4 ms·

I wish someone would make a one-pager that says: "Hey CEO, your site doesn't hash passwords. Here's why it's bad. Here's how it got other companies in hot wate

I wish someone would make a one-pager that says: "Hey CEO, your site doesn't hash passwords. Here's why it's bad. Here's how it got other companies in hot water. Here's how simple it is to fix. Forward this to your tech guy. Oh, and until you do, we'll put your company on this wall of shame." Every time I receive a welcome email showing my password in plain-text, I'd gladly spend 5 minutes finding the email of an exec, or simply sending the link to support. Why? If the service is valuable to me, it's probably worth 5 minutes to protect my account and others'. Would pair up with someone here if you want to knock it out.

ayush_gupta 14y ago
I've done this a couple of times too and usually it does get fixed in a week!
cbsmith 14y ago
Someone shouldn't do that, because a) though the poster thinks they have proof that the site doesn't hash passwords, it increasingly seems like they do, and b) the CEO isn't the person to send this to anyway.
- telecuda 14y ago
  I disagree from personal experience. On (a) if you receive an email confirming your registration that displays your password, I guess it could be hashed later but probably wasn't, right? And (b), this happened with my city's utility bill service (has a lot of my personal info) and an email to the mayor's office got it addressed. My larger point is that telling a non-technical higher-up can go a long way for things where customer service may not see the bigger problem.
  - cbsmith 14y ago
    I agree that if you get the password in an e-mail plain text, there could be an issue... unless your e-mail client is rendering that section using a browser... which happens to have an encrypted version of the password stored locally. However, in Pandora's case, this isn't what is happening, and it appears they've taken pretty extensive security measures given their constraints. Telling a non-technical higher-up there is a problem, is also a good way to get a technical person in to trouble. If it is merited, no problem, but if you are wrong, you've just rewarded good work with a load of crap. It is much more appropriate to follow up with the appropriate party and at least give them a chance to respond before sounding the klaxon.
    - telecuda 14y ago
      Good points.
- deleted 14y ago
  [deleted]

ayush_gupta 14y ago

I've done this a couple of times too and usually it does get fixed in a week!

cbsmith 14y ago

Someone shouldn't do that, because a) though the poster thinks they have proof that the site doesn't hash passwords, it increasingly seems like they do, and b) the CEO isn't the person to send this to anyway.

telecuda 14y ago
I disagree from personal experience. On (a) if you receive an email confirming your registration that displays your password, I guess it could be hashed later but probably wasn't, right? And (b), this happened with my city's utility bill service (has a lot of my personal info) and an email to the mayor's office got it addressed. My larger point is that telling a non-technical higher-up can go a long way for things where customer service may not see the bigger problem.
- cbsmith 14y ago
  I agree that if you get the password in an e-mail plain text, there could be an issue... unless your e-mail client is rendering that section using a browser... which happens to have an encrypted version of the password stored locally. However, in Pandora's case, this isn't what is happening, and it appears they've taken pretty extensive security measures given their constraints. Telling a non-technical higher-up there is a problem, is also a good way to get a technical person in to trouble. If it is merited, no problem, but if you are wrong, you've just rewarded good work with a load of crap. It is much more appropriate to follow up with the appropriate party and at least give them a chance to respond before sounding the klaxon.
  - telecuda 14y ago
    Good points.
deleted 14y ago
[deleted]