9 ms·

For the people who don't know what this means. WeChat is saving the passwords of all its users in plaintext. Which means the company and their employees can see

• dhimes 6y ago
  Not necessarily. Could be filtering before hashing. Or saltless, and comparing against a known list of hashes (essentially cracking their own list).
• mjal 6y ago
  That doesn't have to be the case at all. They could send the password (plaintext, hashed or otherwise) elsewhere to get checked that just takes a little bit of time, and get some form of positive/negative response back. Or any number of similar alternatives. It's still bad, but let's not jump to conclusions.
  • Alex3917 6y ago
    But why would they be doing that? It’s possible, but doesn’t make a lot of sense.
    • ceejayoz 6y ago
      > But why would they be doing that? Because the CCP is a totalitarian state with an interest in controlling expression, even in passwords?
      • FuckButtons 6y ago
        Is it more likely that they want people to have nice passwords so set up filters to make sure, or that they know everyone’s password because they want to be able to see what all of China is saying to each other? I’ll continue to believe it’s the latter unless I see a better explanation.
        • ceejayoz 6y ago
          It's highly unlikely they need folks' passwords to "see what all of China is saying to each other". I'd fully expect the Chinese government to have full access to that, without any need for a password.
          • dylan604 6y ago
            Unless they assume the average Chinese user is just like the average user everywhere else on the planet which tends to reuse password in multiple locations.
            • ceejayoz 6y ago
              If that were the motivation, you wouldn't tip your hand to it by banning a user for using an impermissible password.
    • bbarnett 6y ago
      What makes more sense, is it is a fabrication, a story for twitter clickbait. Just because WeChat does numerous, dislikable things, doesn't mean they monitor passwords. Or did this.
      • vgaldikas 6y ago
        You might be right. Just to test I signed up for it, set it the exact same password, and 45 seconds is long past, but I don't appear to be banned.
        • justadudeama 6y ago
          I think the fact that she is a western journalist who speaks out against the CCP makes a reasonable explanation that her account is more 'watched' then the average account.
          • vgaldikas 6y ago
            Well I would imagine they would just automate such thing? And why would you do fuckery with a journalists password? Seems like especially stupid thing to do
      • vgaldikas 6y ago
        I even tried to change my name too FUCK CCP, and it went ok. But then I got into a problem: https://imgur.com/a/JbUclhL https://imgur.com/a/JbUclhL Is there like only one xi jingling in the whole china? If not, what at others supposed to do?
        • baybal2 6y ago
          > Is there like only one xi jingling in the whole china? If not, what at others supposed to do? Change their surnames
        • oefrha 6y ago
          Others probably use Chinese characters, not a romanized version.
    • usrusr 6y ago
      A caring dev sneaking in a blacklist to reduce the risk of physical harm for users who unexpectedly find themselves in a rubber hose attack? Surely the least likely of all possible explanations, but an easter egg blocking passwords that are variations of "I refuse to cooperate" would be a hidden artistic statement in its own way.
  • panpanna 6y ago
    That is actually worse. Would you trust the third party that flagged this as offensive: F*ckCCP89 Edit: given that her account was permanently deleted after just 45 seconds, I actually think some party member working at WeChat is monitoring her activities in real-time. The password probably get him angry enough to push the permadelete button.
    • discordance 6y ago
      If the account was blocked in 45 seconds then it would be highly unlikely it was moderated by a human.
      • panpanna 6y ago
        But given that people have not been able to reproduce this suggests this was probably not automated. Also, I have hard time seeing an automated system that deletes someone's account including all data for using the f-word in their password.
        • hunter2_ 6y ago
          Maybe the people trying to reproduce it didn't already have strikes against their account and this reported could have.
      • myrandomcomment 6y ago
        Why? China does flag people for monitoring 24/7. Is it hard to believe that in China where the party values stability over everything else that they would not have ID people that they feel post / report unfavorably on the CCP as someone to be tracked / watch by a human at all times? The Chinese state security apparatus is quite good and has near unlimited budget and man power.
    • andrewflnr 6y ago
      Actually, the timeline indicates to me that it was automatic. Considering that they wouldn't assign someone solely to watch one journalist's account for infrequent changes, I think it's unlikely that any human saw it in the first few seconds after it happened and took it on themselves to take irrevocable action in the next second after that. My feeling is that queueing delays of various sorts took up most of the 45 seconds, but I would love to hear better ideas on that point. Would a native Chinese speaker even have that visceral emotional reaction to English profanity? I'm curious about how that impact translates.
  • dirtyid 6y ago
    The OP is Bethany Allen-Ebrahimian, a China reporter that's likely on the CCP shitlist. Most likely there are actions specifically targeting her account that she's conflating with general policy. Also she could... just be embellishing. As someone who follows the space, her reporting is occasionally very questionable. But my money is her account was being monitored there's a trigger to ban if she takes account changing actions. This way CCP can slowly weed out foreign reporters instead of blanket ban.
• Znafon 6y ago
  This is wrong for multiple reasons: they can check whether the password is offensive before hashing it and they wouldn't need your password to access your account anyway.
• turboturbo 6y ago
  They can check upon login.
• erikig 6y ago
  I'd be surprised if they didn't have a rainbow table of all weak passwords. The addition of offensive password checking and the ability to ban users based on their content is what's novel and alarming in this case.
  • lukevp 6y ago
    If they’re salting like they should then rainbow tables aren’t useful. They would just have a plaintext list of weak passwords and do a direct lookup. Rainbow tables are just a compression technique for hashed password lookups which wouldn’t work with salting.
• zoomablemind 6y ago
  Anyone remembers seeing green or red indicator on password strength (min num of special characters, digits). All done at the client, well, letting one to correct before accepting. In the OP case it could be many factors added together that led to the banning. This underscores how precious and fragile the freedom of speech is.
• kerng 6y ago
  It makes perfect sense that the government gets all the cleartext passwords forwarded. People reuse passwords, so its likely that WeChat passwords allow access to other systems (like Facebook, Twitter, Alibaba, Amazon,...) This attack angle of just collecting passwords for government has not yet occured to me before.
  • baybal2 6y ago
    I'm surprised that's not being raised before. Tons of passwords in the web are still 100% plaintext on the other end of TLS connection. And then people getting surprised from where do those ginormous plaintext password leaks come from. All kinds of popular online forum engines were being hacked for password captures since times immemorial. PHPBB still uses server side hashing for example. Now, for people concerned, take a look who was the party who sank crypto forms at W3C.
  • justadudeama 6y ago
    Not saying this isn't important data, but at some point does 2FA make this an innefective method to spy on your citizens? If I have 2FA on my Amazon, if the CCP tried to get into it I would just get a notification with a code, and do nothing except maybe change my password. Additionally, there are probably all sorts of account logs saying "this is who logged in when from what IP address" that are associated with a lot of these accounts. Direct access via the companies themselves is probably much more valuable today.
    • tialaramex 6y ago
      SMS-based 2FA is pretty weak, I think you can reasonably assume that a resourceful government adversary can silently divert SMS codes intended for your phone to their systems. In the case of China in particular we know that part of the "Great Firewall" have IP addresses associated with Chinese residential ISPs, whether those are "hijacked" or the relevant agency just asks nicely we do not know. So it may be that "Chinese central government intelligence agency" and "My neighbour's WiFi" are similar IP addresses if you live there. But yes multi-factor authentication can reduce the impact of credential stuffing attacks.
• davedx 6y ago
  No you can't assume that, someone in the reddit chat had a more reasonable explanation: - password goes through filter check onSubmit and some flag is set on the account immediately, it's added to a queue, pw is hashed and stored - "account moderation" worker picks up task from its gigantic queue of Chinese accounts that need some automated action taking on them, bans account, notifies user, does whatever else needs to be done when closing an account for a service like WeChat Edit just to remark: a lot of people commenting on this thread are making some pretty big assumptions about both what apps do do and should do with passwords. In my experience, you can more or less say this: most companies and applications in 2020 do hash passwords before storing them in the database. Beyond that, all bets are off.
  • Darvon 6y ago
    What percentage of your networth would you bet that the Chinese government can't access WeChat passwords?
    • luc4sdreyer 6y ago
      What percentage of your networth would you bet that the Chinese government _can_ access WeChat passwords?
      • diabeetusman 6y ago
        7%
        • BluePen7 6y ago
          After my initial laugh at your response, I realized 7% is about what I'd bet too. My first foray into options trading I lost around 3% of my net worth, and I'd say I'm more than twice as confident about this than I was about that. I'd evaluate the odds of the CCP doing something, to be in line with the odds of them benefiting from doing something, regardless of the expense/risk to their populace. There's nothing I'd really put past them, we know for a fact they harvest organs from political dissidents, but we're skeptical on if they'd store passwords plaintext? Given people tend to re-use passwords, I'd imagine having a massive trove of plaintext passwords for all Chinese citizens, or even anyone who communicates with them, would be incredibly useful. Not to mention the fact that they have to maintain a list of anti-CCP passwords, which would be a tedious process, or they'd have to automate something to detect anti-CCP sentiment. I think an interesting experiment would be to see what less obvious anti-CCP passwords get you banned. With enough probing and data, I'd possibly increase my wager to 10%. As a well known and outspoken critic of the CCP, she might be elevated to the status where they actually just have a person reading everything she types into WeChat 24/7. Do you think they fully staff the night shift, or would the ban have taken twice as long outside of Chinese business hours?
• duxup 6y ago
  That's not accurate. At some point all passwords are plain text, be it on the client or whatever, they could simply check it before it is encrypted and stored, even on the client end if they wanted to.
• jordache 6y ago
  No it doesn't. WeChat service will receive the password in plaintext. It's able to do processing on that plaintext value. It is likely storing a hashed version of the password in the database.