4 ms·

Still storing clear text passwords in 2012, how the hell do these people have businesses? I mean, I learned about this stuff at age 12 while learning PHP on my

by pwny 14y ago

Still storing clear text passwords in 2012, how the hell do these people have businesses? I mean, I learned about this stuff at age 12 while learning PHP on my own, how hard can it be? Getting hacked happens, even to the best but come on, how many times will we have to read blog posts like this one before people wake up? How hard can it be to hash and salt your passwords? Glad I wasn't one of their customers (and never will be) but it's frustrating how we can't trust anyone with anything these days.

stef25 14y ago
And it's a company that teaches web development ...
- mnicole 14y ago
  Serious question; all of these tutorial sites.. are any of them a reliable source for web dev or are they just another Smashing Magazine where people get paid to write about things they don't understand?
  - stef25 14y ago
    Honestly I don't think their tutorials are half bad and I enjoy reading Smashing Magazine. Mainly for fluffy stuff. For security & scaling stuff go elsewhere.
    - mnicole 14y ago
      I guess half-bad is subjective. I don't feel like a site that allows such a vast array of decent information vs. downright terrible/wrong is worth my time trying to decipher between the two. I know what I read on A List Apart is quality material from quality writers and people who have spent years and years in the field. Tommy the 17 year old graphic designer that only has mom-and-pop Wordpresses under his belt shouldn't be getting paid to tell thousands of people what's hot right now.
  - ineedtosleep 14y ago
    IMO, Smashing is mostly typical blogspam with very occasional nuggets of good content. If you browse HN and some of the Reddit web/programming subreddits even somewhat frequently, both Smashing and tuts+ are pretty useless.
    - mnicole 14y ago
      Yeah, I'm still trying to find the good dev subreddits. You get downvoted in /r/webdesign over some really pathetic crap but it seems to be the most active - any suggestions?
UnoriginalGuy 14y ago
In principle I agree: it is bad practice. But let's remember that either plain text or one-way hashed they will be broken eventually. The only thing hashing passwords buys you is a little bit of time before the "hacker" can use those passwords to access the compromised system. It doesn't, for example, protect you from password re-usage issues. You also have to reset the passwords either way. I think getting broken into is the biggest problem here; everyone has recently spent far too much time talking about hashes instead of asking questions about how the real break-in occurred at these businesses.
- pwny 14y ago
  False. Getting broken through will happen because there are so many holes to plug, while strong and slow hashing + salting (while being extremely easy to set up) will make it so it's not even worth it for the attacker to crack passwords when he/she inevitably gets in. Of course we need to plug holes in security and prevent people from getting in (SQL injection vulnerabilities are just as important an offence) but might as well protect the user's information when a breach happens. Especially since it's so much easier than the other way around.
  - UnoriginalGuy 14y ago
    What is "false?" You deeply over-estimate how much effort it takes someone to break even correctly protected hashes. Most passwords are extremely poor and can be broken even without a rainbow table in less than a couple of hours. Hell I can spin up an EC2 instance right now for free (AWS Free) running Linux and then just leave it there for 12 months at zero cost; giving me a nice formatted list of e-mail addresses and passwords to be used on third party sites. At the end of the day most of these break-ins are news because the "hacker" got into a position to crack the user's passwords at all. What they do once they're in is not nearly as interesting from a learning perspective as how they got in originally. Why, for example, are user's passwords on web-facing servers at all? Why not use several commonly available login API infrastructures to off-load that task to a firewall-ed box that can only be managed via VPN? It isn't that crazy. It isn't that expensive either. A lot of software suites at minimum support a Kerberos protocol.
pawelwentpawel 14y ago
"Our current Tuts+ Premium app makes use of a third party plugin that unfortunately stores passwords in cleartext (i.e. unencrypted)." "(...) with a plan currently in progress to upgrade away from the current plugin." Oh, it's the plugin fault. Not theirs. Blame it on the plugin.

by pwny 14y ago

stef25 14y ago

And it's a company that teaches web development ...

mnicole 14y ago
Serious question; all of these tutorial sites.. are any of them a reliable source for web dev or are they just another Smashing Magazine where people get paid to write about things they don't understand?
- stef25 14y ago
  Honestly I don't think their tutorials are half bad and I enjoy reading Smashing Magazine. Mainly for fluffy stuff. For security & scaling stuff go elsewhere.
  - mnicole 14y ago
    I guess half-bad is subjective. I don't feel like a site that allows such a vast array of decent information vs. downright terrible/wrong is worth my time trying to decipher between the two. I know what I read on A List Apart is quality material from quality writers and people who have spent years and years in the field. Tommy the 17 year old graphic designer that only has mom-and-pop Wordpresses under his belt shouldn't be getting paid to tell thousands of people what's hot right now.
- ineedtosleep 14y ago
  IMO, Smashing is mostly typical blogspam with very occasional nuggets of good content. If you browse HN and some of the Reddit web/programming subreddits even somewhat frequently, both Smashing and tuts+ are pretty useless.
  - mnicole 14y ago
    Yeah, I'm still trying to find the good dev subreddits. You get downvoted in /r/webdesign over some really pathetic crap but it seems to be the most active - any suggestions?

UnoriginalGuy 14y ago

In principle I agree: it is bad practice. But let's remember that either plain text or one-way hashed they will be broken eventually. The only thing hashing passwords buys you is a little bit of time before the "hacker" can use those passwords to access the compromised system. It doesn't, for example, protect you from password re-usage issues. You also have to reset the passwords either way. I think getting broken into is the biggest problem here; everyone has recently spent far too much time talking about hashes instead of asking questions about how the real break-in occurred at these businesses.

pwny 14y ago
False. Getting broken through will happen because there are so many holes to plug, while strong and slow hashing + salting (while being extremely easy to set up) will make it so it's not even worth it for the attacker to crack passwords when he/she inevitably gets in. Of course we need to plug holes in security and prevent people from getting in (SQL injection vulnerabilities are just as important an offence) but might as well protect the user's information when a breach happens. Especially since it's so much easier than the other way around.
- UnoriginalGuy 14y ago
  What is "false?" You deeply over-estimate how much effort it takes someone to break even correctly protected hashes. Most passwords are extremely poor and can be broken even without a rainbow table in less than a couple of hours. Hell I can spin up an EC2 instance right now for free (AWS Free) running Linux and then just leave it there for 12 months at zero cost; giving me a nice formatted list of e-mail addresses and passwords to be used on third party sites. At the end of the day most of these break-ins are news because the "hacker" got into a position to crack the user's passwords at all. What they do once they're in is not nearly as interesting from a learning perspective as how they got in originally. Why, for example, are user's passwords on web-facing servers at all? Why not use several commonly available login API infrastructures to off-load that task to a firewall-ed box that can only be managed via VPN? It isn't that crazy. It isn't that expensive either. A lot of software suites at minimum support a Kerberos protocol.

pawelwentpawel 14y ago

"Our current Tuts+ Premium app makes use of a third party plugin that unfortunately stores passwords in cleartext (i.e. unencrypted)." "(...) with a plan currently in progress to upgrade away from the current plugin." Oh, it's the plugin fault. Not theirs. Blame it on the plugin.