of those. UK gov also has some horrifically over-budget under-performing train wrecks of IT projects so I guess I should be glad that this isn't one of those.

Re: UK government's password checker sends plaintext password in the URL over HTTP

#75

Post by daveslash »

opendais wrote: post #15
ZoFreX wrote: post #7

Earlier quoted context omitted.

> Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel. There are adverts everywhere about it with obvious government endorsement. It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a…

I'm not from the UK and I never believe anything a company puts on its about us page. ;) If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are. Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. Also: "(Never enter your real password into a pas…

I give this site to people so they can check the strength of their twitter password. I think it get's the point across. http://www.ismytwitterpasswordsecure.com

Re: UK government's password checker sends plaintext password in the URL over HTTP

#80

Post by opendais »

Tyrannosaurs wrote: post #54
opendais wrote: post #15

Earlier quoted context omitted.

I'm not from the UK and I never believe anything a company puts on its about us page. ;) If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are. Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. Also: "(Never enter your real password into a pas…

> Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page. That's genius because scammers would never say something like that because that would be lying and people don't lie because it's naughty.

I read that and concluded they meant "Do not use a real password on this site"
Post reply on HN