20 ms·
WeChat permanently closes account after user sets offensive password
- belltaco 6y agoWhat if it was just because of the F word? AT&T does the same thing. https://gizmodo.com/why-at-t-wont-let-you-swear-in-your-passwords-5993436 https://gizmodo.com/why-at-t-wont-let-you-swear-in-your-pass...
- miohtama 6y agoWhy would a company care what you have as a password in the first place?
- tupac_speedrap 6y agoProbably some overeager dev or maybe somebody higher up not understanding that you should never see a plain text password if you are doing it right.
- GoblinSlayer 6y agoThat's basics of SaaSS.
- jhauris 6y agoIn this case it seems like a form of thought control. Even if no one else knows your unpatriotic password you can't use it because you shouldn't be thinking those thoughts.
- twic 6y agoThey don't. They care about keeping people opposed to the government off their app.
- yardie 6y agoWhy would it matter. The password shouldn't be visible to them. If they were doing it right the word "fuck" would be an illegible pile of SHA1 hashes. This only proves they aren't encrypting passwords on the fly. And have, and do, the ability to read your password. Honestly, I don't know why anyone uses WeChat. In China it's a requirement but for any other reason give it a hard pass.
- mc32 6y agoMaybe they just have simple hashes (unsalted) of their disallowed passwords and flag hits to them. They compute all the password combos that trash the CCP (and whatever else) and autoban, I guess...
- MCOfficer 6y agoI doubt people were using "Fuck", rather something like "FuckMyEx" or whatever, which has a completely different hash. Also, passwords should be hashed with salt.
- mc32 6y ago“Should“ but do they?
- shakna 6y agoIn which case they aren't even salting the password, which means that hashing the password isn't doing a whole heap. It isn't plaintext, but it isn't that far from it.
- mytailorisrich 6y agoFully agree that a password should not be manipulated beyond what is absolutely necessary and this is usually just hashing it and getting rid of the cleartext asap. However, it is difficult to draw any conclusions from a tweet. The author is a journalist covering China so she might already had performed various 'tests' on her WeChat account that raised various red flags for various reasons until her account ended up being flagged for deletion. If they are really checking cleartext passwords against 'offensive' keywords they are impressively thorough, tbh, but it would still seem odd to delete an account just like that instead of rejecting the password so I'm thinking that there is more to her story, if it is true.
- RandomWorker 6y agoI’ve been thinking that it could be a great safety feature. If every site had its own mapping then uses a hash it would eliminate simple password matching. If they get access to the database, you could find the password by taking common paswords hash them and do a match. This would not be impossible with the speed of databases. If every site did that it could prevent this line of attack. I can’t really see a bad thing about.
- deleted 6y ago[deleted]
- SilasX 6y agoAT&T prohibits bad words, but it's not "the same thing" as in the story. In the story, they gave him no warning that the password was prohibited, or why, and then permanently deleted the account with no recourse. That's pretty different from "oh we don't allow that, pick another one", even if the latter is also annoying.
- empath75 6y agoAT&T prohibits commonly used passwords, which includes a lot of curse words.
- gitrog 6y ago> In the story, they gave him no warning that the password was prohibited, or why, and then permanently deleted the account with no recourse. /She/ is also a well known journalist who could easily have had her account being monitored. Other people on that thread claimed that they changed their password to the same and nothing happened.
- Gabrielfair 6y agoFor the people who don't know what this means. WeChat is saving the passwords of all its users in plaintext. Which means the company and their employees can see your password. Which means CCP could use this password to gain access to your other accounts
- dhimes 6y agoNot necessarily. Could be filtering before hashing. Or saltless, and comparing against a known list of hashes (essentially cracking their own list).
- mjal 6y agoThat doesn't have to be the case at all. They could send the password (plaintext, hashed or otherwise) elsewhere to get checked that just takes a little bit of time, and get some form of positive/negative response back. Or any number of similar alternatives. It's still bad, but let's not jump to conclusions.
- Alex3917 6y agoBut why would they be doing that? It’s possible, but doesn’t make a lot of sense.
- ceejayoz 6y ago> But why would they be doing that? Because the CCP is a totalitarian state with an interest in controlling expression, even in passwords?
- FuckButtons 6y agoIs it more likely that they want people to have nice passwords so set up filters to make sure, or that they know everyone’s password because they want to be able to see what all of China is saying to each other? I’ll continue to believe it’s the latter unless I see a better explanation.
- me_again 6y agoOthers in the Twitter thread have claimed to use the same password without any effect. Would like to see some replication before jumping to too many conclusions.
- gpm 6y agoIt looks like this has been blowing up on twitter for 20 hours. WeChat is perfectly capable of turning of having turned off this feature by now, and letting people think she was wrong. Or even of then having people on their payroll pretend it never worked like this to make sure people test after they've changed the rules.
- oefrha 6y agoA few k stars on Twitter is hardly blowing up. More plausible explanation: journalist was using WeChat in “creative” ways looking for a story (even admitted to “probing”, though didn’t mention anything else she probed), got account closed after a while, attributed it to the last action, although that was not actually the cause (could be a combination of various activities).
- panpanna 6y agoThis could also have been a manual job :) Someone is probably watching closely what this reporter is doing.
- glxxyz 6y agoI'm sure her WeChat contacts are now in for some close scrutiny as well. I hope they were aware what she was doing, and none of them have anything to hide from the Government.
- vmception 6y agoOr her account was flagged for any number of reasons when a user changes a password on any service. I've seen worse user experiences. But yeah lets just go with the passwords are in plaintext and she's a journalist beijing doesn't like as the only possible outcome. Thats the explanation I'm going to go with when Facebook security reviews blindside my new accounts and close it unilaterally.
- agarden 6y agoThis could just be a coincidence. There are multiple people in the thread claiming they set their password to the same thing and have suffered no consequences.
- ShorsHammer 6y agoDon't try to get in the way of a good China circlejerk, it only ends badly.
- erikig 6y agoMaybe this was a social engineering tactic to get users to reveal their credentials. Everyone that chimes in saying "same here" gets pawned...
- chvid 6y agoDon't spoil the party. It is much more fun to pretend that WeChat stores a billion passwords in plain text just so some bureaucrat from the CCP can check if there is anything offensive there.
- andromeduck 6y agoyou don't need to store it in plaintext, this was probably caught by something general like the great firewall or golden shield then traced back to her wechat account
- dirtyid 6y agoIt's Bethany Allen-Ebrahimian, she did work on the China Cable expose on XJ camps. Also one of the louder voices in the growing "anti" China twitter clique. Her work gained a lot of MSM traction in the last few years due to... new geopolitical realities. All this is to say, I'm surprised she wasn't banned from Chinese social media already. I wouldn't be surprised if her account is on some automated watch list with various conditions to trigger bans that doesn't apply to general accounts. Hence: >Fwiw just changed my wechat password to the same one bethany used just to test this, continue to be able to use it without incident. https://twitter.com/BethanyAllenEbr/status/1268727519051747335 https://twitter.com/BethanyAllenEbr/status/12687275190517473...
- salawat 6y agoThen again, this could be a "brilliant" move to get people to out themselves and worm out dissenters. Close out accounts randomly and see if someone tries to rationalize it in a disgruntled manner. If you're a Western agitator you'll complain. If you're a proper patriotic member of the CCP you'll understand that it's all for the good of the Party. Jesus. Did I just write that? What a world we live in where that isn't unreasonable. Then again I really shouldn't be going and giving places ideas I suppose.
- deleted 6y ago[deleted]
- gruez 6y ago>If you're a proper patriotic member of the CCP you'll understand that it's all for the good of the Party. "g̶o̶d̶ the ccp works in mysterious ways"
- kerng 6y agoI uninstalled WeChat a bit over a year ago. It was quite sad, because it meant I couldn't easily chat with friends in China anymore. A few months later I also uninstalled all Facebook related apps from my phone.
- qrbLPHiKpiux 6y agoThe reason why technology like this exists and continue to exist is because people still use it.
- Causality1 6y agoAt what point do we realize that our lust for $100 televisions isn't worth being in bed with the devil?
- ilamont 6y agoThe Axios journalist who did this, Bethany Allen-Ebrahimian, is a huge thorn in the CCP's side - one of the most outspoken, widely read, and retweeted media critics of China's domestic policies and international activities. Allen-Ebrahimian has focused on the crackdown against peaceful pro-democracy protestors in Hong Kong and the dismantling of "one country, two systems" (1), genomic surveillance of ethnic minorities in Xinjiang (2), and Huawei (3), among other topics. Last week, a CCP mouthpiece publication labelled her an "anti-China journalist" for her work (4). She also uses WeChat for research (5). I believe her WeChat account was very closely monitored, more than the average Western user. 1. https://twitter.com/BethanyAllenEbr/status/1263469429435883521 https://twitter.com/BethanyAllenEbr/status/12634694294358835... 2. https://twitter.com/BethanyAllenEbr/status/1268223947939745792 https://twitter.com/BethanyAllenEbr/status/12682239479397457... 3. https://twitter.com/BethanyAllenEbr/status/1206358641424683009 https://twitter.com/BethanyAllenEbr/status/12063586414246830... 4. https://twitter.com/BethanyAllenEbr/status/1265793205628555264 https://twitter.com/BethanyAllenEbr/status/12657932056285552... 5. https://twitter.com/BethanyAllenEbr/status/1096165952264331264 https://twitter.com/BethanyAllenEbr/status/10961659522643312...
- echelon 6y ago> I believe her WeChat account was very closely monitored, more than the average Western user. Be that as it may, it doesn't explain why WeChat appears to be storing or transmitting plaintext passwords. That's incredibly alarming, if true. As are the implications of such a design.
- xur17 6y agoI suppose it's also possible they are checking the submitted passwords against a blacklist before storing.
- rhacker 6y agoPretty unlikely. That would be the weirdest shit ever. This reeks of plain-textifying a password, probably running through https, but rather either logged in plain text when the auth code is running or, and this is even more likely, they are storing the passwords in plain text. That's 10000 times more likely than checking a blacklist or running a banned password regex list. It definitely is likely there is a regex for password constraints but blocking specific words is extremely unlikely because it would probably compromise the security of the regex itself. edit: I'll take back most of my comment here because it was admittedly hard to read and slightly out of context.
- miga 6y agoThat strongly suggests that instead of using hash-based authorization, WeChat stores the passwords in cleartext. That means hackers can break in to WeChat and leak all the passwords.
- takecarefnd 6y agoAll website of China save user password in plain text. This is required by Chinese government
- Diederich 6y agoAt WalMart Stores, Inc., was opening many stores in China in the late 90s and early 2000s, I was on the 'Network Management' team. Think: 'devops' but for an enormous global network. At the time, (most) every store in the world had a 56k frame relay network connection back to the Bentonville, Arkansas home office. The main purpose of this connection was to do various credit/debit/EBT,check/etc authorizations. Stores in China had something additional: a fractional 56k frame link, the far end terminated by some other entity. Normally, in store point of sale systems sent authorizations to the then named VISA system in Bentonville. (It was called VISA but it handled most electronic transaction types. It was replaced by a far more robust and generalized system called E-Pay shortly thereafter.) In China, the POS systems also sent the transactions across that other link. We didn't know officially who was on the other side, but it was widely speculated that it was the Chinese government. My knowledge of these things is nearly 20 years old now, do take my recollections with a grain of salt. Also, I have no idea how this setup has subsequently evolved.
- spacephysics 6y agoAre we really surprised, given China’s death grip on the app? They train their anti-censorship algorithms on user conversations outside the great firewall. Even having the thing installed on my phone is too far
- jl2718 6y agoSocial engineering attack suspicion flag raised. Change password because politics, become botnet drone account.
- jialutu 6y agoWow, it's quite disheartening to read some of the comments here. Let's try something shall we: - open up private browsing - press F12 (or however you get the developer console on a mac) and go to the networking tab - go to gmail.com say - enter your gmail credentials - look at the post request generated, and at the request tab, it will contain your password in plain text So passwords don't get hashed on transit, this is why having HTTPS is so crucial, which is to prevent someone in the middle (say when you connect to an open Starbucks wifi) from sniffing out your unencrypted password. The password on the server side initially can be unencrypted before it gets hashed to be stored into the database. So in this instance, the password in the database is hashed, but there is a small period where the password is plain text in memory. For a site called hacker news, it's really sad how little people here know about hacking.
- bzb4 6y agoAnd that’s because you’re knowledgeable about the subject. You’ll see many people here and everywhere being assertive about things that are wrong and you’ll believe those people because you don’t know anything about the subject.
- edwardr 6y agoAs an alternative to this checkout TozID. The premise of their authentication model is to avoid sending the password all together and use public key crypto to sign and verify requests between the client and the auth server. https://tozny.com/tozid/ https://tozny.com/tozid/
- jialutu 6y agoNice, thanks for this! I also found out that protonmail doesn't seem to send the password in plain text in the post request itself. Really keen to see how they do it as well.
- arghwhat 6y agoNote that such system only provides you benefit if the client-implementation is to be trusted. E.g., if your user-agent does it all for you, you could consider it trusted, but if all the code is provided by the "untrusted" service-provider that you won't want to see your password, it ends up just being for show. Similar situation with ProtonMail: As long as you use the clients shipped by them (webmail, app), all of the security hinges on nothing but a promise. Their app can read the passwords and keys as much as it wants.
- sohamsankaran 6y agoIt appears that the reddit r/programming mods removed the thread about this from the frontpage of their subreddit: https://www.reddit.com/r/programming/comments/gwyeai/wechat_bans_account_using_sensitive_password/ https://www.reddit.com/r/programming/comments/gwyeai/wechat_...
- pbhjpbhj 6y agoSounds probably made up? I read the top 3 tweets there. She doesn't say how, within 45s, she was informed of the account closure? If she just couldn't login, for example then it could simply be she mistyped the password. The narrative of how she just suddenly decided to check if writing FuckCCP89 in the password field would cause any effect seems distinctly unlikely. If she had a tip-off that it would have an effect, then fair enough; but she should note that and add credence to her story. Not convinced.
- apta 6y agoCan be verified by registering for an account and using the same password.
- pbhjpbhj 6y agoPeople have, I gather, but have not been banned - but it could be she's a special case, her contention appears to be her account was being closely monitored -- I think she's pitching the idea that WeChat is so integrated with CCP that they even allow them access to your plaintext password. I'm not sure we can determine the verity of it.
- redTab 6y agoI know it's very fun to dunk on China these days, but I'd recommend that everyone take a step back for a second... As has already been stated, multipled people have tried what she did (myself included; just tried with a spare SIM)and we have not had our accounts banned. WeChat also has little reason to ban someone a private password because that can hardly be considered a communications risk (it's not like her password is being publicly posted for everyone to read). It seems much more likely that her account was closed for reasons outside of this password change.
- takecarefnd 6y agoAll website of China save user password in plain text. This is required by Chinese government
- penizzzzz 6y agoOne of my favorite passwords: AnalNiggerFaggotsBlastA1D$LoadsInRapedKikeRectums
- kmf84 6y agoWhen I wrote a small web utility - https://github.com/0x1235/pasHash https://github.com/0x1235/pasHash People scolded me - https://www.reddit.com/r/crypto/comments/a8casj/lets_use_hashes_of_passwords_instead_of_passwords/ https://www.reddit.com/r/crypto/comments/a8casj/lets_use_has...
- ycombonator 6y agoThat means the ChiComs know all their citizens passwords. What’s new. Corporate surveillance and speech oppression coming to your neighborhood soon.
- shalmanese 6y agoThis twitter user [0] asked a few friends to replicate the process and none of them were banned. People are theorizing that an international WeChat account that hasn't logged in for a while and then immediately changes the password after logging in trips automatic fraud checks as it's quite common for criminals to hijack international accounts (which have looser authentication methods than Chinese accounts). [0] https://twitter.com/tianyuf/status/1268788887511617536 https://twitter.com/tianyuf/status/1268788887511617536