6 ms·

In clear text? Really? How is this even allowed anymore?

by jtchang 15y ago

sunchild 15y ago
And indexed by Google. That is terrible.
- jc123 15y ago
  It might have been good that it was indexed by Google so that the problem was found quicker. Completely agree about how can cleartext be allowed. Harder to regulate overseas, but would it be possible to have an actual law in the USA against storing passwords and other confidential in cleartext? There are various consumer protections such as food, cars, toys, and could similar things be legislated for data?
  - Joakal 15y ago
    Of course. Keywords: PCI, MIPSA/HIPAA, etc. More: https://secure.wikimedia.org/wikipedia/en/wiki/Information_privacy https://secure.wikimedia.org/wikipedia/en/wiki/Information_p...
    - jc123 15y ago
      Yes, my impression is that passwords are not treated with the same seriousness as say credit card numbers, or health info. That (passwords) was actually what I was curious about, before I generalized my comment.
      - sunchild 15y ago
        Passwords are one of the safeguards (perhaps the most important) that protect personal/sensitive data.
    - oasisbob 15y ago
      PCI isn't law, it's the product of an industry group, and is arguably more about the protection of the networks and issuers than consumers. There is even less guidance and specific regulation pertaining to the encryption and security of banking records. The audits and regulations that are in place are more about overall controls than technological measures.
- mbrzuzy 15y ago
  I didn't even laugh, I just facepalmed.
anonymous246 15y ago
Obligatory post I make on these stories: Use PwdHash for Firefox and Chrome. It's very low overhead and provides and extra layer of protection from lazy programmers.
- Joakal 15y ago
  That only tackles the master password for every site issue. It does not solve the password being plaintext. For example, Facebook has a central ID and if they don't protect the password that gets exposed, someone could use the password to withdraw money from another section of the website.
  - pavel_lishin 15y ago
    You can store money on Facebook?
    - Joakal 15y ago
      Not quite. At the moment it's virtual currency [0]. My point was that security holes increase as service increases in complexity. Especially when it's used for everything and becomes a hard lesson in SPoF for users, like the money example. [0] http://www.facebook.com/credits/ http://www.facebook.com/credits/
  - anonymous246 15y ago
    Yeah, nobody can prevent a leaked password from being used to the site from which it was leaked. This extension is helpful because people reuse passwords: a leaked password cannot be used to causes damage on other sites. Obviously, I agree that sites shouldn't store passwords in plaintext, but good luck enforcing that.
- jc123 15y ago
  PwdHash looks great and it would be nicer if it was implemented by all browsers. To take the idea further, what if the HTML5 standard for input type=password automatically did the hashing before forms are submitted? On any form submission, browsers would hash like PwdHash by using the current domain. There would also be no need to use a prefix like PwdHash. Those are some quick thoughts and I think there's better ideas that can be implemented, that don't require work for consumers. Won't protect against things like weak passwords, but even a little contributes to security.

In clear text? Really? How is this even allowed anymore?

by jtchang 15y ago

In clear text? Really? How is this even allowed anymore?

sunchild 15y ago

And indexed by Google. That is terrible.

jc123 15y ago
It might have been good that it was indexed by Google so that the problem was found quicker. Completely agree about how can cleartext be allowed. Harder to regulate overseas, but would it be possible to have an actual law in the USA against storing passwords and other confidential in cleartext? There are various consumer protections such as food, cars, toys, and could similar things be legislated for data?
- Joakal 15y ago
  Of course. Keywords: PCI, MIPSA/HIPAA, etc. More: https://secure.wikimedia.org/wikipedia/en/wiki/Information_privacy https://secure.wikimedia.org/wikipedia/en/wiki/Information_p...
  - jc123 15y ago
    Yes, my impression is that passwords are not treated with the same seriousness as say credit card numbers, or health info. That (passwords) was actually what I was curious about, before I generalized my comment.
    - sunchild 15y ago
      Passwords are one of the safeguards (perhaps the most important) that protect personal/sensitive data.
  - oasisbob 15y ago
    PCI isn't law, it's the product of an industry group, and is arguably more about the protection of the networks and issuers than consumers. There is even less guidance and specific regulation pertaining to the encryption and security of banking records. The audits and regulations that are in place are more about overall controls than technological measures.
mbrzuzy 15y ago
I didn't even laugh, I just facepalmed.

anonymous246 15y ago

Obligatory post I make on these stories: Use PwdHash for Firefox and Chrome. It's very low overhead and provides and extra layer of protection from lazy programmers.

Joakal 15y ago
That only tackles the master password for every site issue. It does not solve the password being plaintext. For example, Facebook has a central ID and if they don't protect the password that gets exposed, someone could use the password to withdraw money from another section of the website.
- pavel_lishin 15y ago
  You can store money on Facebook?
  - Joakal 15y ago
    Not quite. At the moment it's virtual currency [0]. My point was that security holes increase as service increases in complexity. Especially when it's used for everything and becomes a hard lesson in SPoF for users, like the money example. [0] http://www.facebook.com/credits/ http://www.facebook.com/credits/
- anonymous246 15y ago
  Yeah, nobody can prevent a leaked password from being used to the site from which it was leaked. This extension is helpful because people reuse passwords: a leaked password cannot be used to causes damage on other sites. Obviously, I agree that sites shouldn't store passwords in plaintext, but good luck enforcing that.
jc123 15y ago
PwdHash looks great and it would be nicer if it was implemented by all browsers. To take the idea further, what if the HTML5 standard for input type=password automatically did the hashing before forms are submitted? On any form submission, browsers would hash like PwdHash by using the current domain. There would also be no need to use a prefix like PwdHash. Those are some quick thoughts and I think there's better ideas that can be implemented, that don't require work for consumers. Won't protect against things like weak passwords, but even a little contributes to security.