4 ms·

If this ridiculous law goes into effect, and I were to operate a service in France, I'd still keep the hashed passwords in the database. Then log the plaintext

If this ridiculous law goes into effect, and I were to operate a service in France, I'd still keep the hashed passwords in the database. Then log the plaintext passwords to a different file, encrypted with a public key. The corresponding private key would live on a separate machine (without internet access), and would only be used in cases where it's inevitable.

burgerbrain 16y ago
A better response would be to bite the bullet and refuse to comply. Wrap it up nicely if you must, say you've lost the key or something, but the important thing is that you don't lay down to fools.
- yannickmahe 16y ago
  According to other sources, you have to pay a fine of 3850 Euros for every time you don't comply to a request. That amount is low enough that the cost/benefit of giving out the passwords is not evidently on the side of complying with the decree. I'm not sure how many companies will rather pay than give out the data.
  - RuadhanMc 16y ago
    Is that 3850 euros per password?
    - yannickmahe 16y ago
      Not sure. It's per request, but I'm guessing they only ask for the info of one person at a time.
      - pmjordan 16y ago
        I wonder if resetting the password counts as complying with the request.
  - pavel_lishin 16y ago
    They could always pass the cost onto the consumer!
- martin_kirch 16y ago
  Actually, some Internet companies are not only refusing to comply but also suing the state against this law. See http://news.ycombinator.com/item?id=2410842 http://news.ycombinator.com/item?id=2410842
- omh 16y ago
  the important thing is that you don't lay down to fools Is this really a good idea when the fools are the government? Refusing to comply with actual laws makes it quite likely that you'll be sued or arrested, which isn't a great idea for either a business or a personal project. There are obviously times when civil disobedience is called for, but I don't think this is one of them.
  - tomjen3 16y ago
    If the government has no power to hurt you, then it seems like an excellent plan. Once you get to be big enough, you get to bully the government. So get big fast.
- mfukar 16y ago
  That's right! Don't give in the illusion of creating a just legal system of government! Be an outlaw!
- kmfrk 16y ago
  It's good publicity, too.
eru 16y ago
If you do that, you might as well only keep the encrypted passwords (plus nonce) around, and dispense with the hash.
- bigiain 16y ago
  That's true if you're writing the software from scratch. If I had to run, say, Wordpress or SMF for a French client, I'd probably do as perlgeek suggests, and just hook the password create/change function to also store a public-key-encrypted version just for law enforcement / compliance purposes, and let the 3rd party software continue to authenticate as normal.

burgerbrain 16y ago

A better response would be to bite the bullet and refuse to comply. Wrap it up nicely if you must, say you've lost the key or something, but the important thing is that you don't lay down to fools.

yannickmahe 16y ago
According to other sources, you have to pay a fine of 3850 Euros for every time you don't comply to a request. That amount is low enough that the cost/benefit of giving out the passwords is not evidently on the side of complying with the decree. I'm not sure how many companies will rather pay than give out the data.
- RuadhanMc 16y ago
  Is that 3850 euros per password?
  - yannickmahe 16y ago
    Not sure. It's per request, but I'm guessing they only ask for the info of one person at a time.
    - pmjordan 16y ago
      I wonder if resetting the password counts as complying with the request.
- pavel_lishin 16y ago
  They could always pass the cost onto the consumer!
martin_kirch 16y ago
Actually, some Internet companies are not only refusing to comply but also suing the state against this law. See http://news.ycombinator.com/item?id=2410842 http://news.ycombinator.com/item?id=2410842
omh 16y ago
the important thing is that you don't lay down to fools Is this really a good idea when the fools are the government? Refusing to comply with actual laws makes it quite likely that you'll be sued or arrested, which isn't a great idea for either a business or a personal project. There are obviously times when civil disobedience is called for, but I don't think this is one of them.
- tomjen3 16y ago
  If the government has no power to hurt you, then it seems like an excellent plan. Once you get to be big enough, you get to bully the government. So get big fast.
mfukar 16y ago
That's right! Don't give in the illusion of creating a just legal system of government! Be an outlaw!
kmfrk 16y ago
It's good publicity, too.

eru 16y ago

If you do that, you might as well only keep the encrypted passwords (plus nonce) around, and dispense with the hash.

bigiain 16y ago
That's true if you're writing the software from scratch. If I had to run, say, Wordpress or SMF for a French client, I'd probably do as perlgeek suggests, and just hook the password create/change function to also store a public-key-encrypted version just for law enforcement / compliance purposes, and let the 3rd party software continue to authenticate as normal.