Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How to out a MAJOR online company storing passwords in plaintext?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 16 posts

Ask HN: How to out a MAJOR online company storing passwords in plaintext?

#1

Post by dwelch2344 »

I recently became aware of a major online hotel broker that stores passwords as plaintext in their system. The management is aware of the technical risks and liabilities but has pushed off technical fixes for YEARS. Furthermore, the features of the website make it obvious that this could be q very valuable attack vector as the reset feature emails you your current plain text password.

So the question is: what is the ethical way to raise the issue and force their hand in a fix?

(Sorry for brevity and spelling; mobile on holiday)

Re: Ask HN: How to out a MAJOR online company storing passwords in plaintext?

#3

Post by paulhauggis »

How do you know it's actually plain text? There are plenty of 2-way encryption methods out there.

Do you work there? If so, are you willing to lose your job over it?

These sorts of leaks can have devastating effects on the company/customers. You should also think about the employees that work there as well. Are you willing to risk their jobs in the event that the company loses money?

Re: Ask HN: How to out a MAJOR online company storing passwords in plaintext?

#4

Post by dwelch2344 »

paulhauggis wrote: post #3

How do you know it's actually plain text? There are plenty of 2-way encryption methods out there. Do you work there? If so, are you willing to lose your job over it? These sorts of leaks can have devastating effects on the company/customers. You should also think about the employees that work there as well. Are you willing to risk their jobs in the event that the company loses money?

I've spoken to a number of employees who have confirmed they are stored plain text.

I have considered those factors and am definitely concerned. However, consider the other side of the equation: a systems breach that leaves thousands (maybe even millions, given their size and 15 years of operation) of customers data being leaked, potentially leading to fraud and identity theft.

Who deserves to be protected? The organization that will not respond to the threat, or their innocent customers?

Re: Ask HN: How to out a MAJOR online company storing passwords in plaintext?

#5

Post by dwelch2344 »

paulhauggis wrote: post #3

How do you know it's actually plain text? There are plenty of 2-way encryption methods out there. Do you work there? If so, are you willing to lose your job over it? These sorts of leaks can have devastating effects on the company/customers. You should also think about the employees that work there as well. Are you willing to risk their jobs in the event that the company loses money?

Also, there is no good reason to use 2 way encryption on passwords anyways. It goes against every security best practice.

Re: Ask HN: How to out a MAJOR online company storing passwords in plaintext?

#6

Post by sigden »

paulhauggis wrote: post #3

How do you know it's actually plain text? There are plenty of 2-way encryption methods out there. Do you work there? If so, are you willing to lose your job over it? These sorts of leaks can have devastating effects on the company/customers. You should also think about the employees that work there as well. Are you willing to risk their jobs in the event that the company loses money?

What legitimate use case is there for implementing a 2-way encryption method over a hash function for passwords?

Re: Ask HN: How to out a MAJOR online company storing passwords in plaintext?

#8

Post by ryanlol »

sigden wrote: post #6
paulhauggis wrote: post #3

How do you know it's actually plain text? There are plenty of 2-way encryption methods out there. Do you work there? If so, are you willing to lose your job over it? These sorts of leaks can have devastating effects on the company/customers. You should also think about the employees that work there as well. Are you willing to risk their jobs in the event that the company loses money?

What legitimate use case is there for implementing a 2-way encryption method over a hash function for passwords?

Customer support. A human can then verify the user even if they can only remember a part of the password.

Re: Ask HN: How to out a MAJOR online company storing passwords in plaintext?

#9

Post by stephenr »

ryanlol wrote: post #8
sigden wrote: post #6

Earlier quoted context omitted.

What legitimate use case is there for implementing a 2-way encryption method over a hash function for passwords?

Customer support. A human can then verify the user even if they can only remember a part of the password.

Sounds like a security flaw ripe for social engineering

Re: Ask HN: How to out a MAJOR online company storing passwords in plaintext?

#10

Post by ryanlol »

stephenr wrote: post #9
ryanlol wrote: post #8

Earlier quoted context omitted.

Customer support. A human can then verify the user even if they can only remember a part of the password.

Sounds like a security flaw ripe for social engineering

Customer support by itself tends to be a security flaw ripe for social engineering.
Post reply on HN