7 ms·
I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our
by shanemhansen 14y ago
I understand that many organizations, even fairly large/respected organizations like the ieee work on a limited "IT" budget, but we've reached the point in our society where it's reasonable to expect these guys to do the bare minimum.
Just like everyone working in a restaurant needs to know the basics of food handling in order to avoid getting people sick, everyone who's operating a website with logins has a responsibility to:
a) Not send passwords over http
b) Not send passwords via GET (which is typically logged)
c) Hash their passwords
Anything less, and you're putting the public in danger.
- snprbob86 14y agoI think at this point, I think the software community at large is responsible for not solving this problem once and for all. It's clearly preferable to trust each OS/Browser vendor rather than trust each and every web site.
- fmavituna 14y agod) To not keep 100K users' passwords in a public FTP server :)
- kree10 14y agoI'd take that further. Is there any good reason for anyone to run an FTP server (public or otherwise) in 2012?
- jimhefferon 14y agoHow do you dir on http?
- astrodust 14y agoIf this is your problem, FTP is not your answer.
- geofft 14y agoWhich makes me wonder why approximately everyone has a parser for the common FTP directory listing formats, but I'm not sure I've seen any HTTP client that parses Apache mod_autoindex output or the other big servers' equivalents.
- pserwylo 14y agoWebDAV [0] If Microsoft every had of built a decent client into Windows Explorer like MacOSX has (rather than the crufty, half baked one they ran with) then it could have been great. As it turns out, it is only really easy to access it through FTP-like programs (separate from Windows Explorer). Having said that, we had pretty good experiences with WebDrive [1] allowing us to mount WebDAV directories in Windows. Also, Gnome does a pretty good job on Linux with GVFS [2]. [0] https://en.wikipedia.org/wiki/Webdav https://en.wikipedia.org/wiki/Webdav [1] http://www.webdrive.com/products/webdrive/index.html http://www.webdrive.com/products/webdrive/index.html [2] https://en.wikipedia.org/wiki/GVFS https://en.wikipedia.org/wiki/GVFS
- runn1ng 14y agoIf you want to have a shared folder that you share between people you trust, it's still the simplest solution. It's very low-level, but it works. Yes, you can buy a cloud offering, but physical disk is still way cheaper than "cloud disk". You don't have all the cloud features, but on the other hand, the data are 100% yours, on a server that you control.
- EvanAnderson 14y agoI don't buy that it's "the simplest". Just about every major Linux distro ships w/ SFTP enabled out-of-the-box. How is installing an FTP server easier than just using the built-in SFTP server? I've been trying to actively discourage the use of FTP for the last 10+ years. It's not an option because it passes passwords in-the-clear. Protocols that pass cleartext authentication should just be off the table today.
- jlgreco 14y agoI find that positive attitudes towards FTP often seem to correlate with positive feelings towards Telnet, and both seem to correlate with "Not really that comfortable with Nix"*. The number of times I have had to correct tech-ish friends when they talk about "telnet-ing" into servers is frightening. All of them were relatively technology literate but either didn't do it for a living or got into doing it for a living "by accident". Think your physics major buddy who has only ever used windows on any computer that he owns. You put people like that in the position to make a call, and I assure you you'll have an FTP server running somewhere in 5 minutes flat.
- geofft 14y agoI believe that random Windows authoring software is vaguely more likely to have FTP built in than SFTP. (But finding good SFTP software for Windows, e.g. WinSCP, is not hard, so this is not much of an argument.) It's also the case that SFTP requires giving someone an actual user account on your UNIX box, and preferably knowing enough about how to set SSH up to restrict them to SFTP access only. If your server is much more valuable than the data and you don't trust yourself not to get SSH configuration subtly wrong, it's not terribly unreasonable to prefer installing an FTP server to adding a local user and giving someone else a password to it.
- stusmall 14y agoI usually have an internal TFTP server set up and laying around somewhere. A lot of embedded devices provide simple support for updating their firmware over TFTP.
- JoeAltmaier 14y agoEngineers and scientists have large datasets to share. Gigabytes. Terabytes. FTP can handle it.
- 0003 14y agoI am not too well-versed in this sphere, but I would also require salting passwords when hashing. It obviously won't help if your database is compromised, but will protect your users (and your database) against the effects of leaks such as these.
- ZoFreX 14y ago> It obviously won't help if your database is compromised Good news, everyone: it will!
- batista 14y agoNo, it won't. They can just write a new password + salt in the db and get in as that user.
- shakesbeard 14y agoBut maybe that's not want you want to achieve?
- ZoFreX 14y agoWell, we need to define the attack if we're going to talk about what will and won't help. Generally when we talk password security, we assume the attack is to discover a large number of users' passwords, not to spoof as one. Additionally, it's more common to get read-only access to the data than it is to be able to execute arbitrary queries against the DB.
- ghshephard 14y agoOne of these days we will shut down the "Salting password hashes is a useful thing to do." meme from 1994. See: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ for details.
- e2e8 14y agoOf course a salt will not make a single password harder to attack. A salt will however force you to attack passwords "one at a time" by making precomputed hashes useless.
- ZoFreX 14y agoCan we amend c) to mandate bcrypt, scrypt, or PBKDF2 with a sufficient work factor that is reviewed every 12 months?
- mercuryrising 14y agoCan you send MD5 encrypted passwords over HTTP? Can you send passwords over websockets?
- estel 14y agoIt's perfectly possible to use md5 to hash a password in Javascript before transmitting it by HTTP. There isn't a huge security benefit to doing so, however.
- omra 14y agoOnly doing that won't help. You might as well be transmitting the password, since someone can just copy the hash and then it would be equivalent to having the password. (Also known as a Pass the Hash attack, http://en.wikipedia.org/wiki/Pass_the_hash http://en.wikipedia.org/wiki/Pass_the_hash).
- wisty 14y agoEach website could have a salt. The issue is, if it's not a secure connection, it's vulnerable to hijacks.
- Tloewald 14y agoYou can send a salted md5 password, which is how I implemented it years ago. The salt is supplied by the server and attached to the session.
- geofft 14y agoThe right way to do that is Digest authentication, which is a challenge-response mechanism (so you never actually send a password or something equivalently stealable). I call it the right way mostly because it's built in to just about all servers and clients; doing it over HTTP is still not a terribly good idea.
- runn1ng 14y agoOK, please educate me. (Take me as a model web developer.) I occasionally quickly hack some stuff together in php/javascript/html. I never figured out what should I do exactly to actually set up Apache to work with https, without needing to pay some money to some authorities. I just have a simple LAMP server and I don't really understand Apache. How do I make it "https"?
- superprime 14y agoYou can use mod_ssl: http://onlamp.com/onlamp/2008/03/04/step-by-step-configuring-ssl-under-apache.html http://onlamp.com/onlamp/2008/03/04/step-by-step-configuring... . Other good resources are an easy search away. There are basically two steps, both of which can be at no additional cost: 1. get a certificate, and 2. configure your server to use the certificate. You can generate a certificate yourself, without paying anyone, and it will work fine, but some browsers will throw up a warning page if it is not signed by an authority (more: http://www.namecheap.com/support/knowledgebase/article.aspx/334 http://www.namecheap.com/support/knowledgebase/article.aspx/...).
- julian37 14y agotptacek explained to me once how using a self-signed certificate (or more to the point, trusting it) is a bad idea: http://news.ycombinator.com/item?id=2376644 http://news.ycombinator.com/item?id=2376644 You can get free certificates backed by a CA trusted by most browsers, for example at https://www.startssl.com https://www.startssl.com. There are some limitations (e.g. no wildcard certificates) but it's still much better than a self-signed one.
- mgummelt 14y agoThough using self-signed certs during development is a perfect way to test https without shelling out for a CA signature.
- shanemhansen 14y agoUnfortunately you do have to pay some money. Godaddy offers certs for 12.00 USD a year, which is probably less than you're paying to host the site. As for making it https, (hypothetical web developer) most cheap hosting providers actually provide tools for managing certs and apache configs in cpanel. It's not too difficult to do yourself. Basically install mod_ssl and copy paste a standard config, substituting the pathnames for the paths of the certs you got from a CA. I understand that your average beginning-throw-up-a-website-for-a-business would find this difficult, but they can hire someone for an hour to install their certificates.
- JoeAltmaier 14y agoI wonder why the website package even wrote a log that included plaintext passwords. That's not IEEE's fault, except perhaps a lapse in judgement to use whatever opensource package.