6 ms·

Reversible encryption algorithm that an admin can use to get my password and access my servers == same as clear-text to me... The problem is not that they can

• swombat 17y ago
  As others have pointed out, if you don't trust your host, you're hosed right from the start. If you want a private server, keep it in your closet. Having the password reversibly encrypted means that if someone gets their hands on a dump of the db, they will at least not be able to automatically gain access to millions of accounts with no effort. Depending on the encryption scheme used, it may even be extremely secure - for example, decryption could require sending the encrypted string to a different, extremely secure server off the WAN that answers with the password.
  • tptacek 17y ago
    In 15 years as a security professional and over 5 years directly consulting for big companies, little companies, locked down companies and lunatic companies, selling operating systems, browsers, parts of the power grid, cores of financial exchanges, retail banking applications, email management applications and to-do lists, I have never once seen the "extremely secure" system you allude to. I have seen lots of "reversable encryption", though. Maybe I've just gotten lucky in my career, and I just get the fun applications where people do this wrong. But there's no way GoDaddy did it right.
    • sailormoon 17y ago
      Nonetheless you must admit it is possible. If I did this, that's how I'd do it. Have a separate computer, locked down to the max, except for a couple of functions: accepting HTTP requests POSTing an encrypted password, then sending back the decrypted string. That function would be severely rate-limited. Another function, to confirm the hash of passwords, would not be rate-limited, allowing high volumes of website access. I could make that machine friggin' impregnable (and so could you). But yeah. No-one ever does it.
      • tptacek 17y ago
        I wouldn't do it at all. If I wanted escrowed access to a VM, I'd stick a "break glass" SSH key on the box. I'm not sure how "extremely secure" this "password-decrypting server" design really is, by the way. SQLI is often equivalent to remote code execution. Even when it isn't, XSS is equivalent to operator access, and operators can use the feature that decrypts the password. Passwords are hazmat. You shouldn't be storing them, at all.
        • sailormoon 17y ago
          Yeah. I used to disagree with you, but now I agree. You should write up a definitive guide for password security. For instance, I want to know if we should still use salts in the age of bcrypt, etc. Tell us what to do, man.
          • tptacek 17y ago
            I kind of don't want to be "the password guy".
            • sailormoon 17y ago
              Haha. I understand.
      • Nwallins 17y ago
        Um, sounds like an industry standard HSM http://en.wikipedia.org/wiki/Hardware_Security_Module http://en.wikipedia.org/wiki/Hardware_Security_Module
• andreyf 17y ago
  You have no idea what the procedure for this access is, or how exactly it's stored.