3 ms·

Worth repeating for the nth time: just because they have access to your password doesn't mean it's stored in clear. They could simply be using a reversible encr

• sucuri2 17y ago
  Reversible encryption algorithm that an admin can use to get my password and access my servers == same as clear-text to me... The problem is not that they can get hacked and someone steal all their data, the problem is a malicious employee acessing my private server and my passwords. That's the issue.. unless they trust all their employees.
  • swombat 17y ago
    As others have pointed out, if you don't trust your host, you're hosed right from the start. If you want a private server, keep it in your closet. Having the password reversibly encrypted means that if someone gets their hands on a dump of the db, they will at least not be able to automatically gain access to millions of accounts with no effort. Depending on the encryption scheme used, it may even be extremely secure - for example, decryption could require sending the encrypted string to a different, extremely secure server off the WAN that answers with the password.
    • tptacek 17y ago
      In 15 years as a security professional and over 5 years directly consulting for big companies, little companies, locked down companies and lunatic companies, selling operating systems, browsers, parts of the power grid, cores of financial exchanges, retail banking applications, email management applications and to-do lists, I have never once seen the "extremely secure" system you allude to. I have seen lots of "reversable encryption", though. Maybe I've just gotten lucky in my career, and I just get the fun applications where people do this wrong. But there's no way GoDaddy did it right.
      • sailormoon 17y ago
        Nonetheless you must admit it is possible. If I did this, that's how I'd do it. Have a separate computer, locked down to the max, except for a couple of functions: accepting HTTP requests POSTing an encrypted password, then sending back the decrypted string. That function would be severely rate-limited. Another function, to confirm the hash of passwords, would not be rate-limited, allowing high volumes of website access. I could make that machine friggin' impregnable (and so could you). But yeah. No-one ever does it.
        • tptacek 17y ago
          I wouldn't do it at all. If I wanted escrowed access to a VM, I'd stick a "break glass" SSH key on the box. I'm not sure how "extremely secure" this "password-decrypting server" design really is, by the way. SQLI is often equivalent to remote code execution. Even when it isn't, XSS is equivalent to operator access, and operators can use the feature that decrypts the password. Passwords are hazmat. You shouldn't be storing them, at all.
          • sailormoon 17y ago
            Yeah. I used to disagree with you, but now I agree. You should write up a definitive guide for password security. For instance, I want to know if we should still use salts in the age of bcrypt, etc. Tell us what to do, man.
            • tptacek 17y ago
              I kind of don't want to be "the password guy".
              • sailormoon 17y ago
                Haha. I understand.
        • Nwallins 17y ago
          Um, sounds like an industry standard HSM http://en.wikipedia.org/wiki/Hardware_Security_Module http://en.wikipedia.org/wiki/Hardware_Security_Module
  • andreyf 17y ago
    You have no idea what the procedure for this access is, or how exactly it's stored.
• madair 17y ago
  Worth repeating for the nth time: symmetric encryption algorithms for account passwords provide a misplaced sense of security and can be as risky as no encryption at all, due to changes in behavior and policy that result from misplaced expectations.
  • swombat 17y ago
    That may be, but my point remains: this article's title and one of its central accusations are incorrect.
• ajross 17y ago
  It's also worth noting that, because they control the storage for your hosted server, they can access it without your permission whether you want to allow them to or not. Just reset the ssh keys and bounce it ("oops, power failure!"), or just read out the data from your logs via a snapshot of the partitions, etc.. Still, storing recoverable passwords (which is what most people mean when they say "cleartext") without clear notice is a terrible idea for all the reasons people expect. The list can be stolen or misused, and this sort of thing happens routinely.
  • swombat 17y ago
    It's also worth noting that, because they control the storage for your hosted server, they can access it without your permission whether you want to allow them to or not. Just reset the ssh keys and bounce it ("oops, power failure!"), or just read out the data from your logs via a snapshot of the partitions, etc.. Definitely, which is why, as others have pointed out, you have to get a host you can trust. Still, storing recoverable passwords (which is what most people mean when they say "cleartext") without clear notice is a terrible idea for all the reasons people expect. The list can be stolen or misused, and this sort of thing happens routinely. Whilst I agree that storing cleartext passwords is not a great idea, I think the worse idea is to rely on every single web service you belong to to keep your authentication/authorisation credentials secure. Your process of keeping your credentials secure should not depend on the security practices at any single one of the services you use. People who publicly criticise hosts for storing passwords in clear, but then use the same password for multiple services, are nothing less than hypocrites. Remove the log from your own eye before picking at the straw in someone else's.
• eplanit 17y ago
  Not really worth repeating, because it's a relatively minor concern once the password is compromised. Someone else knowing a password == compromise. It's that they compromised user passwords without their knowing it that is the issue. What you're saying is equivalent to "Yes, they stole your car, but they stored it in a safe garage". Not redeeming, at all.
  • swombat 17y ago
    No, this is equivalent to your gym using their master key to get into your private locker without telling you. They didn't steal the car - it's still there, right where it was. Broken analogies really don't help the discussion.
• ytinas 17y ago
  >They could simply be using a reversible encryption algorithm. I'm sorry, but this difference is completely trivial. Putting a password in some reversible encryption is just security by obscurity. In the worst case the people who managed to break into your site and steal all the passwords can just steal your magical decryption routine as well.