4 ms·

Clear text passwords? I thought it's 2016. If you are not using bcrypt/scrypt or similar in 2016 then you should change profession.

by lossolo 10y ago

varjag 10y ago
The founder now runs secure messaging service with roll-your-own crypto.
- strictnein 10y ago
  Yep. Pavel Durov was forced out by various Kremlin connected folk for daring to stand up to the FSB and the Kremlin. He also went public about their unlawful requests. He then fled Russia. edit: ugly sentence structure.
aleksi 10y ago
Yes, it's 2016, but they say that passwords were collected in 2011-2012/2013. Also, phrasing in Russian sources suggests that passwords were not dumped from DB, but actively collected by other means.
- cm2187 10y ago
  To get close to 50% of the user base? Sounds like a very very high success rate.
paulmd 10y ago
Or PBKDF2, which would be my preference in any stuffy corporate environment. Nobody ever got fired for following NIST/FIPS standards. I'd use bcrypt if I were working on my own project though. I think scrypt goes too far, I would actually be concerned about its speed and memory utilization hurting responsiveness for any sort of web server or other latency-sensitive system.
drakenot 10y ago
Just yesterday I clicked on the "Forgot Password" link on the AutoTrader.com website. I was expecting a reset link in my email and instead they just emailed me my password in cleartext. This is a huge website! Not some small business. It completely baffles me. I wish that there was some way to shame these companies. I've seen some websites that list some of these offenders but they don't appear to be effective enough. I want news articles written about these companies in the magazines that the CIOs care about, with their photo right next to the article.
- deleted 10y ago
  [deleted]
- asadlionpk 10y ago
  This seems to be the most popular collection: http://plaintextoffenders.com/ http://plaintextoffenders.com/ There should be a warning in the browser that these websites are known to store password in plaintext. This can be achieved by an extension too.
  - nacs 10y ago
    > This can be achieved by an extension too. In the website you linked, there is a "3rd party tools" link [1] that has a Chrome extension [2] and a Firefox addon [3] that do just that. [1]: http://plaintextoffenders.com/tools http://plaintextoffenders.com/tools [2]: https://chrome.google.com/webstore/detail/plain-text-offenders-aler/ggndaknbenjhnkddgjnjjcmomgaidhmd https://chrome.google.com/webstore/detail/plain-text-offende... [3]: https://addons.mozilla.org/en-US/firefox/addon/plain-text-offenders/ https://addons.mozilla.org/en-US/firefox/addon/plain-text-of...
FLUX-YOU 10y ago
You just dropped like 80% of the workforce

Clear text passwords? I thought it's 2016. If you are not using bcrypt/scrypt or similar in 2016 then you should change profession.

by lossolo 10y ago

Clear text passwords? I thought it's 2016. If you are not using bcrypt/scrypt or similar in 2016 then you should change profession.

varjag 10y ago

The founder now runs secure messaging service with roll-your-own crypto.

strictnein 10y ago
Yep. Pavel Durov was forced out by various Kremlin connected folk for daring to stand up to the FSB and the Kremlin. He also went public about their unlawful requests. He then fled Russia. edit: ugly sentence structure.

aleksi 10y ago

Yes, it's 2016, but they say that passwords were collected in 2011-2012/2013. Also, phrasing in Russian sources suggests that passwords were not dumped from DB, but actively collected by other means.

cm2187 10y ago
To get close to 50% of the user base? Sounds like a very very high success rate.

paulmd 10y ago

Or PBKDF2, which would be my preference in any stuffy corporate environment. Nobody ever got fired for following NIST/FIPS standards. I'd use bcrypt if I were working on my own project though. I think scrypt goes too far, I would actually be concerned about its speed and memory utilization hurting responsiveness for any sort of web server or other latency-sensitive system.

drakenot 10y ago

Just yesterday I clicked on the "Forgot Password" link on the AutoTrader.com website. I was expecting a reset link in my email and instead they just emailed me my password in cleartext. This is a huge website! Not some small business. It completely baffles me. I wish that there was some way to shame these companies. I've seen some websites that list some of these offenders but they don't appear to be effective enough. I want news articles written about these companies in the magazines that the CIOs care about, with their photo right next to the article.

deleted 10y ago
[deleted]
asadlionpk 10y ago
This seems to be the most popular collection: http://plaintextoffenders.com/ http://plaintextoffenders.com/ There should be a warning in the browser that these websites are known to store password in plaintext. This can be achieved by an extension too.
- nacs 10y ago
  > This can be achieved by an extension too. In the website you linked, there is a "3rd party tools" link [1] that has a Chrome extension [2] and a Firefox addon [3] that do just that. [1]: http://plaintextoffenders.com/tools http://plaintextoffenders.com/tools [2]: https://chrome.google.com/webstore/detail/plain-text-offenders-aler/ggndaknbenjhnkddgjnjjcmomgaidhmd https://chrome.google.com/webstore/detail/plain-text-offende... [3]: https://addons.mozilla.org/en-US/firefox/addon/plain-text-offenders/ https://addons.mozilla.org/en-US/firefox/addon/plain-text-of...

FLUX-YOU 10y ago

You just dropped like 80% of the workforce