4 ms·

Smart Enough Not To Build This Website

23 points by bdfh42 18y ago

jauco 18y ago
from the comments: The plaintext passwords are bad enough, but I think the biggest WTF here is that they give you the "Sorry, we don't recognize that email address." error if you enter an address not in their database. I hit it about 20 times and it doesn't lock you out or add a delay. It would be trivial to write something to datamine valid addresses. Seems like a valuable mailing list to build! Now that's a criminal mind :)
- babul 18y ago
  ...or a good marketing(/recruitment/etc) mind.
  - deleted 18y ago
    [deleted]
  - jcl 18y ago
    Or a good security mind: http://www.schneier.com/essay-210.html http://www.schneier.com/essay-210.html
- staunch 18y ago
  The vast majority of web sites that allow sign ups will prevent you from joining with an existing email address. Almost none of them limit the number of times you can try to sign up. Obviously from a security perspective it's probably a good idea to limit this. In practice though, who's really been bitten by this problem? The search space for valid email addresses is super large. There are much easier ways to get lists of valid email addresses. The most useful thing you could learn (I think) is that an email address you already know is in their database. But, that would be possible even if you were limited to a small number of attempts.
mojuba 18y ago
The vast majority of web sites have this privacy/security flaw in their password recovery systems: they respond by saying if they have the email address or not in the database, which means, anyone can check out if you are a member of a service or not by trying out your email.
- jonknee 18y ago
  I've done it both ways and the customer service reps much prefer when it lets you know if the email was sent or not. Otherwise they get lots of calls from unhappy people who put in their old email address and didn't get their login info. It's a usability trade off. I think a good compromise is limiting to a few attempts within a time period. That way you won't get a dictionary attack, but if someone has to try a few email addresses they can.
smanek 18y ago
I hate to say it, but storing users' passwords in plaintext in your internal db/filesystem isn't that bad ... (relative to a lot of other snafus we've seen). I'll of course grant that it is a far from ideal state of affairs and should be fixed. But, I think we can pretty safely assume that if an attacker has unfettered access to your server, you have bigger things to worry about.
- swombat 18y ago
  Don't hate to say it. It's a reality of the web that usability trumps security. And those who disagree should unplug their computer now, because it's not secure. This is really missing the forest for the trees though. If you log in via a plain text form, who cares that your password gets sent in a plain text email? There are easier ways to get people's passwords than to sniff plain text emails - phishing, for example, or social engineering, both of which are much easier to implement than an email-sniffing man-in-the-middle server.
  - jaf656s 18y ago
    the problem isn't entirely with sending a plain text password in an email. It is that the passwords are being stored in plain text in the database. This is just an SQL injection away from gaining an email-password list of all members of the site. Couple this with the fact that many people use the same password for other accounts, including email, and you have a definite security problem for the users.
    - swombat 18y ago
      How do you know they're stored in plain text in the db? I have that same functionality in my start-up, but we encrypt the passwords in the db. We just don't one-way-hash them.
      - jeremytliles 18y ago
        Exactly. It seems that about 75% of the commenters here and on CodingHorror are making this leap from "System can send password to user" to "System is storing password in clear text." Maybe Jeff's next post should be focused on how many "hackers" are unable to perform simple logical analysis. I believe the flaw here is that it sends your existing password rather than sending you an email link to create a new one. Not really worth a post (and all the ensuing discussion).
babul 18y ago
The now defunct Active Matter (who built the site, in 2003) were hopefully not members of Mensa.
dgabriel 18y ago
Does mensa store sensitive user data (financial info/ssn/naked pictures), or is it like most sites that store maybe customization options, possibly a calendar, possibly grant access to a forum? Unless there's sensitive data, it doesn't seem all that incredibly stupid to me. Am I missing something? Of course, I would prefer to generate my own password, rather than using one created for me.
- natrius 18y ago
  It doesn't matter how sensitive the data you're storing is. It matters how many other sites your users have used the same password on, and what those sites have stored on them. If salting and hashing passwords is all you need to do to help protect your users from their bad security decisions, I don't see why anyone wouldn't do it.
  - dgabriel 18y ago
    It doesn't really apply here, because the user obviously has an assigned password. Users are quite unlikely to change their other passwords to match their mensa-assigned password. However, it's an interesting point, and possibly deserves debate. How responsible am I for ensuring a user's security on other sites? Should all password fields be flanked by a flashing message that reads something like: Do not use your online banking password here?
raganwald 18y ago
Old timers remember the exact same issue with reddit.com, only they went the extra distance and had their servers stolen with passwords on them.
raganwald 18y ago
I realize it's a colloquialism and not to be taken too literally, but I don't care for the premise of Jeff's opening line: I may not be smart enough to join Mensa, but I am smart enough not to build websites like the American Mensa website. It implies that smartness is a single continuum (maybe, maybe not), and that you can measure it by looking at single actions like whether someone implements security feature X in a web site. My feeling about something like this is that most people who get it right are probably people who have heard or read about the issues regarding plaintext passwords. That makes them more knowledgeable, which is a fine thing if you are hiring them to build a web application, but not the same thing as smart in this sense. True, some people can work out the issues from first principles, which is definitely evidence of smartness, but I have strong doubts that you can get an accurate measure of smartness from just one "test" like this. Overall, it would be a far better "zinger" if it were a security web site with a security flaw, something like the story of the identity protection company whose CEO had his identity stolen. All that being said, I still upmodded the story. Blogging this kind of thing is a public service and a reminder for hackers doing start-ups can't hurt. It would be terrible if you built a great service, were just about to raise a substantial round, and some know-it-all technoid working with the VC flipped your bozo bit because you stored passwords in plain text.
gruseom 18y ago
One of the funniest things I ever saw: a bumper sticker that said "Mensa" and was upside down.
nazgulnarsil 18y ago
The idea behind mensa is that people with high IQ's need to associate with their own kind to feel comfortable. This is elitist crap. People who are truly intelligent are able to effectively communicate with the largest variety of people. In fact I would define that as a dimension of intelligence.
- jraines 18y ago
  Well, you can call me an elitist (though I've never been a member of or interested in Mensa), but I don't think this is crap. Happiest times of my life were when I was among high concentrations of intelligent people on a daily basis. The very existence of this community is evidence against your point. Or are all the truly intelligent people out there happily communicating with YouTube commenters?
  - DTrejo 18y ago
    Are you sure that you were happy because the people around you were intelligent? Or was it because you were in an intellectual environment where people discussed interesting topics?* *free of inane comments
    - jraines 18y ago
      The latter really doesn't happen without the former, in my opinion.
      - deleted 18y ago
        [deleted]
- edw519 18y ago
  I once had a girlfriend who had joined Mensa to meet "smart guys". She said all she ever met were geeks and ADD freaks. Then she ended up with me. </irony>
aasarava 18y ago
By the way, the comment from Aaron G on the original article is right on: Don't think you've got better security than Mensa if you're using MD5 to hash your users' password -- you should be using something along the lines of bcrypt. http://openwall.com/phpass/ http://openwall.com/phpass/
AndyKelley 18y ago
Without looking at the answer, I couldn't figure out what the problem with the site was. Could it be that the password is sent to the email? No, that's probably just how they worded the command button. Of course they'd hash a new password and send that to my email. And Atwood wouldn't repeat himself yet again, would he? After a few minutes, I finally guessed: the feature is much too wordy. The entire paragraph under the text field is completely unnecessary. I guess I would want to avoid websites that make this mistake because I don't like poor design and pointless text. Apparently I have more of a mind for design than security.

23 points by bdfh42 18y ago

jauco 18y ago

from the comments: The plaintext passwords are bad enough, but I think the biggest WTF here is that they give you the "Sorry, we don't recognize that email address." error if you enter an address not in their database. I hit it about 20 times and it doesn't lock you out or add a delay. It would be trivial to write something to datamine valid addresses. Seems like a valuable mailing list to build! Now that's a criminal mind :)

babul 18y ago
...or a good marketing(/recruitment/etc) mind.
- deleted 18y ago
  [deleted]
- jcl 18y ago
  Or a good security mind: http://www.schneier.com/essay-210.html http://www.schneier.com/essay-210.html
staunch 18y ago
The vast majority of web sites that allow sign ups will prevent you from joining with an existing email address. Almost none of them limit the number of times you can try to sign up. Obviously from a security perspective it's probably a good idea to limit this. In practice though, who's really been bitten by this problem? The search space for valid email addresses is super large. There are much easier ways to get lists of valid email addresses. The most useful thing you could learn (I think) is that an email address you already know is in their database. But, that would be possible even if you were limited to a small number of attempts.

mojuba 18y ago

The vast majority of web sites have this privacy/security flaw in their password recovery systems: they respond by saying if they have the email address or not in the database, which means, anyone can check out if you are a member of a service or not by trying out your email.

jonknee 18y ago
I've done it both ways and the customer service reps much prefer when it lets you know if the email was sent or not. Otherwise they get lots of calls from unhappy people who put in their old email address and didn't get their login info. It's a usability trade off. I think a good compromise is limiting to a few attempts within a time period. That way you won't get a dictionary attack, but if someone has to try a few email addresses they can.

smanek 18y ago

I hate to say it, but storing users' passwords in plaintext in your internal db/filesystem isn't that bad ... (relative to a lot of other snafus we've seen). I'll of course grant that it is a far from ideal state of affairs and should be fixed. But, I think we can pretty safely assume that if an attacker has unfettered access to your server, you have bigger things to worry about.

swombat 18y ago
Don't hate to say it. It's a reality of the web that usability trumps security. And those who disagree should unplug their computer now, because it's not secure. This is really missing the forest for the trees though. If you log in via a plain text form, who cares that your password gets sent in a plain text email? There are easier ways to get people's passwords than to sniff plain text emails - phishing, for example, or social engineering, both of which are much easier to implement than an email-sniffing man-in-the-middle server.
- jaf656s 18y ago
  the problem isn't entirely with sending a plain text password in an email. It is that the passwords are being stored in plain text in the database. This is just an SQL injection away from gaining an email-password list of all members of the site. Couple this with the fact that many people use the same password for other accounts, including email, and you have a definite security problem for the users.
  - swombat 18y ago
    How do you know they're stored in plain text in the db? I have that same functionality in my start-up, but we encrypt the passwords in the db. We just don't one-way-hash them.
    - jeremytliles 18y ago
      Exactly. It seems that about 75% of the commenters here and on CodingHorror are making this leap from "System can send password to user" to "System is storing password in clear text." Maybe Jeff's next post should be focused on how many "hackers" are unable to perform simple logical analysis. I believe the flaw here is that it sends your existing password rather than sending you an email link to create a new one. Not really worth a post (and all the ensuing discussion).

babul 18y ago

The now defunct Active Matter (who built the site, in 2003) were hopefully not members of Mensa.

dgabriel 18y ago

Does mensa store sensitive user data (financial info/ssn/naked pictures), or is it like most sites that store maybe customization options, possibly a calendar, possibly grant access to a forum? Unless there's sensitive data, it doesn't seem all that incredibly stupid to me. Am I missing something? Of course, I would prefer to generate my own password, rather than using one created for me.

natrius 18y ago
It doesn't matter how sensitive the data you're storing is. It matters how many other sites your users have used the same password on, and what those sites have stored on them. If salting and hashing passwords is all you need to do to help protect your users from their bad security decisions, I don't see why anyone wouldn't do it.
- dgabriel 18y ago
  It doesn't really apply here, because the user obviously has an assigned password. Users are quite unlikely to change their other passwords to match their mensa-assigned password. However, it's an interesting point, and possibly deserves debate. How responsible am I for ensuring a user's security on other sites? Should all password fields be flanked by a flashing message that reads something like: Do not use your online banking password here?

raganwald 18y ago

Old timers remember the exact same issue with reddit.com, only they went the extra distance and had their servers stolen with passwords on them.

raganwald 18y ago

I realize it's a colloquialism and not to be taken too literally, but I don't care for the premise of Jeff's opening line: I may not be smart enough to join Mensa, but I am smart enough not to build websites like the American Mensa website. It implies that smartness is a single continuum (maybe, maybe not), and that you can measure it by looking at single actions like whether someone implements security feature X in a web site. My feeling about something like this is that most people who get it right are probably people who have heard or read about the issues regarding plaintext passwords. That makes them more knowledgeable, which is a fine thing if you are hiring them to build a web application, but not the same thing as smart in this sense. True, some people can work out the issues from first principles, which is definitely evidence of smartness, but I have strong doubts that you can get an accurate measure of smartness from just one "test" like this. Overall, it would be a far better "zinger" if it were a security web site with a security flaw, something like the story of the identity protection company whose CEO had his identity stolen. All that being said, I still upmodded the story. Blogging this kind of thing is a public service and a reminder for hackers doing start-ups can't hurt. It would be terrible if you built a great service, were just about to raise a substantial round, and some know-it-all technoid working with the VC flipped your bozo bit because you stored passwords in plain text.

gruseom 18y ago

One of the funniest things I ever saw: a bumper sticker that said "Mensa" and was upside down.

nazgulnarsil 18y ago

The idea behind mensa is that people with high IQ's need to associate with their own kind to feel comfortable. This is elitist crap. People who are truly intelligent are able to effectively communicate with the largest variety of people. In fact I would define that as a dimension of intelligence.

jraines 18y ago
Well, you can call me an elitist (though I've never been a member of or interested in Mensa), but I don't think this is crap. Happiest times of my life were when I was among high concentrations of intelligent people on a daily basis. The very existence of this community is evidence against your point. Or are all the truly intelligent people out there happily communicating with YouTube commenters?
- DTrejo 18y ago
  Are you sure that you were happy because the people around you were intelligent? Or was it because you were in an intellectual environment where people discussed interesting topics?* *free of inane comments
  - jraines 18y ago
    The latter really doesn't happen without the former, in my opinion.
    - deleted 18y ago
      [deleted]
edw519 18y ago
I once had a girlfriend who had joined Mensa to meet "smart guys". She said all she ever met were geeks and ADD freaks. Then she ended up with me. </irony>

aasarava 18y ago

By the way, the comment from Aaron G on the original article is right on: Don't think you've got better security than Mensa if you're using MD5 to hash your users' password -- you should be using something along the lines of bcrypt. http://openwall.com/phpass/ http://openwall.com/phpass/

AndyKelley 18y ago

Without looking at the answer, I couldn't figure out what the problem with the site was. Could it be that the password is sent to the email? No, that's probably just how they worded the command button. Of course they'd hash a new password and send that to my email. And Atwood wouldn't repeat himself yet again, would he? After a few minutes, I finally guessed: the feature is much too wordy. The entire paragraph under the text field is completely unnecessary. I guess I would want to avoid websites that make this mistake because I don't like poor design and pointless text. Apparently I have more of a mind for design than security.