4 ms·
Servers routinely handle plaintext passwords when authenticating. They may not store it, but it's not something that is invisible to them, unless using some aut
by megous 5y ago
Servers routinely handle plaintext passwords when authenticating. They may not store it, but it's not something that is invisible to them, unless using some auth method that uses challenge/response instead of plaintext passwords. Most web apps use plaintext password auth.
- Kwpolska 5y agoThere is a difference between the plaintext password being stored in memory and in a database. One is just how things work (the client browser needs the password in plaintext as well), and another is a security breach waiting to happen.
- adolph 5y ago> There is a difference between the plaintext password being stored in memory and in a database. Yes, if you already got in, then reading RAM for active users is much more convenient than exfiltrating a bunch of potential trash accounts.
- pdpi 5y agoAny non-brain dead design will keep the password around only long enough to hash it and compare that to the store hash, and then promptly get rid of it. You can’t just read passwords from memory as if it were an open book.
- adolph 5y agoAttacks, as opposed to data breaches/exposures, may occur over longer time periods and sample memory as they go. Iirc, the attacker in The Cuckoo’s Egg both read password files and temporarily patched the login form.
- alophawen 5y agoYou don't have to hold clear-text data around for very long for it to be exfiltrated. And noone said clear-text passwords would just stick around in ram.
- Dylan16807 5y agoYour first sentence seems to describe sticking around and your second sentence says nobody claimed they would stick around? But more directly, "reading RAM for active users" as a method of gaining passwords, written in context as a direct consequence of "the plaintext password being stored in memory", sure sounds to me like a claim that they're sticking around.
- pdpi 5y agoIf my password is only ever kept in RAM during my login process, there’s a small window of time where it can be exfiltrated, it’s only really at risk if there is an attack in progress while I’m logging in. Persistent storage is always susceptible to exfiltration. Nothing is ever 100% secure, but we can limit the exposure, and the blast radius when you do get breached.