22 ms·

The Effectiveness of Publicly Shaming Bad Security

580 points by MandieD 8y ago

lbriner 8y ago
It's sad that what Troy is arguing for sounds like the best we can expect right now and he is probably right. Ideally, there would be mandated processes for any commercial company like any serious security vulnerability must be fixable within x hours/days (if a fix is available) i.e. the excuse can't be, "we don't have the means or money to fix that right now" and there are certain things that seem to be accepted knowledge in the security community (like password managers) that somehow are allowed to be circumvented by random companies because they decided so. The real question is why isn't there a mandated list of global best-practice for web app security that can direct any acceptance test of any web site? Can't people like isaca and isc2 agree something and make it the gold-standard?
- zentiggr 8y ago
  And every manager (but for a few well informed) will scream every time that gold standard has to be adjusted for new zero-days and completely new vectors etc etc, forcing rewrites over and over. Never underestimate the power of inertia.
QasimK 8y ago
I really dislike websites that prevent the use of password managers by disabling the ability to paste. Recently[0], I discovered that you can stop websites from doing this in Firefox by setting dom.event.clipboardevents.enabled = false. This has already improved my quality of life slightly. [0]: https://gist.github.com/0XDE57/fbd302cef7693e62c769 https://gist.github.com/0XDE57/fbd302cef7693e62c769
- Joe8Bit 8y ago
  While true, it’s a bit of a blunt force solution as it prevents all clipboard events (e.g. no ‘click here to copy’ anymore). That may be a reasonable compromise for some, but I’ve seen some weird broken behaviour as a result of people using this FF toggle.
  - SOLAR_FIELDS 8y ago
    Could you have an extension with a toggle that turns it off temporarily only for password entry? Or even better UX, integrate it into the password manager extensions such that the temporary action is invisible to the end user? It would toggle the switch off during login, and toggle it back on after. Perhaps it's not a good idea to code too much browser-specific behavior into this stuff on the other hand.
    - donatzsky 8y ago
      There's an extension already that does that. It's called Don't Fuck with Paste or something like it.
  - Klover 8y ago
    Isn’t this the default behaviour in Safari though? That’s a browser that’s used by a lot of mobile phones, and it doesn’t seem to be problematic enough for it to be changed. I think this is what Safari does at least, because the Google website tells me to hold and copy the links instead of just holding it like on my Android phone.
- pbhjpbhj 8y ago
  There's some sort of counter to this I have it enabled but Facebook still prevents me from pasting (sometimes! Pasting deletes the rest of the comment and closes the reply box, super annoying). Some sites still prevent password pasting too -- but I've found you can drag-drop in both situations to work around the restriction.
- aaronmdjones 8y ago
  I already set this to false so that news websites can't hijack my copy functionality to insert "Read more: <tracking link>" at the end of anything I copy from the article.
- jiveturkey 8y ago
  On Chrome, you can install the 'don't fuck with paste' extension.
Steer 8y ago
The Swedish Bank ID also disallows copy/paste of passwords. When I contacted the company that builds the solution I got more or less the same response, "it is safer for normal users" which I didn't really understand. Highly annoying.
- zorked 8y ago
  I have heard the argument that regular users often believe that copying and pasting passwords makes them immune to keylogging, so allowing that will cause some of them to keep a copy of their password on a plaintext file on their desktop where otherwise they would just type from memory. Not sure if that's what banks are thinking about.
  - hazz99 8y ago
    Probably a dumb question, but doesn't copying & pasting protect against keylogging? The only key events being sent is CTRL+C and CTRL+V (or the mouse equivalent), and not the password keys themselves. Obviously this is an extremely bad way to "protect" yourself (since you keep your password in plaintext on your PC), but it does protect against keylogging, right?
    - TheCoelacanth 8y ago
      Maybe keylogging in the strictly literal sense, but I think most software "keyloggers" log the clipboard too. I suppose it would protect you from a physical keylogger.
      - user5994461 8y ago
        To clarify, it is not a maybe, keyloggers definitely monitor the clipboard. It's one of the most basic features of a key logger. Another basic features is logging the active window/process to know where the user is currently writing to.
    - bluGill 8y ago
      Correct, it does foil key logging. However in general installing a key logging is harder to pull off than just copying all files from the machine in question. Of course it depends on which known unpatched security hole exists on the system at the time. However in general a program is more likely to be able to read arbitrary files.
eric_b 8y ago
Troy's stance makes me uneasy. I'm sure publicly shaming these companies is effective, but where does the line get drawn? In my experience the infosec community strongly believes security is the most important thing, full stop. So they feel no qualms about using every trick in the book to get their way. But two things about this trouble me. The first is, have we decided that the ends always justify the means? It seems in other domains public shaming is unacceptable. Troy himself despises Donald Trump, but one of the things most heinous about 45 is his use of Twitter to publicly ridicule and shame companies and individuals. And now Troy is engaging in exactly the same behavior. But it's "OK" this time? What is different? The second thing that troubles me is security "best practices" today may not be best practices tomorrow. Some of his example companies are using practices that were "best" 10 years ago. What happens in another 10 years when Troy's current advice is outdated? More pitchforks? The security treadmill is hard for even the most modern tech companies to stay on. I think the infosec community could go a long way to helping itself by making easier to use tools, and writing canonical guides for common scenarios. Setting up HTTPS to get an "A" from SSLLabs is non-trivial. Securing SSH with perfect forward secrecy is near impossible for a mortal. There's no reason it has to be this complicated. Edit: To the people who couldn't get past the first sentence of my last paragraph. I'm not saying that because the security treadmill is hard the companies get a pass. I'm saying the infosec community has a responsibility to make it easier to stay on it. If the barrier to securing something appropriately was so low you could trip over it, we wouldn't have this many problems.
- vorpalhex 8y ago
  You're right, we should be totally OK with a company that makes profit off of us using 10 year old outdated security techniques - we wouldn't want to be rude. Imagine you went to an amusement park and saw the rides were being operated unsafely. No seatbelts, no safety protocols, no even making sure passengers were seated first. Do you stay quiet because after all, the teenager running the ride probably didn't invent the safety protocol? Sure, someone might get beheaded, but you don't want to be rude. > The security treadmill is hard for even the most modern tech companies to stay on That is nonsense. If you have the resources to track me across the web, hold vast amounts of my private information and profit off of me, you'd best damn invest in basic security practices like SSL and encryption at rest. If you don't have the in-team expertise, bring in a consultant. These aren't Mom & Pop ice cream shops, these are major international companies and banks - stop cheaping out on security to save a few pennies.
_pdp_ 8y ago
I generally agree but would you place your security in the hands of some 3rd-party providers such as password managers? If you do that then their problems instantly become your problems. I am not saying that password managers are without any merit and/or useful. All I am saying is that although security decisions are often made without much thought process there are situations where there are some hard requirements based on a multitude of factors which are not publicly discussed. It is easy to brush it all off as a 3rd-party observer but in reality nothing is perfect and considering that a lot of the people on this forum are actual developers you must be well aware of the countless compromises you had to make that go against security best-practices... :) common on. What Troy is discussing are cases of trivial matter of negligence - hardly breaking the bank and I can assure you that in many circumstances the security budget required to implement some of the necessary improvements outspend the annual fraud budget. This is hardly makes an argument if you need to justify your department running cost. Yes shaming kind of works, sometimes... but honestly these companies have much bigger internal problems than reconsidering their whole stance on usefulness of password managers and the risk levels their are willing to accept.
- n4r9 8y ago
  > would you place your security in the hands of some 3rd-party providers such as password managers? I don't know if I can think of a better solution than an open-source password manager which encrypts and stores everything locally. Unless you have an incredible memory. > but honestly these companies have much bigger internal problems than reconsidering their whole stance on usefulness of password managers I guess Troy is just focusing on what he knows best.
  - auslander 8y ago
    > I don't know if I can think of a better solution than an open-source password manager Sure, KeePass(XC) > I guess Troy is just focusing on what he knows best No, KeePass(XC), as you said, stores everything locally, no Troy needed.
    - n4r9 8y ago
abarringer 8y ago
Troy and Krebs should team up to create a security hall of shame and only remove companies when issues are fixed. We have security vendors who have sslv2 enabled and they can't understand why that's an issue. We have huge fortune 250 companies that we exchange full credit card data with that have TLS 1.0 enabled with Symantec certs and only two weak ciphers. I sent them an ssl labs report and they accused me of breach of contract for hacking the site. This list of security and finance related vendors that are double facepalm worthy is just astonishing.
- tempuser24 8y ago
  http://attrition.org/ http://attrition.org/ does this, though it doesn't look like they've kept up with companies.
  - medecau 8y ago
    attrition.org doesn't even provide HTTPS.
    - Sohcahtoa82 8y ago
      Wow...how can a site about security not support HTTPS?
- tombrossman 8y ago
  I'm doing this in the community where I live and I have discovered that it is super effective. I send an email to each company explaining a security problem with their site (currently focusing on simple lack of HTTPS for form data, and not mentioning the public disclosure because I want to see who fixes things because they care vs. those just avoiding negative publicity) and if they haven't resolved it or replied within a week, I list them publicly on https://www.insecure.org.je https://www.insecure.org.je. The site isn't winning me any design awards and needs expanding of the advice articles, but dozens of local companies are immediately spurred to action when they appear in the "Sites requiring extra caution" section. Thousands of local users have directly benefited by the added security, even though they are completely unaware of why it was upgraded. The reaction from some business has been very predictable, with a mix of hostility, threats, confusion, outright lies, but enough respond politely and want to fix things, and I go out of my way to help those who want to learn. Source is public and if you want to try this locally, I highly recommend it: https://gitlab.com/tombrossman/insecure.org.je https://gitlab.com/tombrossman/insecure.org.je
murph-almighty 8y ago
I can think of one exception to Troy's claim: companies that hold data of people who aren't their customers. No amount of shaming Equifax would have fixed their practices, because we can't choose to not have our data collected by them.
nathantotten 8y ago
> You see, they knew this process sucked - any reasonable person with half an idea about security did - but the internal security team alone telling management this was not cool wasn't enough to drive change. Negative media coverage, however, is something management actually listens to. I could not agree more with this statement.
auslander 8y ago
I don't trust Troy anymore. He pushed into the Firefox 1Password and Cloudflare based password checks. "Praises for Troy, Troy praises 1Password and Cloudflare..." https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342 What happened to this 'integration' effort, btw?
- Operyl 8y ago
  Why would that result in loss of respect/trust? k-anonymity works great and is perfect for application into password managers and on-registration password security checks.
  - auslander 8y ago
    The combination of 'Baking HIBP into Firefox' and 'Cloudflare did some great work' and 'sends this to the API' just sounds bad. We are talking passwords here, for god's sake, I want nothing be sent nowhere, let my browser and me alone.
    - Operyl 8y ago
      OK, calm down for a minute. You need to read how k-Anonymity works before you continue to comment on this: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with... It isn't sending a plaintext password, not even a full hash of the password. This is entirely fine..
      - auslander 8y ago
        > This is entirely fine.. ... until it doesn't. Any update on did this HIBP 'feature' made it into Firefox?
        Operyl 8y ago
        You’ve yet to tell me when it’s not fine. Can you please provide some citations or technical reasonings besides just putting forward unsubstantiated claims? Below you've told jgahramc you refuse to read how it works, then you probably shouldn't make claims on this.
nickray 8y ago
https://login.swissid.ch https://login.swissid.ch does this too: disallow password managers from filling out the login. Upon asking them to fix: "Autofill completion is not allowed by us for security reasons. First, if that's the case, if someone gets to your PC, we can stop a hacking attempt and that's one of many reasons. For other questions, we are at your disposal." They also only enforce SMS as two-factor authentication. The idea of this SwissID is to become a nation-wide identity service, yet they manage to do everything wrong. Yeah, this annoys me to no end :(
- sschueller 8y ago
  Me too as we already had an attempt called suisse ID (10 years ago now?) and mobile ID. Both which cost money limiting adaption greatly. Personaly I like mobile Id which makes logging into PostFinance or swisscom easy but not all phone providers are able to offer it. Sucks that for post and sbb I need yet another system, Swiss id....
  - ThePadawan 8y ago
    Notably, SwissPass did not allow me to set a randomly generated, very long (>20 character) password. It also didn't notify me that it didn't allow such passwords, it just went right ahead and created an account it was impossible to log in to. Thankfully, I was able to reset the password to one which is far unsafer. Well done everyone.
    - davchana 8y ago
      India Government's official Website for managing public retirement fund, NPS, eNPS does this. Password need to be changed every 90 days, of max 14 characters length, but no where documented. On password change page, it will silently accept your any 14+ length password & will truncate it to 14. Then you try to login with your actual password, it gives error, Wrong Password.
      - FabHK 8y ago
        That's just stunningly bad (both the 90 days reset, and the silent (!) truncation to 14 characters...)
zimbatm 8y ago
It's quite scary to think that a bank only fix obvious security issues after public shaming. There are a lot of internal services in a bank that are not exposed to the scrutiny of security researchers and will therefor never get patched.
- zentiggr 8y ago
  Right, and that applies to probably all but a small percentage of organizations. Not malice, just management that doesn't properly account for the negatives involved in poor security policy. Banks are no exception to the rule that all the managers are humans, and may not have the best information / mindset. Fix the lowest hanging fruit as fast as possible, and raise the mean incrementally.
- lostapathy 8y ago
  What sucks is that for every breach you hear about, odds are somebody “on the inside” has tried to raise the alarm and been ignored, or marginalized, for it. Then after the breach they often take it very hard. To the extreme, a former employer suffered a major breach (after I was gone) and from what I heard a really great dev was distraught to the point I worried he might be suicidal. All made worse because the organization as a whole didn’t learn, there were no obvious consequences for the management at fault, so he took it even more personally, when it truly wasn’t his fault a breach happened. We need a way to give these people a voice before bad things happen, not just therapy after something they saw coming goes bad.
- lolc 8y ago
  Yes! What does it say about internal security if a bank leaves its mailbox unlocked. (The postal equivalent of not using SSL.) For those that would prefer other methods because public shaming doesn't fix everything: Let's look at some scenarios what (successful) shaming of publicly available services could do: 1. lead to audit and discovery of the issues in the internal services 2. bolster the argument of internal people who argue for security improvements 3. reset priorities to fix issues in public instances instead of fixing internal ones
  - 8y ago
amarant 8y ago
the worst of all are those that allow you to paste the password when you setup the account, but not on login. this leads to a situation where I have a 100 digit hashed password I have to type in by hand. usually I just create a new account, preferably somewhere else.
- fatboy 8y ago
  In macOS I use Keyboard Maestro, which allows you to create a macro that pastes the current clipboard by typing. Very handy for these no-paste text boxes.
- drakenot 8y ago
  I created an account for a 401k vendor that our company recently switched to. During the registration process I used a password manager to generate a 14 digit random password. Imagine my surprise when I went to login to the newly created account only to find out that the login screen enforced a character limit of 8 characters (both with a textfield attribute and js). This limitation was not enforced during registration! I had to edit the page in developer tools so I could actually paste my full password to login. The limitation was purely client side.
  - retrodpc 8y ago
    Ouch. So the server still accepted the 14-char password, even if the login page didn't allow it?
  - amarant 8y ago
    haha whaat? they had a limit of 8 chars MAXIMUM? that's usually the minimum limitation! at least they had implemented the first rule of it-security: perform all checks client-side only ;)
gerardnll 8y ago
Social media is used by companies to improve their public perception but we cannot ‘shame’ them by its bad practices. No way. And if the Community managers throw lies we have to also shut up? Respect always, but the ‘shaming’ are not CManagers fault because security decisions are not taken by them but other people so they shouldn’t feel bad by the public response.
marek995 8y ago
A question: I know of some companies and banks with such issues. I am no Troy Hunt - what would you do about this? Public shaming doesn't really work when you aren't a public person. Also this is in non-english environment, so there are no such public figures...
- mayneack 8y ago
  Most of those Troy Hunt examples were submitted to him by non-public people. You could probably just email/tweet him. smaller scale: http://plaintextoffenders.com/ http://plaintextoffenders.com/
AdmiralAsshat 8y ago
An add-on/extension I've found useful for combating this behavior on certain financial websites is Don't Fuck With Paste: https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb https://chrome.google.com/webstore/detail/dont-fuck-with-pas... https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...
oxplot 8y ago
I wrote about non secure contact pages of various banks in Australia back in 2014 [1] and sent them all private messages. Didn't hear back from a single one saying they were working on it. Haven't checked lately to see how or if they changed. [1]: https://blog.oxplot.com/non-secure-contact-page/ https://blog.oxplot.com/non-secure-contact-page/
auslander 8y ago
The only true, safe password manager is the one that stores its database in a local, master password encrypted file, likee KeePass(XC), open source. Anything else is trusting third-party.
arayh 8y ago
This reminds me of the fiasco regarding Virgin Media over Twitter: https://twitter.com/virginmedia/status/595135419152474112 https://twitter.com/virginmedia/status/595135419152474112 I think companies need to mandate some kind of improved protocol for responding to these sort of tweet storms. It always seems to be people who are technically inclined talking to a social media representative with little to no knowledge of standard security practices, which leads to attempts to calm the masses, but ultimately backfires.
thomaspaine 8y ago
Law suits seem to be the standard tactic for dealing with other types of corporate negligence (for better or worse). Why aren't they employed more for these types of obvious security vulnerabilities if you can demonstrate harm?
- manigandham 8y ago
  Considering Equifax basically had 0 consequences, legal work is incredibly expensive and ineffective unless someone gets seriously injured or dies.
coleifer 8y ago
I have compassion for these people who made these ludicrous comments -- they clearly aren't cryptographers or digital security experts. Let's separate the people making these comments from the corporations they represent. Public shaming of a person is never the right response, in my opinion -- live and let live. Public shaming of a corporation, on the other hand, may be the only way to get the attention of the decision-makers. Let's be kind and compassionate to individuals.
- taf2 8y ago
  and remember that corporations are by definition a collection of individuals... is public shaming really the only way to get through to the decision makers? I hate the thought of regulations... but maybe there is a $$ solution here?
- blauditore 8y ago
  Yeah, in many of those tweets you can almost feel that the person writing it is trying to reiterate something they don't fully understand.
- lultimouomo 8y ago
  To be clear: do you count shaming an official corporate account as shaming a corporation or as shaming the person that actually write the tweets? Because of course corporations will always put a person in front of, so that you feel bad for speaking the truth. That's why official corporation tweets often carry a signature with a person first name - it reminds me of Pennac's Malaussène, who by trade is a professional scapegoat.
- kodablah 8y ago
  My compassion dies when their humility does. You cannot affect attitude towards disclosures by accepting the existing attitude. Compassion is bidirectional. A "we will investigate and get back shortly", or a "our internal team has investigated and here is their answer: '...'" is much more appropriate. Several companies' social media responders are courteous. Excusing corporate condescension mouthpieces just encourages the practice.
auslander 8y ago
Don't trust Troy. He pushed into the Firefox 1Password and Cloudflare based password checks. https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342 What happened to this 'integration' effort, btw?
adrian_mrd 8y ago
It would be interesting to ascertain how many times users' on social media flag a security problem to a company's social media team that isn't actually a security problem? In other words, how many false negatives get caught too? Troy Hunt's post is really told from the victor's perspective (likely a bias rather than intentional or arrogance), but to form a well-rounded view, understanding how many false negatives would likely help...
- gowld 8y ago
  If the flagging is respectful and the user is mistaken, either they will apologize for the mistake or it's up to the community to lower that user's influence. Troy Hunt is retweeted and upvoted and made famous because he has built a good reputation.
nautilus12 8y ago
So the question is why don't companies have infosec individuals seriously looking into issues raised by a user seriously because its in their best interest to avoid bad PR and public shaming which will be the logical next step if they ignore it. Is the shaming necessary? Do corporations only respond to an issue when it blows up? Seems like bad stewardship.
kodablah 8y ago
> But the hesitation quickly passed as he proceeded to thank me for the coverage. You see, they knew this process sucked - any reasonable person with half an idea about security did - but the internal security team alone telling management this was not cool wasn't enough to drive change. Negative media coverage, however, is something management actually listens to. Sounds like justification for bad-security whistle blowing too. The downside of encouraging it is that you are easily deanonymized if you had attempted to bring it up internally before. We need a, possibly crowd funded, corporate bad-security whistle blowing foundation that contacts your own company on your behalf and then publicly shames them if they don't fix the issue.
auslander 8y ago
I wouldn't trust troyhunt.com. He was trying to put passwords checks using third-party APIs into Firefox. https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342
auslander 8y ago
Streisand effect in its best :) I wouldn't trust Troy. He was trying to put passwords checks using third-party APIs, Cloudflare and 1Password into Firefox code. https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342
- doque 8y ago
  Not password checks, but rather "does my email appear on haveibeenpwnd.com".
  - auslander 8y ago
    The very passwords: "k-anonymity" model which works like this: when searching HIBP for a password, the client SHA-1 hashes it then ... sends this to the API. https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/ https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...
    - Shengbo 8y ago
      This implementation has no value to potential attackers. Anything it could -if it could- help you with, you can already do without it.
    - FabHK 8y ago
      According to the description in the linked article, only the first 5 characters of the hash of the password are sent to the API (and that API is not publicly available in the first place, apparently, but can only be accessed via Mozilla or 1Password's own APIs). What exactly appears to be the problem? The reasoning for this feature is clearly laid out, and the underlying "ethics of running a database breach search service", while controversial, are also something Troy has thought about very carefully: https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/ https://www.troyhunt.com/the-ethics-of-running-a-data-breach...
      - auslander 8y ago
auslander 8y ago
To Moderators: I claim Frivolous flagging on https://news.ycombinator.com/item?id=17958620 https://news.ycombinator.com/item?id=17958620 From FAQ ... flagging a story that's clearly on-topic by the site guidelines just because one personally dislikes it— eventually gets an account's flagging privileges taken away.
Dirlewanger 8y ago
I can imagine it's a really shitty situation for e.g. smaller banks here in the US. Most of them don't have the resources to build their own custom back end services, so many outsource the tech. And then shit like Fiserv getting hacked the other week happens, and not only is Fiserv's reputation hurt but so is all their client's. I'd love to "bank local", but when shit like that happens, the only way I'd feel safe with my finances is by going with the Bank of Americas/Fidelity's/etc. over Mom & Pop Credit Union.
- gowld 8y ago
  That calls for startups to build good tech for these companies to all use.
  - Dirlewanger 8y ago
    Very, very difficult in fintech. Very high barrier to entry. The Paypals/Venmos/Acorns of the world have been increasingly getting into the traditional banking realm, offering checking account/debit card products, but their back ends are still the same old slow companies. Polishing a turd essentially.
pentae 8y ago
"Now, keeping in mind that the username is your email address and that many among us like cake and presents and other birthday celebratory patterns, it's reasonable to say that this was a ludicrous statement." This is when I lost it. Bloody good read.
auslander 8y ago
Beware, don't trust anyone in this digital age. Troy was pushing third-party APIs, Cloudflare and 1Password into Firefox code. https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342
auslander 8y ago
That thread costed me 38, edit, 50 karma points. Well spent ones, bring it on :))
- sctb 8y ago
  Please stop doing this or we'll ban the account.
srinivasan 8y ago
Didn't browsers take a stand a few years ago by ignoring "autocomplete=off" on password fields? I think it’s about time browsers start ignoring any onpaste events on password fields. I’m curious what Chromium folks think - have there been tickets about this? It would be a great way to end this dumb practice.
- kevincox 8y ago
  Firefox has the dom.event.clipboardevents.enabled pref which can be used to prevent a lot of web naughtiness however it does break a couple of legitimate use cases.
  - aaronmdjones 8y ago
    Firefox also has signon.storeWhenAutocompleteOff (default true) which ignores such hints.
jedberg 8y ago
> You see, they knew this process sucked - any reasonable person with half an idea about security did - but the internal security team alone telling management this was not cool wasn't enough to drive change. Negative media coverage, however, is something management actually listens to. It's even better when the internal person tips off the press to initiate the public shaming to take to management. Never happened in an organization that I worked in, but I know security people in other orgs that had to resort to these tactics.
- gowld 8y ago
  Yup. https://en.wikipedia.org/wiki/Deep_Throat_(Watergate) https://en.wikipedia.org/wiki/Deep_Throat_(Watergate)
manigandham 8y ago
The worst offenders are max password length limits, especially tiny ones like 8 characters. It's a guarantee that the service does not properly hash and store passwords.
- jedberg 8y ago
  That usually happens on banking sites because their system is backed by an old mainframe that can only handle 8 characters. The second thing you said is right though -- they probably have terrible security on that mainframe.
  - manigandham 8y ago
    Why does the accounts system have to use that mainframe?
    - jedberg 8y ago
      In most cases it's because the mainframe holds all the customer data and is the system of record, and it's just easier to do it that way.
  - pps43 8y ago
    They could still hash the long password, without trimming, and store 64 bits of that hash.
    - jedberg 8y ago
      True, but then you'd have to make sure that all software that accesses that field is aware of the hash, and chances are if you have a legacy system like that, you have legacy software too.
  - chatmasta 8y ago
    NatWest goes a step further and asks you to enter (for example) “the 1st, 5th, 8th and 9th character of your password.” I saw a comment once explaining why this might make sense to prevent replay attacks. But it seems awfully absurd.
bostik 8y ago
I'm mildly surprised no-one has so far drawn the similarity to full-disclosure. Because let's be fair, this practice is full-disclosure. Of bad practices. And as we've seen over the past 2+ decades - FD works. Once you draw attention to an insecure system, resources to fix it will be found. (Enough of the time, at least.)
- gowld 8y ago
  This is different from full disclosure because (1) in many cases the information is directly visible to the commmon user or publicly advertised by the company already, and (b) the insecurities aren't immediately directly exploitable (like plaintext passwords), just a risk factor in case of a hack.
Animats 8y ago
The trouble is, it won't scale. If an announcement like that comes out several times a day, it's not news.
- orblivion 8y ago
  There was the example of the company that saw the BBC article and was scared into compliance. Perhaps if he keeps up the approach of keeping the shaming events rare and brutal, it can be enough of a psychological effect to corral other companies into compliance until there are only a few cases remaining, at which point you could just go after them individually without creating a news burnout.
- deleted 8y ago
  [deleted]
chatmasta 8y ago
I tried [0] to stir one of these up for coral.co.uk which also forces (via a downgrade redirect) insecure login over http. Unfortunately my tweet didn’t get much attention, although I did get the “Don’t worry! You can login without any doubts!” reply from Coral. Not sure if it’s still the case (think they recently did a redesign and hopefully fixed it; I’ll check tonight). If it is, I would appreciate some more attention on this issue! [0] https://mobile.twitter.com/milesrichardson/status/1017195538213634049 https://mobile.twitter.com/milesrichardson/status/1017195538...
deleted 8y ago
[deleted]
lifeisstillgood 8y ago
This suggests to me a more democractic approach to corporate culture / action. Let's say we have a giant backlog of work, each item ranked by voting by employees Now the security team adds their "Stop sending passwords in plain text" item. Which companies will it get voted up in?
peterwwillis 8y ago
Ego, embarrassment, lack of taking someone seriously, ignorance, and laziness all contribute to not taking security reports seriously, and results in creating rationalizations to prevent fixing them. At that point, you need pressure to create change. Shame definitely works, but it isn't professional, and it isn't nice at all. Many people may be open to help if you can get off of Twitter. You can send a positive letter through a private channel that details the problem and offers help in fixing it. You can make an automated, impartial test that clearly proves the problem and provides links to fixes. Failing these, you can start a petition. You can have famous, well respected, and powerful people sign it. You can add carrots and sticks, like an award for security response, a hall of shame entry, or the nuclear option, a PR release and interview with national media about the dangers of the problem. Even just sending a list of these problems as they have happened in the past and how they resolved to executives at the company is probably all the visibility needed to get the ball rolling.
Bhilai 8y ago
Public shaming definitely works but there is only so many times you can play this card. It may give you quick small wins but such organizations which downplay or do not understand fundamental security concepts have many other serious security/technical debt which eventually leads to a breach.
cocoflunchy 8y ago
Meanwhile 90% of the banks in France use a 6-digit password that you can't paste because you have to enter it by clicking on a super-secure-random grid... https://imgur.com/a/q91JDXi https://imgur.com/a/q91JDXi Maybe Troy Hunt can publicly shame them into more secure practises but I'm not hopeful.
- aaronmdjones 8y ago
  My bank's (Lloyds TSB) idea of extra security beyond a password is ... yet another password, but one that you have to select 3 random digits of, in dropdown boxes. I asked them for TOTP 2FA, but never got a response... Why is it always banks who have some of the worst security posture out there? I fully expect my bank to eventually implement 2FA ... by SMS! Thinking that it's a good idea! sigh
  - simonbyrne 8y ago
    A common work around is to make them all the same: that way you don't have to think which ones to type.
- jiveturkey 8y ago
  that actually is secure ... if you have a secure display
  - loeg 8y ago
    In the same sense that a password manager is secure if you have a secure keyboard.
- user5994461 8y ago
  It's secure. It defeats keyloggers and it prevents the password from being remembered by the browser and enumerated. It's usually a PIN that is set by the bank rather than the user, to prevent people from using 123456 or their date of birth.
  - 8y ago
orblivion 8y ago
Could there also be a thing where you go out of your way to praise? It seems that the combination of carrot and stick seems to be good for persuasion.
richrichardsson 8y ago
I had a bit of a rant in a job interview about how storing plain text passwords was something only idiots do. I got the job and lo and behold the main feature being worked on when I started 3 weeks later was "encrypt passwords field". So even inadvertant direct private shaming can effect change!
kovek 8y ago
Why was the situation with the page that does not ask for credentials and does not use https considered unsafe? Is the worry that a man in the middle could change the Login link to a different website?
- redwards510 8y ago
  Yes, exactly.
move-on-by 8y ago
A big takeaway for me is how the internal security teams knew it was bad and couldn't make a case for the change. Once a process is in place, it takes a well delivered argument to make a change. Not allowing paste into password fields is a prime example of something that seems like a good practice, but isn't. If anyone is reading this and needs to convince others to allow paste, NIST says to allow pasting passwords, and that it improves security: > Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets. [1] People will no doubt still say it's bad, but its a fact that the National Institute of Standards and Technology says to allow paste, and that it improves security [1] https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html
presscast 8y ago
Let's take a step back and ask ourselves this: when did banks end up with some of the least secure websites? It's so common we've become oblivious to how frightening this is.

580 points by MandieD 8y ago

It's sad that what Troy is arguing for sounds like the best we can expect right now and he is probably right. Ideally, there would be mandated processes for any commercial company like any serious security vulnerability must be fixable within x hours/days (if a fix is available) i.e. the excuse can't be, "we don't have the means or money to fix that right now" and there are certain things that seem to be accepted knowledge in the security community (like password managers) that somehow are allowed to be circumvented by random companies because they decided so. The real question is why isn't there a mandated list of global best-practice for web app security that can direct any acceptance test of any web site? Can't people like isaca and isc2 agree something and make it the gold-standard?

zentiggr 8y ago
And every manager (but for a few well informed) will scream every time that gold standard has to be adjusted for new zero-days and completely new vectors etc etc, forcing rewrites over and over. Never underestimate the power of inertia.

QasimK 8y ago

I really dislike websites that prevent the use of password managers by disabling the ability to paste. Recently[0], I discovered that you can stop websites from doing this in Firefox by setting dom.event.clipboardevents.enabled = false. This has already improved my quality of life slightly. [0]: https://gist.github.com/0XDE57/fbd302cef7693e62c769 https://gist.github.com/0XDE57/fbd302cef7693e62c769

Joe8Bit 8y ago
While true, it’s a bit of a blunt force solution as it prevents all clipboard events (e.g. no ‘click here to copy’ anymore). That may be a reasonable compromise for some, but I’ve seen some weird broken behaviour as a result of people using this FF toggle.
- SOLAR_FIELDS 8y ago
  Could you have an extension with a toggle that turns it off temporarily only for password entry? Or even better UX, integrate it into the password manager extensions such that the temporary action is invisible to the end user? It would toggle the switch off during login, and toggle it back on after. Perhaps it's not a good idea to code too much browser-specific behavior into this stuff on the other hand.
  - donatzsky 8y ago
    There's an extension already that does that. It's called Don't Fuck with Paste or something like it.
- Klover 8y ago
  Isn’t this the default behaviour in Safari though? That’s a browser that’s used by a lot of mobile phones, and it doesn’t seem to be problematic enough for it to be changed. I think this is what Safari does at least, because the Google website tells me to hold and copy the links instead of just holding it like on my Android phone.
pbhjpbhj 8y ago
There's some sort of counter to this I have it enabled but Facebook still prevents me from pasting (sometimes! Pasting deletes the rest of the comment and closes the reply box, super annoying). Some sites still prevent password pasting too -- but I've found you can drag-drop in both situations to work around the restriction.
aaronmdjones 8y ago
I already set this to false so that news websites can't hijack my copy functionality to insert "Read more: <tracking link>" at the end of anything I copy from the article.
jiveturkey 8y ago
On Chrome, you can install the 'don't fuck with paste' extension.

Steer 8y ago

The Swedish Bank ID also disallows copy/paste of passwords. When I contacted the company that builds the solution I got more or less the same response, "it is safer for normal users" which I didn't really understand. Highly annoying.

zorked 8y ago
I have heard the argument that regular users often believe that copying and pasting passwords makes them immune to keylogging, so allowing that will cause some of them to keep a copy of their password on a plaintext file on their desktop where otherwise they would just type from memory. Not sure if that's what banks are thinking about.
- hazz99 8y ago
  Probably a dumb question, but doesn't copying & pasting protect against keylogging? The only key events being sent is CTRL+C and CTRL+V (or the mouse equivalent), and not the password keys themselves. Obviously this is an extremely bad way to "protect" yourself (since you keep your password in plaintext on your PC), but it does protect against keylogging, right?
  - TheCoelacanth 8y ago
    Maybe keylogging in the strictly literal sense, but I think most software "keyloggers" log the clipboard too. I suppose it would protect you from a physical keylogger.
    - user5994461 8y ago
      To clarify, it is not a maybe, keyloggers definitely monitor the clipboard. It's one of the most basic features of a key logger. Another basic features is logging the active window/process to know where the user is currently writing to.
  - bluGill 8y ago
    Correct, it does foil key logging. However in general installing a key logging is harder to pull off than just copying all files from the machine in question. Of course it depends on which known unpatched security hole exists on the system at the time. However in general a program is more likely to be able to read arbitrary files.

eric_b 8y ago

Troy's stance makes me uneasy. I'm sure publicly shaming these companies is effective, but where does the line get drawn? In my experience the infosec community strongly believes security is the most important thing, full stop. So they feel no qualms about using every trick in the book to get their way. But two things about this trouble me. The first is, have we decided that the ends always justify the means? It seems in other domains public shaming is unacceptable. Troy himself despises Donald Trump, but one of the things most heinous about 45 is his use of Twitter to publicly ridicule and shame companies and individuals. And now Troy is engaging in exactly the same behavior. But it's "OK" this time? What is different? The second thing that troubles me is security "best practices" today may not be best practices tomorrow. Some of his example companies are using practices that were "best" 10 years ago. What happens in another 10 years when Troy's current advice is outdated? More pitchforks? The security treadmill is hard for even the most modern tech companies to stay on. I think the infosec community could go a long way to helping itself by making easier to use tools, and writing canonical guides for common scenarios. Setting up HTTPS to get an "A" from SSLLabs is non-trivial. Securing SSH with perfect forward secrecy is near impossible for a mortal. There's no reason it has to be this complicated. Edit: To the people who couldn't get past the first sentence of my last paragraph. I'm not saying that because the security treadmill is hard the companies get a pass. I'm saying the infosec community has a responsibility to make it easier to stay on it. If the barrier to securing something appropriately was so low you could trip over it, we wouldn't have this many problems.

vorpalhex 8y ago
You're right, we should be totally OK with a company that makes profit off of us using 10 year old outdated security techniques - we wouldn't want to be rude. Imagine you went to an amusement park and saw the rides were being operated unsafely. No seatbelts, no safety protocols, no even making sure passengers were seated first. Do you stay quiet because after all, the teenager running the ride probably didn't invent the safety protocol? Sure, someone might get beheaded, but you don't want to be rude. > The security treadmill is hard for even the most modern tech companies to stay on That is nonsense. If you have the resources to track me across the web, hold vast amounts of my private information and profit off of me, you'd best damn invest in basic security practices like SSL and encryption at rest. If you don't have the in-team expertise, bring in a consultant. These aren't Mom & Pop ice cream shops, these are major international companies and banks - stop cheaping out on security to save a few pennies.

_pdp_ 8y ago

I generally agree but would you place your security in the hands of some 3rd-party providers such as password managers? If you do that then their problems instantly become your problems. I am not saying that password managers are without any merit and/or useful. All I am saying is that although security decisions are often made without much thought process there are situations where there are some hard requirements based on a multitude of factors which are not publicly discussed. It is easy to brush it all off as a 3rd-party observer but in reality nothing is perfect and considering that a lot of the people on this forum are actual developers you must be well aware of the countless compromises you had to make that go against security best-practices... :) common on. What Troy is discussing are cases of trivial matter of negligence - hardly breaking the bank and I can assure you that in many circumstances the security budget required to implement some of the necessary improvements outspend the annual fraud budget. This is hardly makes an argument if you need to justify your department running cost. Yes shaming kind of works, sometimes... but honestly these companies have much bigger internal problems than reconsidering their whole stance on usefulness of password managers and the risk levels their are willing to accept.

n4r9 8y ago
> would you place your security in the hands of some 3rd-party providers such as password managers? I don't know if I can think of a better solution than an open-source password manager which encrypts and stores everything locally. Unless you have an incredible memory. > but honestly these companies have much bigger internal problems than reconsidering their whole stance on usefulness of password managers I guess Troy is just focusing on what he knows best.
- auslander 8y ago
  > I don't know if I can think of a better solution than an open-source password manager Sure, KeePass(XC) > I guess Troy is just focusing on what he knows best No, KeePass(XC), as you said, stores everything locally, no Troy needed.
  - n4r9 8y ago

abarringer 8y ago

Troy and Krebs should team up to create a security hall of shame and only remove companies when issues are fixed. We have security vendors who have sslv2 enabled and they can't understand why that's an issue. We have huge fortune 250 companies that we exchange full credit card data with that have TLS 1.0 enabled with Symantec certs and only two weak ciphers. I sent them an ssl labs report and they accused me of breach of contract for hacking the site. This list of security and finance related vendors that are double facepalm worthy is just astonishing.

tempuser24 8y ago
http://attrition.org/ http://attrition.org/ does this, though it doesn't look like they've kept up with companies.
- medecau 8y ago
  attrition.org doesn't even provide HTTPS.
  - Sohcahtoa82 8y ago
    Wow...how can a site about security not support HTTPS?
tombrossman 8y ago
I'm doing this in the community where I live and I have discovered that it is super effective. I send an email to each company explaining a security problem with their site (currently focusing on simple lack of HTTPS for form data, and not mentioning the public disclosure because I want to see who fixes things because they care vs. those just avoiding negative publicity) and if they haven't resolved it or replied within a week, I list them publicly on https://www.insecure.org.je https://www.insecure.org.je. The site isn't winning me any design awards and needs expanding of the advice articles, but dozens of local companies are immediately spurred to action when they appear in the "Sites requiring extra caution" section. Thousands of local users have directly benefited by the added security, even though they are completely unaware of why it was upgraded. The reaction from some business has been very predictable, with a mix of hostility, threats, confusion, outright lies, but enough respond politely and want to fix things, and I go out of my way to help those who want to learn. Source is public and if you want to try this locally, I highly recommend it: https://gitlab.com/tombrossman/insecure.org.je https://gitlab.com/tombrossman/insecure.org.je

murph-almighty 8y ago

I can think of one exception to Troy's claim: companies that hold data of people who aren't their customers. No amount of shaming Equifax would have fixed their practices, because we can't choose to not have our data collected by them.

nathantotten 8y ago

auslander 8y ago

I don't trust Troy anymore. He pushed into the Firefox 1Password and Cloudflare based password checks. "Praises for Troy, Troy praises 1Password and Cloudflare..." https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342 What happened to this 'integration' effort, btw?

Operyl 8y ago
Why would that result in loss of respect/trust? k-anonymity works great and is perfect for application into password managers and on-registration password security checks.
- auslander 8y ago
  The combination of 'Baking HIBP into Firefox' and 'Cloudflare did some great work' and 'sends this to the API' just sounds bad. We are talking passwords here, for god's sake, I want nothing be sent nowhere, let my browser and me alone.
  - Operyl 8y ago
    OK, calm down for a minute. You need to read how k-Anonymity works before you continue to comment on this: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with... It isn't sending a plaintext password, not even a full hash of the password. This is entirely fine..
    - auslander 8y ago
      > This is entirely fine.. ... until it doesn't. Any update on did this HIBP 'feature' made it into Firefox?
      - Operyl 8y ago
        You’ve yet to tell me when it’s not fine. Can you please provide some citations or technical reasonings besides just putting forward unsubstantiated claims? Below you've told jgahramc you refuse to read how it works, then you probably shouldn't make claims on this.

nickray 8y ago

https://login.swissid.ch https://login.swissid.ch does this too: disallow password managers from filling out the login. Upon asking them to fix: "Autofill completion is not allowed by us for security reasons. First, if that's the case, if someone gets to your PC, we can stop a hacking attempt and that's one of many reasons. For other questions, we are at your disposal." They also only enforce SMS as two-factor authentication. The idea of this SwissID is to become a nation-wide identity service, yet they manage to do everything wrong. Yeah, this annoys me to no end :(

sschueller 8y ago
Me too as we already had an attempt called suisse ID (10 years ago now?) and mobile ID. Both which cost money limiting adaption greatly. Personaly I like mobile Id which makes logging into PostFinance or swisscom easy but not all phone providers are able to offer it. Sucks that for post and sbb I need yet another system, Swiss id....
- ThePadawan 8y ago
  Notably, SwissPass did not allow me to set a randomly generated, very long (>20 character) password. It also didn't notify me that it didn't allow such passwords, it just went right ahead and created an account it was impossible to log in to. Thankfully, I was able to reset the password to one which is far unsafer. Well done everyone.
  - davchana 8y ago
    India Government's official Website for managing public retirement fund, NPS, eNPS does this. Password need to be changed every 90 days, of max 14 characters length, but no where documented. On password change page, it will silently accept your any 14+ length password & will truncate it to 14. Then you try to login with your actual password, it gives error, Wrong Password.
    - FabHK 8y ago
      That's just stunningly bad (both the 90 days reset, and the silent (!) truncation to 14 characters...)

zimbatm 8y ago

It's quite scary to think that a bank only fix obvious security issues after public shaming. There are a lot of internal services in a bank that are not exposed to the scrutiny of security researchers and will therefor never get patched.

zentiggr 8y ago
Right, and that applies to probably all but a small percentage of organizations. Not malice, just management that doesn't properly account for the negatives involved in poor security policy. Banks are no exception to the rule that all the managers are humans, and may not have the best information / mindset. Fix the lowest hanging fruit as fast as possible, and raise the mean incrementally.
lostapathy 8y ago
What sucks is that for every breach you hear about, odds are somebody “on the inside” has tried to raise the alarm and been ignored, or marginalized, for it. Then after the breach they often take it very hard. To the extreme, a former employer suffered a major breach (after I was gone) and from what I heard a really great dev was distraught to the point I worried he might be suicidal. All made worse because the organization as a whole didn’t learn, there were no obvious consequences for the management at fault, so he took it even more personally, when it truly wasn’t his fault a breach happened. We need a way to give these people a voice before bad things happen, not just therapy after something they saw coming goes bad.
lolc 8y ago
Yes! What does it say about internal security if a bank leaves its mailbox unlocked. (The postal equivalent of not using SSL.) For those that would prefer other methods because public shaming doesn't fix everything: Let's look at some scenarios what (successful) shaming of publicly available services could do: 1. lead to audit and discovery of the issues in the internal services 2. bolster the argument of internal people who argue for security improvements 3. reset priorities to fix issues in public instances instead of fixing internal ones
- 8y ago

amarant 8y ago

the worst of all are those that allow you to paste the password when you setup the account, but not on login. this leads to a situation where I have a 100 digit hashed password I have to type in by hand. usually I just create a new account, preferably somewhere else.

fatboy 8y ago
In macOS I use Keyboard Maestro, which allows you to create a macro that pastes the current clipboard by typing. Very handy for these no-paste text boxes.
drakenot 8y ago
I created an account for a 401k vendor that our company recently switched to. During the registration process I used a password manager to generate a 14 digit random password. Imagine my surprise when I went to login to the newly created account only to find out that the login screen enforced a character limit of 8 characters (both with a textfield attribute and js). This limitation was not enforced during registration! I had to edit the page in developer tools so I could actually paste my full password to login. The limitation was purely client side.
- retrodpc 8y ago
  Ouch. So the server still accepted the 14-char password, even if the login page didn't allow it?
- amarant 8y ago
  haha whaat? they had a limit of 8 chars MAXIMUM? that's usually the minimum limitation! at least they had implemented the first rule of it-security: perform all checks client-side only ;)

gerardnll 8y ago

Social media is used by companies to improve their public perception but we cannot ‘shame’ them by its bad practices. No way. And if the Community managers throw lies we have to also shut up? Respect always, but the ‘shaming’ are not CManagers fault because security decisions are not taken by them but other people so they shouldn’t feel bad by the public response.

marek995 8y ago

A question: I know of some companies and banks with such issues. I am no Troy Hunt - what would you do about this? Public shaming doesn't really work when you aren't a public person. Also this is in non-english environment, so there are no such public figures...

mayneack 8y ago
Most of those Troy Hunt examples were submitted to him by non-public people. You could probably just email/tweet him. smaller scale: http://plaintextoffenders.com/ http://plaintextoffenders.com/

AdmiralAsshat 8y ago

An add-on/extension I've found useful for combating this behavior on certain financial websites is Don't Fuck With Paste: https://chrome.google.com/webstore/detail/dont-fuck-with-paste/nkgllhigpcljnhoakjkgaieabnkmgdkb https://chrome.google.com/webstore/detail/dont-fuck-with-pas... https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-with-paste/ https://addons.mozilla.org/en-US/firefox/addon/don-t-fuck-wi...

oxplot 8y ago

I wrote about non secure contact pages of various banks in Australia back in 2014 [1] and sent them all private messages. Didn't hear back from a single one saying they were working on it. Haven't checked lately to see how or if they changed. [1]: https://blog.oxplot.com/non-secure-contact-page/ https://blog.oxplot.com/non-secure-contact-page/

auslander 8y ago

The only true, safe password manager is the one that stores its database in a local, master password encrypted file, likee KeePass(XC), open source. Anything else is trusting third-party.

arayh 8y ago

This reminds me of the fiasco regarding Virgin Media over Twitter: https://twitter.com/virginmedia/status/595135419152474112 https://twitter.com/virginmedia/status/595135419152474112 I think companies need to mandate some kind of improved protocol for responding to these sort of tweet storms. It always seems to be people who are technically inclined talking to a social media representative with little to no knowledge of standard security practices, which leads to attempts to calm the masses, but ultimately backfires.

thomaspaine 8y ago

Law suits seem to be the standard tactic for dealing with other types of corporate negligence (for better or worse). Why aren't they employed more for these types of obvious security vulnerabilities if you can demonstrate harm?

manigandham 8y ago
Considering Equifax basically had 0 consequences, legal work is incredibly expensive and ineffective unless someone gets seriously injured or dies.

coleifer 8y ago

I have compassion for these people who made these ludicrous comments -- they clearly aren't cryptographers or digital security experts. Let's separate the people making these comments from the corporations they represent. Public shaming of a person is never the right response, in my opinion -- live and let live. Public shaming of a corporation, on the other hand, may be the only way to get the attention of the decision-makers. Let's be kind and compassionate to individuals.

taf2 8y ago
and remember that corporations are by definition a collection of individuals... is public shaming really the only way to get through to the decision makers? I hate the thought of regulations... but maybe there is a $$ solution here?
blauditore 8y ago
Yeah, in many of those tweets you can almost feel that the person writing it is trying to reiterate something they don't fully understand.
lultimouomo 8y ago
To be clear: do you count shaming an official corporate account as shaming a corporation or as shaming the person that actually write the tweets? Because of course corporations will always put a person in front of, so that you feel bad for speaking the truth. That's why official corporation tweets often carry a signature with a person first name - it reminds me of Pennac's Malaussène, who by trade is a professional scapegoat.
kodablah 8y ago
My compassion dies when their humility does. You cannot affect attitude towards disclosures by accepting the existing attitude. Compassion is bidirectional. A "we will investigate and get back shortly", or a "our internal team has investigated and here is their answer: '...'" is much more appropriate. Several companies' social media responders are courteous. Excusing corporate condescension mouthpieces just encourages the practice.

auslander 8y ago

Don't trust Troy. He pushed into the Firefox 1Password and Cloudflare based password checks. https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342 What happened to this 'integration' effort, btw?

adrian_mrd 8y ago

It would be interesting to ascertain how many times users' on social media flag a security problem to a company's social media team that isn't actually a security problem? In other words, how many false negatives get caught too? Troy Hunt's post is really told from the victor's perspective (likely a bias rather than intentional or arrogance), but to form a well-rounded view, understanding how many false negatives would likely help...

gowld 8y ago
If the flagging is respectful and the user is mistaken, either they will apologize for the mistake or it's up to the community to lower that user's influence. Troy Hunt is retweeted and upvoted and made famous because he has built a good reputation.

nautilus12 8y ago

So the question is why don't companies have infosec individuals seriously looking into issues raised by a user seriously because its in their best interest to avoid bad PR and public shaming which will be the logical next step if they ignore it. Is the shaming necessary? Do corporations only respond to an issue when it blows up? Seems like bad stewardship.

kodablah 8y ago

> But the hesitation quickly passed as he proceeded to thank me for the coverage. You see, they knew this process sucked - any reasonable person with half an idea about security did - but the internal security team alone telling management this was not cool wasn't enough to drive change. Negative media coverage, however, is something management actually listens to. Sounds like justification for bad-security whistle blowing too. The downside of encouraging it is that you are easily deanonymized if you had attempted to bring it up internally before. We need a, possibly crowd funded, corporate bad-security whistle blowing foundation that contacts your own company on your behalf and then publicly shames them if they don't fix the issue.

auslander 8y ago

I wouldn't trust troyhunt.com. He was trying to put passwords checks using third-party APIs into Firefox. https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342

auslander 8y ago

Streisand effect in its best :) I wouldn't trust Troy. He was trying to put passwords checks using third-party APIs, Cloudflare and 1Password into Firefox code. https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342

doque 8y ago
Not password checks, but rather "does my email appear on haveibeenpwnd.com".
- auslander 8y ago
  The very passwords: "k-anonymity" model which works like this: when searching HIBP for a password, the client SHA-1 hashes it then ... sends this to the API. https://www.troyhunt.com/were-baking-have-i-been-pwned-into-firefox-and-1password/ https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...
  - Shengbo 8y ago
    This implementation has no value to potential attackers. Anything it could -if it could- help you with, you can already do without it.
  - FabHK 8y ago
    According to the description in the linked article, only the first 5 characters of the hash of the password are sent to the API (and that API is not publicly available in the first place, apparently, but can only be accessed via Mozilla or 1Password's own APIs). What exactly appears to be the problem? The reasoning for this feature is clearly laid out, and the underlying "ethics of running a database breach search service", while controversial, are also something Troy has thought about very carefully: https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/ https://www.troyhunt.com/the-ethics-of-running-a-data-breach...
    - auslander 8y ago

auslander 8y ago

To Moderators: I claim Frivolous flagging on https://news.ycombinator.com/item?id=17958620 https://news.ycombinator.com/item?id=17958620 From FAQ ... flagging a story that's clearly on-topic by the site guidelines just because one personally dislikes it— eventually gets an account's flagging privileges taken away.

Dirlewanger 8y ago

I can imagine it's a really shitty situation for e.g. smaller banks here in the US. Most of them don't have the resources to build their own custom back end services, so many outsource the tech. And then shit like Fiserv getting hacked the other week happens, and not only is Fiserv's reputation hurt but so is all their client's. I'd love to "bank local", but when shit like that happens, the only way I'd feel safe with my finances is by going with the Bank of Americas/Fidelity's/etc. over Mom & Pop Credit Union.

gowld 8y ago
That calls for startups to build good tech for these companies to all use.
- Dirlewanger 8y ago
  Very, very difficult in fintech. Very high barrier to entry. The Paypals/Venmos/Acorns of the world have been increasingly getting into the traditional banking realm, offering checking account/debit card products, but their back ends are still the same old slow companies. Polishing a turd essentially.

pentae 8y ago

"Now, keeping in mind that the username is your email address and that many among us like cake and presents and other birthday celebratory patterns, it's reasonable to say that this was a ludicrous statement." This is when I lost it. Bloody good read.

auslander 8y ago

Beware, don't trust anyone in this digital age. Troy was pushing third-party APIs, Cloudflare and 1Password into Firefox code. https://news.ycombinator.com/item?id=17395342 https://news.ycombinator.com/item?id=17395342

auslander 8y ago

That thread costed me 38, edit, 50 karma points. Well spent ones, bring it on :))

sctb 8y ago
Please stop doing this or we'll ban the account.

srinivasan 8y ago

Didn't browsers take a stand a few years ago by ignoring "autocomplete=off" on password fields? I think it’s about time browsers start ignoring any onpaste events on password fields. I’m curious what Chromium folks think - have there been tickets about this? It would be a great way to end this dumb practice.

kevincox 8y ago
Firefox has the dom.event.clipboardevents.enabled pref which can be used to prevent a lot of web naughtiness however it does break a couple of legitimate use cases.
- aaronmdjones 8y ago
  Firefox also has signon.storeWhenAutocompleteOff (default true) which ignores such hints.

jedberg 8y ago

> You see, they knew this process sucked - any reasonable person with half an idea about security did - but the internal security team alone telling management this was not cool wasn't enough to drive change. Negative media coverage, however, is something management actually listens to. It's even better when the internal person tips off the press to initiate the public shaming to take to management. Never happened in an organization that I worked in, but I know security people in other orgs that had to resort to these tactics.

gowld 8y ago
Yup. https://en.wikipedia.org/wiki/Deep_Throat_(Watergate) https://en.wikipedia.org/wiki/Deep_Throat_(Watergate)

manigandham 8y ago

The worst offenders are max password length limits, especially tiny ones like 8 characters. It's a guarantee that the service does not properly hash and store passwords.

jedberg 8y ago
That usually happens on banking sites because their system is backed by an old mainframe that can only handle 8 characters. The second thing you said is right though -- they probably have terrible security on that mainframe.
- manigandham 8y ago
  Why does the accounts system have to use that mainframe?
  - jedberg 8y ago
    In most cases it's because the mainframe holds all the customer data and is the system of record, and it's just easier to do it that way.
- pps43 8y ago
  They could still hash the long password, without trimming, and store 64 bits of that hash.
  - jedberg 8y ago
    True, but then you'd have to make sure that all software that accesses that field is aware of the hash, and chances are if you have a legacy system like that, you have legacy software too.
- chatmasta 8y ago
  NatWest goes a step further and asks you to enter (for example) “the 1st, 5th, 8th and 9th character of your password.” I saw a comment once explaining why this might make sense to prevent replay attacks. But it seems awfully absurd.

bostik 8y ago

I'm mildly surprised no-one has so far drawn the similarity to full-disclosure. Because let's be fair, this practice is full-disclosure. Of bad practices. And as we've seen over the past 2+ decades - FD works. Once you draw attention to an insecure system, resources to fix it will be found. (Enough of the time, at least.)

gowld 8y ago
This is different from full disclosure because (1) in many cases the information is directly visible to the commmon user or publicly advertised by the company already, and (b) the insecurities aren't immediately directly exploitable (like plaintext passwords), just a risk factor in case of a hack.

Animats 8y ago

The trouble is, it won't scale. If an announcement like that comes out several times a day, it's not news.

orblivion 8y ago
There was the example of the company that saw the BBC article and was scared into compliance. Perhaps if he keeps up the approach of keeping the shaming events rare and brutal, it can be enough of a psychological effect to corral other companies into compliance until there are only a few cases remaining, at which point you could just go after them individually without creating a news burnout.
deleted 8y ago
[deleted]

chatmasta 8y ago

I tried [0] to stir one of these up for coral.co.uk which also forces (via a downgrade redirect) insecure login over http. Unfortunately my tweet didn’t get much attention, although I did get the “Don’t worry! You can login without any doubts!” reply from Coral. Not sure if it’s still the case (think they recently did a redesign and hopefully fixed it; I’ll check tonight). If it is, I would appreciate some more attention on this issue! [0] https://mobile.twitter.com/milesrichardson/status/1017195538213634049 https://mobile.twitter.com/milesrichardson/status/1017195538...

deleted 8y ago

[deleted]

lifeisstillgood 8y ago

This suggests to me a more democractic approach to corporate culture / action. Let's say we have a giant backlog of work, each item ranked by voting by employees Now the security team adds their "Stop sending passwords in plain text" item. Which companies will it get voted up in?

peterwwillis 8y ago

Ego, embarrassment, lack of taking someone seriously, ignorance, and laziness all contribute to not taking security reports seriously, and results in creating rationalizations to prevent fixing them. At that point, you need pressure to create change. Shame definitely works, but it isn't professional, and it isn't nice at all. Many people may be open to help if you can get off of Twitter. You can send a positive letter through a private channel that details the problem and offers help in fixing it. You can make an automated, impartial test that clearly proves the problem and provides links to fixes. Failing these, you can start a petition. You can have famous, well respected, and powerful people sign it. You can add carrots and sticks, like an award for security response, a hall of shame entry, or the nuclear option, a PR release and interview with national media about the dangers of the problem. Even just sending a list of these problems as they have happened in the past and how they resolved to executives at the company is probably all the visibility needed to get the ball rolling.

Bhilai 8y ago

Public shaming definitely works but there is only so many times you can play this card. It may give you quick small wins but such organizations which downplay or do not understand fundamental security concepts have many other serious security/technical debt which eventually leads to a breach.

cocoflunchy 8y ago

Meanwhile 90% of the banks in France use a 6-digit password that you can't paste because you have to enter it by clicking on a super-secure-random grid... https://imgur.com/a/q91JDXi https://imgur.com/a/q91JDXi Maybe Troy Hunt can publicly shame them into more secure practises but I'm not hopeful.

aaronmdjones 8y ago
My bank's (Lloyds TSB) idea of extra security beyond a password is ... yet another password, but one that you have to select 3 random digits of, in dropdown boxes. I asked them for TOTP 2FA, but never got a response... Why is it always banks who have some of the worst security posture out there? I fully expect my bank to eventually implement 2FA ... by SMS! Thinking that it's a good idea! sigh
- simonbyrne 8y ago
  A common work around is to make them all the same: that way you don't have to think which ones to type.
jiveturkey 8y ago
that actually is secure ... if you have a secure display
- loeg 8y ago
  In the same sense that a password manager is secure if you have a secure keyboard.
user5994461 8y ago
It's secure. It defeats keyloggers and it prevents the password from being remembered by the browser and enumerated. It's usually a PIN that is set by the bank rather than the user, to prevent people from using 123456 or their date of birth.
- 8y ago

orblivion 8y ago

Could there also be a thing where you go out of your way to praise? It seems that the combination of carrot and stick seems to be good for persuasion.

richrichardsson 8y ago

I had a bit of a rant in a job interview about how storing plain text passwords was something only idiots do. I got the job and lo and behold the main feature being worked on when I started 3 weeks later was "encrypt passwords field". So even inadvertant direct private shaming can effect change!

kovek 8y ago

Why was the situation with the page that does not ask for credentials and does not use https considered unsafe? Is the worry that a man in the middle could change the Login link to a different website?

redwards510 8y ago
Yes, exactly.

move-on-by 8y ago

A big takeaway for me is how the internal security teams knew it was bad and couldn't make a case for the change. Once a process is in place, it takes a well delivered argument to make a change. Not allowing paste into password fields is a prime example of something that seems like a good practice, but isn't. If anyone is reading this and needs to convince others to allow paste, NIST says to allow pasting passwords, and that it improves security: > Verifiers SHOULD permit claimants to use “paste” functionality when entering a memorized secret. This facilitates the use of password managers, which are widely used and in many cases increase the likelihood that users will choose stronger memorized secrets. [1] People will no doubt still say it's bad, but its a fact that the National Institute of Standards and Technology says to allow paste, and that it improves security [1] https://pages.nist.gov/800-63-3/sp800-63b.html https://pages.nist.gov/800-63-3/sp800-63b.html

presscast 8y ago

Let's take a step back and ask ourselves this: when did banks end up with some of the least secure websites? It's so common we've become oblivious to how frightening this is.