6 ms·

The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...

phito 8y ago
That sounds like a bad excuse...
amelius 8y ago
So they tried to improve security, but instead they weakened it.
- buboard 8y ago
  They might also have prevented a lot of users from being hacked. We can't know for sure.
tyingq 8y ago
"Passwords were hashed as a hash in 2016, but the unchanged version of the passwords has been retained, so users can not filter their own password via our platform via a filter" https://www.archynety.com/tech/why-knuddels-saved-his-passwords-in-plain-text/ https://www.archynety.com/tech/why-knuddels-saved-his-passwo... Which sounds odd. You could just hash/compare filter words. I'm guessing similar issues too, like "no salt" or "same salt for all passwords".
- dpwm 8y ago
  If you do password hashing properly, using a key derivation function, you shouldn't be able to do that filtering efficiently at all.
  - tyingq 8y ago
    It just has to run once, at filter creation time. Disallow creation of the filter if your password is in it. Note the quoted reason from Knuddles is different from what others are saying the reason is: "so users can not filter their own password via our platform via a filter" Edit: Apparently, the posted articles on this are misquoting things. Here's the original company response: https://forum.knuddels.de/ubbthreads.php?ubb=showflat&Number=2916515#Post2916515 https://forum.knuddels.de/ubbthreads.php?ubb=showflat&Number... It does appear they were screening all chat text for the user's password after all.
- daveFNbuck 8y ago
  What does filtering your own password mean on that platform?
  - tyingq 8y ago
    Found the quote from a company rep on their chat forum: https://forum.knuddels.de/ubbthreads.php?ubb=showflat&Number=2916515#Post2916515 https://forum.knuddels.de/ubbthreads.php?ubb=showflat&Number...
arayh 8y ago
This sounds dumb. So if my password was "something" (yes, it's a terrible password), it would just keep censoring that word every time I write that into the chat?
- buboard 8y ago
  sounds smart. not only you prevent users from giving their passwords, you force them to choose better passwords.
badrabbit 8y ago
Why didn't they just hash all the words they type if you must(maybe bloom filter?)
- Double_a_92 8y ago
  You would have to hash every possible substring in a sentence.
  - ygra 8y ago
    Also with a quite expensive hashing algorithm since ideally the password wouldn't be just stored as unsalted MD5.
  - badrabbit 8y ago
    Yeah,can't see sunstring matching working.
- megaremote 8y ago
  But if you use different hash keys, then you would have to hash each word multiple times.
  - badrabbit 8y ago
    You would use a unique hash key for a user's password. You'll only have to hash each word with that unique hash key once. And ideally cache the hashing and prehash known words.
megaremote 8y ago
So, there is no way at all to stop that from happening.

phito 8y ago

That sounds like a bad excuse...

amelius 8y ago

So they tried to improve security, but instead they weakened it.

buboard 8y ago
They might also have prevented a lot of users from being hacked. We can't know for sure.

tyingq 8y ago

"Passwords were hashed as a hash in 2016, but the unchanged version of the passwords has been retained, so users can not filter their own password via our platform via a filter" https://www.archynety.com/tech/why-knuddels-saved-his-passwords-in-plain-text/ https://www.archynety.com/tech/why-knuddels-saved-his-passwo... Which sounds odd. You could just hash/compare filter words. I'm guessing similar issues too, like "no salt" or "same salt for all passwords".

dpwm 8y ago
If you do password hashing properly, using a key derivation function, you shouldn't be able to do that filtering efficiently at all.
- tyingq 8y ago
  It just has to run once, at filter creation time. Disallow creation of the filter if your password is in it. Note the quoted reason from Knuddles is different from what others are saying the reason is: "so users can not filter their own password via our platform via a filter" Edit: Apparently, the posted articles on this are misquoting things. Here's the original company response: https://forum.knuddels.de/ubbthreads.php?ubb=showflat&Number=2916515#Post2916515 https://forum.knuddels.de/ubbthreads.php?ubb=showflat&Number... It does appear they were screening all chat text for the user's password after all.
daveFNbuck 8y ago
What does filtering your own password mean on that platform?
- tyingq 8y ago
  Found the quote from a company rep on their chat forum: https://forum.knuddels.de/ubbthreads.php?ubb=showflat&Number=2916515#Post2916515 https://forum.knuddels.de/ubbthreads.php?ubb=showflat&Number...

arayh 8y ago

This sounds dumb. So if my password was "something" (yes, it's a terrible password), it would just keep censoring that word every time I write that into the chat?

buboard 8y ago
sounds smart. not only you prevent users from giving their passwords, you force them to choose better passwords.

badrabbit 8y ago

Why didn't they just hash all the words they type if you must(maybe bloom filter?)

Double_a_92 8y ago
You would have to hash every possible substring in a sentence.
- ygra 8y ago
  Also with a quite expensive hashing algorithm since ideally the password wouldn't be just stored as unsalted MD5.
- badrabbit 8y ago
  Yeah,can't see sunstring matching working.
megaremote 8y ago
But if you use different hash keys, then you would have to hash each word multiple times.
- badrabbit 8y ago
  You would use a unique hash key for a user's password. You'll only have to hash each word with that unique hash key once. And ideally cache the hashing and prehash known words.

megaremote 8y ago

So, there is no way at all to stop that from happening.