3 ms·

Oh noes! you mean my hacker mom will be able to log onto my pandora account and listen to my Yes/Supertramp mix station!!?? Ok, admittedly, bad form on pandora

Oh noes! you mean my hacker mom will be able to log onto my pandora account and listen to my Yes/Supertramp mix station!!?? Ok, admittedly, bad form on pandora's part but seems pretty low impact to me.

matthuggins 14y ago
I strongly disagree. People use the same password on multiple sites all the time. If someone shares a password between Pandora and Gmail or PayPal, for example, you now have access to their email or their money.
- measlyweasel 14y ago
  you've got a really good point there and on second thought I totally agree with you. I guess I was looking at it from a more "my app"-centric point of view. I suppose these days, in light of the point you make, if you accept a password from an end-user there is no such thing as a low impact disclosure.
- deleted 14y ago
  [deleted]
- deleted 14y ago
  [deleted]
- cbsmith 14y ago
  Honestly, if you share your PayPal password with other sites, you are already asking for it pretty badly. I'd say the same thing about your Google password, but if you use two-factor authentication is isn't quite so bad (and in that case Pandora isn't a concern). The reality is though, what Pandora is doing prevents the password from going over the 'net at all, which arguably protects it from being stolen better. For someone to get access to it, they'd need access to your machine, at which point... just how secure do you think your PayPal and Google accounts (assuming no two-factor auth) will be? The main increased risk factor if you shared your PayPal and Pandora passwords would be that if someone had read-only access to your filesystem, they could still get your PayPal password (which wouldn't otherwise be the case). This would be a potentially big exposure if you have unencrypted backups (though why backup HTML5 storage or browser data in plaintext to an untrusted target if you want security?) or for whatever reason you let other people read your browser profile directory. Still doesn't feel like a big deal.

matthuggins 14y ago

I strongly disagree. People use the same password on multiple sites all the time. If someone shares a password between Pandora and Gmail or PayPal, for example, you now have access to their email or their money.

measlyweasel 14y ago
you've got a really good point there and on second thought I totally agree with you. I guess I was looking at it from a more "my app"-centric point of view. I suppose these days, in light of the point you make, if you accept a password from an end-user there is no such thing as a low impact disclosure.
deleted 14y ago
[deleted]
deleted 14y ago
[deleted]
cbsmith 14y ago
Honestly, if you share your PayPal password with other sites, you are already asking for it pretty badly. I'd say the same thing about your Google password, but if you use two-factor authentication is isn't quite so bad (and in that case Pandora isn't a concern). The reality is though, what Pandora is doing prevents the password from going over the 'net at all, which arguably protects it from being stolen better. For someone to get access to it, they'd need access to your machine, at which point... just how secure do you think your PayPal and Google accounts (assuming no two-factor auth) will be? The main increased risk factor if you shared your PayPal and Pandora passwords would be that if someone had read-only access to your filesystem, they could still get your PayPal password (which wouldn't otherwise be the case). This would be a potentially big exposure if you have unencrypted backups (though why backup HTML5 storage or browser data in plaintext to an untrusted target if you want security?) or for whatever reason you let other people read your browser profile directory. Still doesn't feel like a big deal.