4 ms·

“Posting it to you is secure, as it's illegal to open someone else's mail.”

87 points by jamespwilliams 5y ago

charcircuit 5y ago
Surely there is an engineer there who understands plain text passwords is wrong, so why can't he fix it?
- maxbond 5y ago
  Authentication is the sort of thing that gets set up very early in the life of the application, and usually doesn't run into issues or need new features. When I've read production authentication/authorization code for apps I've worked on, it's usually been out of interest, not necessity. I feel like many, many people could work on that application, understand clear text passwords are wrong, and just not know that the application works that way.
- bogantech 5y ago
  Iirc (it's been a few decades..) if you have an ADSL service your password is stored in plaintext because that's the only way RADIUS can check your password with the various authentication protocols there are. Iirc the two mainly used authentication protocols for PPPOE connections are CHAP or MSCHAPv2, the former requires that both sides know the plaintext but the latter uses an NTLM hash that can be cracked. Everything is built around horrible old auth protocols ISPs usually have you use the same password for email, account and pppoe which all comes from RADIUS. They don't all support the same support for hashing algorithms etc ISP's should be changing them before sending them out but then you'll be without internet for a week or two depending on how slow your postal service is.
  - jonathantf2 5y ago
    Virgin is a DOCSIS service and I'm fairly sure you have to use their CPE so there aren't any connection login credentials that the user has - this is most likely just awful security on their part.
    - bogantech 5y ago
      From what I can see they used to have DSL too. But they should modernise things a bit if they don't need to deal with ancient crap.
  - Nextgrid 5y ago
    There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. As far as I understand it uses certificates that are built into the modems at manufacture time.
    - bogantech 5y ago
      > There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. It usually does just because they want the same password to be used for both > Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). DSL makes use of PPPOE so they don't have any choice to auth you any any other way. Also DSL services are terminated at DSLAMs that are not necessarily owned by your ISP. They use the radius realm (the bit after the @ in your username) to proxy your authentication request to the correct ISP. It would be nice if ADSL services didn't do PPPOE with CHAP authentication but they do. This is how they work whether you think there's a reason for them to or not. > But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. The company previously did DSL and when they stopped doing that I'd hazard a guess they didn't re-engineer the whole organisation to change how they auth users for webmail etc
- MattGaiser 5y ago
  Engineers don't get to randomly allocate their time like that.
  - eyelidlessness 5y ago
    Joke reply: sure, but we can pseudo-randomly allocate our time like that. More seriously: Many of us can… if it’s enough of a priority to us to accept the consequences. And we’re in such high demand that we often overestimate those consequences. I’m saying this from experience. I had begged to address a serious security issue, and eventually I just refused to work on anything else until it was fixed. The only consequences were that I overworked myself to see it through. All of management either supported me when I declared my intention, or let it happen without comment. I even received a substantial, non-routine pay raise in the same period. There was some pressure by one (IIRC, it’s been some time so details are fuzzy) PMish person to move on to feature work, but that pressure was just noise. Granted communication is essential in this. I made absolutely sure that everyone knew as much as they could understand about the risk factor, and known business impacts (side effects of this issue were also affecting other operations, which wasn’t widely understood by any of us for some time). This knowledge had already been shared prior to my decision to, effectively, go rogue. But the decision had to be mine, because I was the one motivated to fix it without incentive to find more ways to kick that can down the road. This isn’t meant as a story to glorify myself in any way, for what it’s worth. Just to say that we have more power to direct priorities on the job than most workers do, and more safety in choosing to exercise it than we may realize.
- Nextgrid 5y ago
  These companies are nothing like the typical modern tech startup most of us are familiar with. This is a legacy hell hole where if there even is engineering, it’s reduced to the bare minimum, outsourced to the lowest bidder (= idiots) and they are proud of it. There is absolutely no reason for skilled talent to join them, which also means no skilled talent to train new joiners, so the mediocrity is perpetuated forever. This is the same reason why modern fintech startups managed to build competitive current account products in a few years and the legacy banks still can’t catch up. It’s not a money or resources problem, it’s a mindset and culture problem that needs to be resolved from the top.
jwalton 5y ago
Just like guns are secure, as it’s illegal to shoot someone.
twobitshifter 5y ago
I had a parked domain with a registrar and the registrar had grown increasingly expensive and behind the competition over the years. Eventually I decided to move my domain. After a five step process that initially blocked me and eventually required me to speak to an agent they provided me with the auth code to transfer my domain. The code provided was the login password for my account.
- Tostino 5y ago
  "We'll just reuse the password as a token! Hashing, what's that?"
deleted 5y ago
[deleted]
suprjami 5y ago
If you're being robbed, just say no. It's actually illegal to take a person's property without their permission.
- jakelazaroff 5y ago
  "Burglars hate him! This one weird trick protects your home!"
- deleted 5y ago
  [deleted]
Havoc 5y ago
How do you run a major corporate Twitter and not realise audience is in various countries and thus laws. Esp for a UK group - the threshold for getting into trouble in UK for opening mail is quite high legally
dataflow 5y ago
I'm seeing some people miss the point here, so just to clarify: the part of this that's supposed to be ridiculous isn't the fact that they're deeming postal mail to be secure, but the fact that they're storing passwords in plaintext in their database (and also the fact that they completely miss the nature of this very issue in their reply about postal mail). I think the title should also be edited to make this clear.
- deleted 5y ago
  [deleted]
hogrider 5y ago
I swear late stage capitalism has killed any shred of caring for your customers.
MerelyMortal 5y ago
(2019) fyi ... I tried doing a search to see if Virgin Media fixed the error of their ways over the last two and a half years, but instead it looks like they've doubled-down on their ineptness (five days ago): > the ISP's email account policy wouldn't allow him to set a password longer than 10 characters; nor would it allow him to add two-factor authentication (2FA); the first character had to be a letter; and non-alphanumeric characters weren't allowed. https://www.theregister.com/2022/03/10/virgin_media_email_password_security/ https://www.theregister.com/2022/03/10/virgin_media_email_pa...
reitzensteinm 5y ago
It's illegal to log in to someone else's account, so why have passwords at all?
- Nextgrid 5y ago
  The customer service monkey should’ve handed over their bank account credentials to prove their point, since you know, stealing someone’s money is illegal.
Epiphany21 5y ago
"You wouldn't download a car"
bronzeage 5y ago

charcircuit 5y ago

Surely there is an engineer there who understands plain text passwords is wrong, so why can't he fix it?

maxbond 5y ago
Authentication is the sort of thing that gets set up very early in the life of the application, and usually doesn't run into issues or need new features. When I've read production authentication/authorization code for apps I've worked on, it's usually been out of interest, not necessity. I feel like many, many people could work on that application, understand clear text passwords are wrong, and just not know that the application works that way.
bogantech 5y ago
Iirc (it's been a few decades..) if you have an ADSL service your password is stored in plaintext because that's the only way RADIUS can check your password with the various authentication protocols there are. Iirc the two mainly used authentication protocols for PPPOE connections are CHAP or MSCHAPv2, the former requires that both sides know the plaintext but the latter uses an NTLM hash that can be cracked. Everything is built around horrible old auth protocols ISPs usually have you use the same password for email, account and pppoe which all comes from RADIUS. They don't all support the same support for hashing algorithms etc ISP's should be changing them before sending them out but then you'll be without internet for a week or two depending on how slow your postal service is.
- jonathantf2 5y ago
  Virgin is a DOCSIS service and I'm fairly sure you have to use their CPE so there aren't any connection login credentials that the user has - this is most likely just awful security on their part.
  - bogantech 5y ago
    From what I can see they used to have DSL too. But they should modernise things a bit if they don't need to deal with ancient crap.
- Nextgrid 5y ago
  There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. As far as I understand it uses certificates that are built into the modems at manufacture time.
  - bogantech 5y ago
    > There is no reason why your web portal password should have anything to do with the modem’s RADIUS passwords. It usually does just because they want the same password to be used for both > Frankly, there’s no reason to even have a modem password as you can just identify them based on the line (and an attacker that manages to get physical access to the like can trivially MITM to get the password anyway). DSL makes use of PPPOE so they don't have any choice to auth you any any other way. Also DSL services are terminated at DSLAMs that are not necessarily owned by your ISP. They use the radius realm (the bit after the @ in your username) to proxy your authentication request to the correct ISP. It would be nice if ADSL services didn't do PPPOE with CHAP authentication but they do. This is how they work whether you think there's a reason for them to or not. > But as another comment mentions, this is DOCSIS which doesn’t use any user-entered passwords for modems. The company previously did DSL and when they stopped doing that I'd hazard a guess they didn't re-engineer the whole organisation to change how they auth users for webmail etc
MattGaiser 5y ago
Engineers don't get to randomly allocate their time like that.
- eyelidlessness 5y ago
  Joke reply: sure, but we can pseudo-randomly allocate our time like that. More seriously: Many of us can… if it’s enough of a priority to us to accept the consequences. And we’re in such high demand that we often overestimate those consequences. I’m saying this from experience. I had begged to address a serious security issue, and eventually I just refused to work on anything else until it was fixed. The only consequences were that I overworked myself to see it through. All of management either supported me when I declared my intention, or let it happen without comment. I even received a substantial, non-routine pay raise in the same period. There was some pressure by one (IIRC, it’s been some time so details are fuzzy) PMish person to move on to feature work, but that pressure was just noise. Granted communication is essential in this. I made absolutely sure that everyone knew as much as they could understand about the risk factor, and known business impacts (side effects of this issue were also affecting other operations, which wasn’t widely understood by any of us for some time). This knowledge had already been shared prior to my decision to, effectively, go rogue. But the decision had to be mine, because I was the one motivated to fix it without incentive to find more ways to kick that can down the road. This isn’t meant as a story to glorify myself in any way, for what it’s worth. Just to say that we have more power to direct priorities on the job than most workers do, and more safety in choosing to exercise it than we may realize.
Nextgrid 5y ago
These companies are nothing like the typical modern tech startup most of us are familiar with. This is a legacy hell hole where if there even is engineering, it’s reduced to the bare minimum, outsourced to the lowest bidder (= idiots) and they are proud of it. There is absolutely no reason for skilled talent to join them, which also means no skilled talent to train new joiners, so the mediocrity is perpetuated forever. This is the same reason why modern fintech startups managed to build competitive current account products in a few years and the legacy banks still can’t catch up. It’s not a money or resources problem, it’s a mindset and culture problem that needs to be resolved from the top.

jwalton 5y ago

Just like guns are secure, as it’s illegal to shoot someone.

twobitshifter 5y ago

I had a parked domain with a registrar and the registrar had grown increasingly expensive and behind the competition over the years. Eventually I decided to move my domain. After a five step process that initially blocked me and eventually required me to speak to an agent they provided me with the auth code to transfer my domain. The code provided was the login password for my account.

Tostino 5y ago
"We'll just reuse the password as a token! Hashing, what's that?"

deleted 5y ago

[deleted]

suprjami 5y ago

If you're being robbed, just say no. It's actually illegal to take a person's property without their permission.

jakelazaroff 5y ago
"Burglars hate him! This one weird trick protects your home!"
deleted 5y ago
[deleted]

Havoc 5y ago

How do you run a major corporate Twitter and not realise audience is in various countries and thus laws. Esp for a UK group - the threshold for getting into trouble in UK for opening mail is quite high legally

dataflow 5y ago

I'm seeing some people miss the point here, so just to clarify: the part of this that's supposed to be ridiculous isn't the fact that they're deeming postal mail to be secure, but the fact that they're storing passwords in plaintext in their database (and also the fact that they completely miss the nature of this very issue in their reply about postal mail). I think the title should also be edited to make this clear.

deleted 5y ago
[deleted]

hogrider 5y ago

I swear late stage capitalism has killed any shred of caring for your customers.

MerelyMortal 5y ago

(2019) fyi ... I tried doing a search to see if Virgin Media fixed the error of their ways over the last two and a half years, but instead it looks like they've doubled-down on their ineptness (five days ago): > the ISP's email account policy wouldn't allow him to set a password longer than 10 characters; nor would it allow him to add two-factor authentication (2FA); the first character had to be a letter; and non-alphanumeric characters weren't allowed. https://www.theregister.com/2022/03/10/virgin_media_email_password_security/ https://www.theregister.com/2022/03/10/virgin_media_email_pa...

reitzensteinm 5y ago

It's illegal to log in to someone else's account, so why have passwords at all?

Nextgrid 5y ago
The customer service monkey should’ve handed over their bank account credentials to prove their point, since you know, stealing someone’s money is illegal.

Epiphany21 5y ago

"You wouldn't download a car"

bronzeage 5y ago