5 ms·
Any non-brain dead design will keep the password around only long enough to hash it and compare that to the store hash, and then promptly get rid of it. You can
by pdpi 5y ago
Any non-brain dead design will keep the password around only long enough to hash it and compare that to the store hash, and then promptly get rid of it. You can’t just read passwords from memory as if it were an open book.
- adolph 5y agoAttacks, as opposed to data breaches/exposures, may occur over longer time periods and sample memory as they go. Iirc, the attacker in The Cuckoo’s Egg both read password files and temporarily patched the login form.
- alophawen 5y agoYou don't have to hold clear-text data around for very long for it to be exfiltrated. And noone said clear-text passwords would just stick around in ram.
- Dylan16807 5y agoYour first sentence seems to describe sticking around and your second sentence says nobody claimed they would stick around? But more directly, "reading RAM for active users" as a method of gaining passwords, written in context as a direct consequence of "the plaintext password being stored in memory", sure sounds to me like a claim that they're sticking around.
- pdpi 5y agoIf my password is only ever kept in RAM during my login process, there’s a small window of time where it can be exfiltrated, it’s only really at risk if there is an attack in progress while I’m logging in. Persistent storage is always susceptible to exfiltration. Nothing is ever 100% secure, but we can limit the exposure, and the blast radius when you do get breached.