8 ms·
Pandora doesn't hash their passwords
- biomechanica 14y agoWhat.The.Hell? You would figure companies out there would have learned a lesson or two by now. Wow.
- deleted 14y ago[deleted]
- nthitz 14y agoEek, nothing more frightening than seeing my own password there in the plaintext of the HTML...
- cbsmith 14y agoIt's not in the plaintext of the HTML. It's in the DOM. You know, the think that you can hook in to capture your password when you type it in...
- deleted 14y ago[deleted]
- bcuccioli 14y agoI just checked, my password was visible in the source. Pretty shitty, Pandora.
- yahelc 14y agoMine too.
- bduerst 14y agoEDIT: Found it. It was in the settings page. What is the source code surrounding the password? Is it the same as the screenshot? I'm trying to find mine but can't. Also, what browsers are you guys using? Mine is Chrome.
- aiiane 14y agoJust right-click the password field and choose 'Inspect Element' in the menu.
- lhnn 14y agoMine says value="${password}"/> in the source.
- deleted 14y ago[deleted]
- citizens 14y agoTry going to the settings screen and then right-click in the password field and click inspect element (assuming Chrome). I thought mine just said value="${password}" too, but nope, its there in all its unencrypted glory.
- deleted 14y ago[deleted]
- aiiane 14y agoAre you looking at view-source: or are you looking at the actual DOM after it has been modified by JavaScript? The password field is created by JavaScript based on a template from the HTML source, and the password is filled in via a script; it's not sent in the base page.
- jsherry 14y agoAhhh - there it is - you're right! Pretty lousy.
- gabebw 14y agoTry inspecting the element (in Chrome inspector or Firebug or whatever). My password is visible there. When doing a simple view-source, I just see "${password}" though.
- Judson 14y agoMy password isn't viewable in the source (cmd + opt + u), but when I inspect the password field with the Web Inspector, my password is visible in plain text as the value of the password field.
- bcuccioli 14y agoI don't get why people don't do this. It's not that hard. The modification would be about 2 lines of code. If you're unhappy about storing 128 bits for everyone's password you could even just take an 8 character substring of the hash or something. It would be a lot better than nothing.
- meritt 14y agoConfirmed. No asterisks. <input type="password" value="hunter2">
- olalonde 14y agohttp://bash.org/?244321 http://bash.org/?244321 ... classic :)
- swang 14y agoIs there a need for the password to even be printed there? Usually the flow for changing the password is inputting the current password, then typing the new password twice.
- benburleson 14y agoExactly. That brings up another bonehead move by Pandora - if you've made it here on someone else's account (presumably they left it logged in), you can change their password without knowing their password (ignoring the fact that you can already get their password from the DOM). But I guess that's a minor issue compared to exposing your password. Either way, the whole programming dept. at Pandora needs a lesson in passwords.
- adgar 14y agoNope! They're just bad at their jobs.
- fruchtose 14y agoMy jaw dropped. How does such a publicly visible website think it is okay to show users their password without them asking? It should now be assumed that every hacker on the planet knows about this vulnerability, and Pandora will see attacks against their database very soon. What we don't know is if Pandora is storing users' passwords in plaintext. It is possible that Pandora remembers your password server-side for your session. I hope that this is the case. If it turns out to be anything else--plaintext passwords in database, etc.--then Pandora is worse than LinkedIn.
- qq66 14y agoWhat kind of profitable attacks could one perform with a large collection of Pandora passwords? The best I can think of is for a small band to have millions of people "like" them.
- timo614 14y agoMany users reuse passwords across their web presence. So there's the chance of gaining access to other accounts as a result of the data leak... such as their bank accounts, etc.
- bduerst 14y agoPeople typically use variants of the same password across the web. It's a huge starting place for breaking into an email account. Also, since it's vanilla http, you could sniff these passwords at a coffee shop's wifi all day and just wait for someone to log in to Pandora.
- JohnsonB 14y agoSimple, for every user that the hackers have, try their password for the associated email account, guaranteed they will gain access to many email accounts. Now they have access to their banking accounts.
- ryanwaggoner 14y agoThis could happen, but do we have any evidence that it has? I'm being serious...I constantly hear about widespread leaks of passwords, but the most I hear about it is people having their email hacked by a botnet to...send spam. Have their been any large scale attacks to gain access to bank accounts to then clean them out somehow? On top of that, how does getting access to someone's bank account even help you? You have to transfer the money to another account, which leaves a trail...
- telecuda 14y agoI wish someone would make a one-pager that says: "Hey CEO, your site doesn't hash passwords. Here's why it's bad. Here's how it got other companies in hot water. Here's how simple it is to fix. Forward this to your tech guy. Oh, and until you do, we'll put your company on this wall of shame." Every time I receive a welcome email showing my password in plain-text, I'd gladly spend 5 minutes finding the email of an exec, or simply sending the link to support. Why? If the service is valuable to me, it's probably worth 5 minutes to protect my account and others'. Would pair up with someone here if you want to knock it out.
- ayush_gupta 14y agoI've done this a couple of times too and usually it does get fixed in a week!
- cbsmith 14y agoSomeone shouldn't do that, because a) though the poster thinks they have proof that the site doesn't hash passwords, it increasingly seems like they do, and b) the CEO isn't the person to send this to anyway.
- telecuda 14y agoI disagree from personal experience. On (a) if you receive an email confirming your registration that displays your password, I guess it could be hashed later but probably wasn't, right? And (b), this happened with my city's utility bill service (has a lot of my personal info) and an email to the mayor's office got it addressed. My larger point is that telling a non-technical higher-up can go a long way for things where customer service may not see the bigger problem.
- cbsmith 14y agoI agree that if you get the password in an e-mail plain text, there could be an issue... unless your e-mail client is rendering that section using a browser... which happens to have an encrypted version of the password stored locally. However, in Pandora's case, this isn't what is happening, and it appears they've taken pretty extensive security measures given their constraints. Telling a non-technical higher-up there is a problem, is also a good way to get a technical person in to trouble. If it is merited, no problem, but if you are wrong, you've just rewarded good work with a load of crap. It is much more appropriate to follow up with the appropriate party and at least give them a chance to respond before sounding the klaxon.
- peterwwillis 14y agoIf your Pandora password is extremely sensitive perhaps you should re-evaluate how anal you are about privacy. As long as your CC details are secure, who cares?
- pearkes 14y agoIt's the job of the web developer to do everything within their control to protect a user. There is no excuse for not hashing/salting passwords.
- peterwwillis 14y agoIt's a radio station. I would never expect a web developer to do 'everything within their control' to secure it. Not even banks do that. Honestly, what are you worried about? So they have your plaintext password. You didn't reuse it for any other service, right? So what use is it to anybody other than logging into your Pandora account and fucking with your stations? (And why the hell would anyone do that?) People need to be more realistic about security.
- bduerst 14y agoWhich would be a reasonable argument except that hashing passwords is effortless in terms of development. The cost/benefit of implementing this functionality makes it a rule of thumb for front facing web pages.
- peterwwillis 14y agoOf course it's easy. You won't necessarily do it right, but you can sure get a crappy version working quickly. Assuming every web developer implemented a crappy password hash and then checked off the 'security' box on their compliance form. Are users more secure? No, because they didn't consider exactly how secure it needed to be. Are you using a sha1 hash? Great. Is it salted? Oh shit, forgot that, let's salt it. Ok, now I just cracked it. Oh shit, let's use pbkdf2. Uh oh, it's cpu expensive and not very strong, let's use bcrypt. Shit, it's easy to crack with a big FPGA array, let's use scrypt. Shit, now it can be used for replay attacks, let's add a MAC. Password hashing is easy, right? Europeans have chip-and-pin credit/debit cards. Are they more secure than Americans without chips in the cards? Yes. They probably feel they're more secure. Yet it's been known for a decade that you can intercept the communication, and millions of dollars/euros have been lost because customers and companies believed in the blind faith of their perceived security. "oh, i have an anti-virus, i'm secure now." "oh, i have a vpn, i'm secure now." "oh, i have tls, i'm secure now." "oh, i have a password hash, i'm secure now." I'm not saying you should not apply strong password hashes. I'm saying there is a time and a place to be outraged about a lack of security practices. If you knew how incredibly, horribly, terribly insecure the world around you is, the world that matters, you wouldn't care about your Pandora password either.
- seanconaty 14y agoThis is very bad from a security standpoint but you'd be surprised how many websites do this. Here is a list http://plaintextoffenders.com/ http://plaintextoffenders.com/ I would have expected Pandora to know better. Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. The websites that do it right cannot tell you your password (because they don't know it); they can only let you reset it.
- dangrossman 14y ago> Anytime a website shows you your password or emails it to you, it's a bad sign. It means it is stored in plain text. No it doesn't. They could be using the strongest encryption known to man and still show you your password or e-mail it to you by simply decrypting it when needed.
- pizza 14y agoAnd then someone looks at your screen and takes your account.
- jevinskie 14y agoWhich is almost as bad. A service provider does not need to know your password, just a salted hash of it.
- hahainternet 14y agoIt's true that he worded it badly, but symmetrically encrypted passwords are no safer than plaintext in practical use.
- mikeash 14y agoEncrypted passwords are functionally equivalent to "stored in plain text".
- pbreit 14y agoIntuitively that makes no sense so I'm wondering if someone could explain?
- nilved 14y agoWhy are people still relying on developers to implement proper password security instead of using unique passwords?
- ciupicri 14y agoI fail to see the tragedy, too. Every service should have an unique password. Also even if the password are hashed, if hackers get control of the web server, they could sniff the passwords when users log in.
- dredmorbius 14y agoWhy are we still relying on passwords rather than a secure PKI key-based access method in which unique keys are generated for each remote system accessed?
- ciupicri 14y agoThere's the possibility of authenticating with a SSL certificate. Fedora uses this method for a web service. There is also OpenID, but not many sites are using it unfortunately.
- tbeseda 14y agoIt also seems the password is being passed in the clear...
- jmediast 14y agoThoughts? https://news.ycombinator.com/item?id=3798597 https://news.ycombinator.com/item?id=3798597
- ecaron 14y agoProof that 99% of generating good conversation on HN comes from a well-phrased title.
- daeken 14y agoNo, most of it is timing and simple luck. If you hit the right time of the day (when there are a lot of users present but not a ton of news) and get the first few votes in a good time (which is mostly luck), you'll make the front page.
- cbsmith 14y agoActually, proof that a provocative but false headline on HN will still get the sheep to vote up your article. ;-)
- aiiane 14y agoFor the record, the title was actually edited from what I submitted it as.
- RokStdy 14y agoTo me the funniest thing is that they rely on the 'password' input type to obfuscate the password. If you change it to 'text' its just a plain text password sitting there. So... somebody thought, "well we're going to have the password here, better make this input 'password' so people can't just see it over your shoulder, it's private!"
- macchina 14y agoThis is very shocking. It's just ASTOUNDING to me that in the year 2012 — one of the largest and most well-known companies on the internet (listed on NYSE, Alexa Rank 306, $100 Billion+ in revenue) could allow such a stupid vulnerability to persist.
- bluedanieru 14y agoNeither does Hover, still, despite being outed here nearly 18 months ago and assurances by a Hover rep that they were working on tightening security and would have it completed by September (2011). Some companies just do not give a shit about (your) security,
- bluedanieru 14y agoOkay, I have to take this back. It looks like they did finally implement this sometime between now and June (when I last checked). Better late than never.
- cbsmith 14y agoThere may be a security issue here, but I think there is a distinct possibility that it certainly isn't what people think. Pandora needn't store the password on their servers. Just posted this to the Google+ thread: Okay, I just did a simple test of what happens when I change my Pandora password. There is a record of HTML local storage keyed on "jStorage" which appears to be a giant JSON blob. A specific attribute whose name appears to be a randomly generated (encrypted) is updated. Assuming that is password, stored encrypted, the exposure here may not be what people think. It certainly would mean the password need not be stored at all on Pandora's server. They could just have an HMAC. The password value could be simple extracted from local storage. Has anyone checked to see if this is the case? Follow up: Okay, I further confirmed that if I set the password back to a prior value, that field in jStorage flips back to the prior value. So, it looks like it is stored encrypted, locally on the system. I haven't traced through all the JavaScript, but it seems likely that the security issue here is different than perceived, and might even be non-existant.
- aiiane 14y agoEven if that's the case, though, that actually only mitigates the least problematic issue here (namely, how the passwords are stored on Pandora's end). At least the stored passwords there are behind other forms of security - so regardless of whether they're stored in plaintext or hashed on Pandora's servers, it'd still take an actual breach of Pandora's servers to retrieve them. The real, major issue here is the fact that passwords are loaded into an HTTP-served page and displayed back to the user. It doesn't matter how it happens behind the scenes - the fact that someone can do either of the following is still majorly problematic: 1. Walk up to a computer you're logged into and read your plaintext password. 2. Inject scripts into the main (non-HTTPS) Pandora page and read it out of the DOM. If they did go to the trouble of saving the password into local storage with encryption, one has to wonder what they were thinking, given that it's a lot of effort for a solution that's far less secure than the trivial effort of just storing hashed passwords.
- peterwwillis 14y agoThe fact that someone could physically break into your machine to steal your Pandora password is extremely problematic? I'd hate to see your write-up once somebody knocks over the carton of milk... If they used an HMAC and the secret is stored locally, aside some some sort of JavaScript/browser exploit, it's more secure than a non-MAC cryptographically hashed password, and much more secure than the plaintext password you submit in your browser to log into almost every website in the entire world. This Pandora password is just visible to you on your computer. If you're worried about that, please don't have a heart attack, but they have these things called malware now ...
- ayush_gupta 14y agoThis is terrible. No site has any business "knowing" my password. To me, not hashing is a violation of my trust right there. I'm a paid Pandora user and have been their evangelist for many years and supporter through all their tough times. Just seeing my password in plain text in the DOM Inspector makes me embarrassed. This should have never happened. They should fix this. Soon.
- justinph 14y agoCan't help but notice that its a google+ user, that happens to work at google. Must be some strong kool-aid over there in Mountain View.
- just2n 14y agoI see __USE_EXISTING__. I promise that's not my password, either. It seems that the server interprets this as an implication that it should keep your existing password. So I would expect if it's ever using a different value on the client, it's an accident, because this feature implies there's no reason for the client to ever save the password (not that there's a valid reason to do that anyway). That is, unless I'm actually seeing this after they've patched the issue?
- dougbarrett 14y agoI'm pretty sure they patched it, that's what I'm seeing too. I have a feeling that they just put a bandaid on an issue that is going to get cracked open eventually.
- aiiane 14y agoYes, they patched it within the past few hours.
- jmediast 14y agoIt seems like they "fixed" people being able to read the passwords by replacing the the form value with __USE_EXISTING__... It's still trivial to automate account takeover though. Here's a PoC to take over pandora accounts on your network using MITMProxy and Tornado: https://github.com/JackWink/Pandora-Account-Takeover-Tool https://github.com/JackWink/Pandora-Account-Takeover-Tool
- junto 14y agoI had a Pandora account long before they bowed to the music cartel and restricted access to anyone outside the US. I am now in an odd situation where I cannot login to change my password, or delete my account (not that I trust any delete account functions these days anyway). Is there anyone here working for Pandora that could help me?
- kami8845 14y agolog in through a proxy
- junto 14y agoFound a workaround. You can still get to the login page: http://pandora.com/login http://pandora.com/login From there you can say you have forgot your password: http://www.pandora.com/forgot.vm?target= http://www.pandora.com/forgot.vm?target= Completing this form sends a forgotten password email to your registered email address. That link provided allows to you reset your password.