4 ms·

I agree. Storing passwords in clear text is a security issue, but from the point of view of the user experience is better. When the user does a few times the p

by antirez 16y ago

I agree. Storing passwords in clear text is a security issue, but from the point of view of the user experience is better. When the user does a few times the password recovering procedure, he'll finally memorize it. When instead the password recovery ends sending you a random password, I end doing the password recovery every time I need to enter that site. And I eventually get bored enough to don't enter the site again. Even the url in the email does not fix this issue IMHO, what the user want is typing yourcompany.com and log in, without searching for emails, at least in the long run. Now since plaintext passwords are insecure, when it's worth using them? Only when the service is not very security sensitive, and only if you are ready as a developer to face the negative PR if something bad happens. So: If you use plaintext passwords you should know what you are doing, and you should secure your systems very very well so that is unlikely (but not impossible...) that there will be a leak of informations in the database. There is another usability problem related to authentication cookies expiring. Setting cookies to expire in 2036 is a good trick to avoid part of this problem. If you want to do the right thing storing hashed passwords, at least make sure that unless your data is very very security sensible, like 23andme or alike, please don't log out the user automatically. What I like is that the authentication token in the cookie lives forever and is the same in every session opened (so you can have the same site open in office, laptop, desktop, and everything works), but once you hit "logout" in any of the sessions the auth cookie changes, and you get logged out everywhere.

tintin 16y ago
"from the point of view of the user experience is better" Well I don't think a lot of users have a better experience now there password is exposed. Agreed it would be nice when your old password could be recovered. But a lot of people will understand that you don't want to store there password and they will accept the fact they have to make sure they remember there password. When you know a website doesn't store your password you are likely more willing to provide a password you can remember well.
- antirez 16y ago
  I was not referring to the user experience once the password is leaked, but if everything goes well :) But I understand your point. Part of the user experience is being comfortable with the handling of his private data.
arethuza 16y ago
Surely storing the passwords in plain text and making them available to users are two separate points? If you really did want to be able to recover passwords then at least encrypt them and store the key(s) outside of the database (with options varying from "in a configuration file somewhere" through to hardware security modules at the other extreme). [Edit: for the avoidance of doubt I think storing passwords in any recoverable form is highly dubious]
- rmc 16y ago
  If your encryption key is stored with the databases you haven't gained much. The best thing to do is hash the passwords. It's quite common for people to say "encrypt the passwords" when they mean "hash the passwords".
  - StavrosK 16y ago
    But then they're not recoverable, which is what the GP is talking about.
    - roc 16y ago
      There's no benefit to recovering a current password. If you can determine that the requesting user should be able to receive the current password, you can skip that step and just ask them to set a new one.
  - arethuza 16y ago
    You can probably do rather better than the usual approach of a general purpose hashing algorithm and a salt: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
jister 16y ago
You can store encrypted passwords without compromising user experience and usability so I am not sure what's this got to do with it?
cao825 16y ago
If they are worried about user experience and that is the main reason they do not encrypt - then why not at the very least use a version of encryption that the site can decrypt? Sure, the people who grab the data can run some cryptography programs on it and eventually come up with the algorithm, but it is a hell of a lot safer than plain text.
- zaidf 16y ago
  We don't really know if they are encrypting the password while storing in the db.
snes 16y ago
What about not having a password at all? The user who wants to log in, request a login link to their email. And can click it within set amount of time. Then the user only have to know the email-password. And that could be used to get a new password anyways. Lots of sites I only visit once a year I need a new password to each time. And it would save me the trouble of making something up each time, and not remembering it anyways. And if I would try to remember it, it would likely be a password I use on another site. Which would be bad.
- repsilat 16y ago
  I think you just invented OpenID. Better, because more people have email addresses than OpenID providers, and because it piggybacks on existing infrastructure. Worse, because you don't auto-redirect past the login page. Probably a net win.
nailer 16y ago
> When instead the password recovery ends sending you a random password, I end doing the password recovery every time I need to enter that site. This is what I do with 'Verified by Visa'. They make me use unintelligible passwords, so I just recover each time. It's horrible but I'm forced to.
Herald_MJ 16y ago
Don't try to excuse bad security practice with "user experience". How good a user experience is having your passwords hacked and leaked over the internet? There are many other better and secure ways of improving e-mail user experience. OKCupid, for example, sends out e-mails with "Login Instantly" links which contain unique keys which identify accounts. Admittedly, an e-mail eavesdropper could use one of those links to gain access to your account, but the keys can expire, can be remotely disabled, and don't contain any user data at all. I have never heard anything about the PoF habit of sending regular e-mails containing your password, but if any service did that to me, I would immediately close my account with them and change all my passwords. I even get perturbed when companies do this as a one-off.
- henrikschroder 16y ago
  To be cynical about it, you have to do a cost-benefit analysis. Is the improved user experience of being able to remind people of their passwords so much better that it brings in more revenue than what you can potentially lose from the risk of being hacked?
  - StavrosK 16y ago
    As I said above, this is even a false dilemma. You can have both increased security and increased usability by including one-time hashes in URLs that log users in.
    - henrikschroder 16y ago
      Yes, that's the right way to do it, but a URL that makes the user auto-login is not the same thing as actually reminding the users of their passwords. And I bet that quite a lot of people prefer getting their password in a mail instead of a weird URL thing and being forced to enter a new password. Remember that you and me are not the main target group of a service like this.
- regularfry 16y ago
  Security is always traded off against convenience. That's not an excuse, it's just the nature of the beast.
iuguy 16y ago
I'm amazed how the author of an awesome tool like hping can get this so wrong. I know you're an incredibly intelligent and capable guy, but some of the stuff you're saying here is really bad. There's almost always a UX/Security tradeoff, but in this case the user benefit is less than the loss in security - in other words the value of the tradeoff isn't sufficient to justify the lapse in security. Setting the cookies to expire in 2036 isn't a good idea at all. If the user has a shared PC then you've just introduced a 25 year window of opportunity for anyone with access to that system to compromise the account. What PoF should've done is include a password reset link in the email. No need for messing around with cookies, and those that remember their password can log in just fine.
- speleding 16y ago
  > but in this case the user benefit is less than the loss in security That's a highly subjective statement. Lower security makes the site more money with better user retention and it improves the user experience (as long as the site doesn't get hacked). For a bank the trade off will be different but for an online dating site I can see it makes economic sense to behave that way.
  - iuguy 16y ago
    I see what you're saying but I disagree that it's subjective. I'm saying that the benefit for the user is lower than the loss in security (to the user) with this approach. You're saying that the benefit to the site owner is greater in this case, and I'm not sure whether it is or not (but if it's a deliberate policy I'm sure PoF would). What is a benefit to one side is not necessarily a benefit to another.
- StavrosK 16y ago
  I agree with you, but this isn't a solution either. You can, quite trivially, implement sending a one-time random hash that will log the user in when he clicks it. So, you can say "you haven't been active, click here to be logged in". This is less secure than not sending the hash, but we've already established you want the user to log in from the email. This is more secure than sending them their password and more user-friendly than having them type it in. Plus, the hashes expire after one use, so they won't be able to be reused. Storing passwords in plaintext is an extremely bad practice.

by antirez 16y ago

tintin 16y ago

"from the point of view of the user experience is better" Well I don't think a lot of users have a better experience now there password is exposed. Agreed it would be nice when your old password could be recovered. But a lot of people will understand that you don't want to store there password and they will accept the fact they have to make sure they remember there password. When you know a website doesn't store your password you are likely more willing to provide a password you can remember well.

antirez 16y ago
I was not referring to the user experience once the password is leaked, but if everything goes well :) But I understand your point. Part of the user experience is being comfortable with the handling of his private data.

arethuza 16y ago

Surely storing the passwords in plain text and making them available to users are two separate points? If you really did want to be able to recover passwords then at least encrypt them and store the key(s) outside of the database (with options varying from "in a configuration file somewhere" through to hardware security modules at the other extreme). [Edit: for the avoidance of doubt I think storing passwords in any recoverable form is highly dubious]

rmc 16y ago
If your encryption key is stored with the databases you haven't gained much. The best thing to do is hash the passwords. It's quite common for people to say "encrypt the passwords" when they mean "hash the passwords".
- StavrosK 16y ago
  But then they're not recoverable, which is what the GP is talking about.
  - roc 16y ago
    There's no benefit to recovering a current password. If you can determine that the requesting user should be able to receive the current password, you can skip that step and just ask them to set a new one.
- arethuza 16y ago
  You can probably do rather better than the usual approach of a general purpose hashing algorithm and a salt: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/

jister 16y ago

You can store encrypted passwords without compromising user experience and usability so I am not sure what's this got to do with it?

cao825 16y ago

If they are worried about user experience and that is the main reason they do not encrypt - then why not at the very least use a version of encryption that the site can decrypt? Sure, the people who grab the data can run some cryptography programs on it and eventually come up with the algorithm, but it is a hell of a lot safer than plain text.

zaidf 16y ago
We don't really know if they are encrypting the password while storing in the db.

snes 16y ago

What about not having a password at all? The user who wants to log in, request a login link to their email. And can click it within set amount of time. Then the user only have to know the email-password. And that could be used to get a new password anyways. Lots of sites I only visit once a year I need a new password to each time. And it would save me the trouble of making something up each time, and not remembering it anyways. And if I would try to remember it, it would likely be a password I use on another site. Which would be bad.

repsilat 16y ago
I think you just invented OpenID. Better, because more people have email addresses than OpenID providers, and because it piggybacks on existing infrastructure. Worse, because you don't auto-redirect past the login page. Probably a net win.

nailer 16y ago

> When instead the password recovery ends sending you a random password, I end doing the password recovery every time I need to enter that site. This is what I do with 'Verified by Visa'. They make me use unintelligible passwords, so I just recover each time. It's horrible but I'm forced to.

Herald_MJ 16y ago

Don't try to excuse bad security practice with "user experience". How good a user experience is having your passwords hacked and leaked over the internet? There are many other better and secure ways of improving e-mail user experience. OKCupid, for example, sends out e-mails with "Login Instantly" links which contain unique keys which identify accounts. Admittedly, an e-mail eavesdropper could use one of those links to gain access to your account, but the keys can expire, can be remotely disabled, and don't contain any user data at all. I have never heard anything about the PoF habit of sending regular e-mails containing your password, but if any service did that to me, I would immediately close my account with them and change all my passwords. I even get perturbed when companies do this as a one-off.

henrikschroder 16y ago
To be cynical about it, you have to do a cost-benefit analysis. Is the improved user experience of being able to remind people of their passwords so much better that it brings in more revenue than what you can potentially lose from the risk of being hacked?
- StavrosK 16y ago
  As I said above, this is even a false dilemma. You can have both increased security and increased usability by including one-time hashes in URLs that log users in.
  - henrikschroder 16y ago
    Yes, that's the right way to do it, but a URL that makes the user auto-login is not the same thing as actually reminding the users of their passwords. And I bet that quite a lot of people prefer getting their password in a mail instead of a weird URL thing and being forced to enter a new password. Remember that you and me are not the main target group of a service like this.
regularfry 16y ago
Security is always traded off against convenience. That's not an excuse, it's just the nature of the beast.

iuguy 16y ago

I'm amazed how the author of an awesome tool like hping can get this so wrong. I know you're an incredibly intelligent and capable guy, but some of the stuff you're saying here is really bad. There's almost always a UX/Security tradeoff, but in this case the user benefit is less than the loss in security - in other words the value of the tradeoff isn't sufficient to justify the lapse in security. Setting the cookies to expire in 2036 isn't a good idea at all. If the user has a shared PC then you've just introduced a 25 year window of opportunity for anyone with access to that system to compromise the account. What PoF should've done is include a password reset link in the email. No need for messing around with cookies, and those that remember their password can log in just fine.

speleding 16y ago
> but in this case the user benefit is less than the loss in security That's a highly subjective statement. Lower security makes the site more money with better user retention and it improves the user experience (as long as the site doesn't get hacked). For a bank the trade off will be different but for an online dating site I can see it makes economic sense to behave that way.
- iuguy 16y ago
  I see what you're saying but I disagree that it's subjective. I'm saying that the benefit for the user is lower than the loss in security (to the user) with this approach. You're saying that the benefit to the site owner is greater in this case, and I'm not sure whether it is or not (but if it's a deliberate policy I'm sure PoF would). What is a benefit to one side is not necessarily a benefit to another.
StavrosK 16y ago
I agree with you, but this isn't a solution either. You can, quite trivially, implement sending a one-time random hash that will log the user in when he clicks it. So, you can say "you haven't been active, click here to be logged in". This is less secure than not sending the hash, but we've already established you want the user to log in from the email. This is more secure than sending them their password and more user-friendly than having them type it in. Plus, the hashes expire after one use, so they won't be able to be reused. Storing passwords in plaintext is an extremely bad practice.