6 ms·

I wonder how they can be sure that a website stores their website in plain text? Just because a website sends an email confirmation with the password doesn't me

I wonder how they can be sure that a website stores their website in plain text? Just because a website sends an email confirmation with the password doesn't mean they store it in plain text. The developer could just send the email before hashing the password. Not saying it's a good practice to send the password by email but it seems the website stretches the truth a bit.

conroy 14y ago
The majority of the items on the website are password reminder emails. This is after the initial sign up, which means the do indeed store it in plain text.
- runako 14y ago
  Either that, or they store it in encrypted format. Encryption typically implies that decryption is possible. Encrypted text is not plain text. These terms do have real meanings. You mean to say "the sites do not store the text in non-reversible format."
  - marshray 14y ago
    Encrypted text is equivalent to plain text to anyone who has the ability to decrypt it. What passwords need is a secure password hashing method. It's a very special purpose sort of thing, different from ordinary hashing, encrypting, and key derivation. It's unfortunate that it doesn't have a proper name. Neither "PBKDF2", B-"crypt", nor S-"crypt" are helping much with this terminology.
    - runako 14y ago
      >> "Encrypted text is equivalent to plain text to anyone who has the ability to decrypt it." This is a vastly different claim than "these websites store passwords as plaintext." There are a lot of differences in assumptions and attack vectors, etc. It usually pays for security alarms to be precise, and this site almost goes out of its way to be imprecise (and likely inaccurate). In this case, your verbiage would work great for the site in question. Why not say these are sites that don't use "secure password hashing methods" instead of making bogus unverifiable claims?
      - jasonlingx 14y ago
        It doesn't matter how you spin the verbiage. It's all just as bad.
        runako 14y ago
        Being accurate is not spinning. Accuracy matters, especially in matters of security. It's really not too much to ask for security alarmists to make precise claims.
        marshray 14y ago
        Would something like this satisfy you: The system provides functionality for (password reset via email|sending plaintext password reminder emails|other password-based credential recovery|other delegation or retention of password-based credentials) which strongly suggests that an attacker who succeeded in (cross site scripting (XSS)|cross site request forgery (XSRF)|obtaining production server access|obtaining production database access|obtaining back-up meda|observeing network traffic|actively injecting network traffic) would then be subsequently capable of (logging into this site with a targeted user's password-based credentials|mounting on-line attacks against (a specific user's|all users') password-based credentials|mounting (dictionary|non-dictionary) off-line brute-force attacks against (a specific user's|all users') password-based credentials)|passive decryption attacks|active man-in-the-middile attacks) (with little or no work factor). This (is|is not) recommended for (urgent) remediation. It (is likely|is not) sufficient to meet Payment Card Industry (PCI) standards or other adequate standards of care in the industry. Check all that apply. Also see http://cwe.mitre.org/data/definitions/719.html http://cwe.mitre.org/data/definitions/719.html , for example http://capec.mitre.org/data/definitions/55.html http://capec.mitre.org/data/definitions/55.html .
        jasonlingx 14y ago
        Websites sending passwords in email should be alarming. You are trying to spin it as not necessarily alarming, which is false.
      - marshray 14y ago
- laurent123456 14y ago
  Just to be sure, I had a look at the first 20 websites - 50% of them are password reminders, the rest are registration confirmation emails so it's not the majority of them. In any case, sending a password by email is always bad, no doubt about it, but my point is that they claim these websites store passwords as plain text when, half of the time, they don't actually know. Although this is a useful website, they lose a bit in credibility by being more sensationalist than they need to be.
runako 14y ago
You're entirely correct; an outsider cannot determine whether a password is stored in encrypted format or not. I agree that sending passwords by email is a bad idea, but I also believe that the folks behind this site should learn what it means to say "website storing a password in plain text" (from their about page). They're right, but for the wrong reasons.
- marshray 14y ago
  If at some later time you can click a button that says "I forgot my password", and they email you the plain text password, then we know that they have stored the plain text password.
  - runako 14y ago
    I'll play along. How do you know that they didn't store the password in an encrypted format using e.g. DSA? For argument's sake, let's say this happens: 1. You create your password ("ABCDEF"). 2. Their system stores it to the database encrypted ("a;kdjfa;oisdurpoqiwur,m c3249um zxc,vmvsdflkgjad[fiualmdr23,4mo;icuzvlcm œ rtoqieuroier"). 3. You click "I forgot my password". 4. Their system transforms the encrypted format to your original ("ABCDEF"). I think you mean to say "we know that they have not stored the password in a non-reversible format". This is pedantic, but specifics matter when talking about security.
    - michaelt 14y ago
      Seems to me your example is like a bank storing things in a secure locked vault, then leaving the key in the vault door at all times. It's technically accurate to say the valuables are stored in a locked vault - but the actual security level is no better than being stored in an unlocked vault. In other words, what is technically correct doesn't convey an accurate impression. If you're dealing with a bank that keeps their vault key in their vault door, or a member of the public choosing a bank, they might not have the nuanced understanding of security to understand the problem if you use too much technical jargon.
    - marshray 14y ago
_ikke_ 14y ago
Sending passwords in plain-text over email is bad enough in itself, and it also tells a lot about how they think about plain-text passwords in general.

conroy 14y ago

The majority of the items on the website are password reminder emails. This is after the initial sign up, which means the do indeed store it in plain text.

runako 14y ago
Either that, or they store it in encrypted format. Encryption typically implies that decryption is possible. Encrypted text is not plain text. These terms do have real meanings. You mean to say "the sites do not store the text in non-reversible format."
- marshray 14y ago
  Encrypted text is equivalent to plain text to anyone who has the ability to decrypt it. What passwords need is a secure password hashing method. It's a very special purpose sort of thing, different from ordinary hashing, encrypting, and key derivation. It's unfortunate that it doesn't have a proper name. Neither "PBKDF2", B-"crypt", nor S-"crypt" are helping much with this terminology.
  - runako 14y ago
    >> "Encrypted text is equivalent to plain text to anyone who has the ability to decrypt it." This is a vastly different claim than "these websites store passwords as plaintext." There are a lot of differences in assumptions and attack vectors, etc. It usually pays for security alarms to be precise, and this site almost goes out of its way to be imprecise (and likely inaccurate). In this case, your verbiage would work great for the site in question. Why not say these are sites that don't use "secure password hashing methods" instead of making bogus unverifiable claims?
    - jasonlingx 14y ago
      It doesn't matter how you spin the verbiage. It's all just as bad.
      - runako 14y ago
        Being accurate is not spinning. Accuracy matters, especially in matters of security. It's really not too much to ask for security alarmists to make precise claims.
        marshray 14y ago
        Would something like this satisfy you: The system provides functionality for (password reset via email|sending plaintext password reminder emails|other password-based credential recovery|other delegation or retention of password-based credentials) which strongly suggests that an attacker who succeeded in (cross site scripting (XSS)|cross site request forgery (XSRF)|obtaining production server access|obtaining production database access|obtaining back-up meda|observeing network traffic|actively injecting network traffic) would then be subsequently capable of (logging into this site with a targeted user's password-based credentials|mounting on-line attacks against (a specific user's|all users') password-based credentials|mounting (dictionary|non-dictionary) off-line brute-force attacks against (a specific user's|all users') password-based credentials)|passive decryption attacks|active man-in-the-middile attacks) (with little or no work factor). This (is|is not) recommended for (urgent) remediation. It (is likely|is not) sufficient to meet Payment Card Industry (PCI) standards or other adequate standards of care in the industry. Check all that apply. Also see http://cwe.mitre.org/data/definitions/719.html http://cwe.mitre.org/data/definitions/719.html , for example http://capec.mitre.org/data/definitions/55.html http://capec.mitre.org/data/definitions/55.html .
        jasonlingx 14y ago
        Websites sending passwords in email should be alarming. You are trying to spin it as not necessarily alarming, which is false.
    - marshray 14y ago
laurent123456 14y ago
Just to be sure, I had a look at the first 20 websites - 50% of them are password reminders, the rest are registration confirmation emails so it's not the majority of them. In any case, sending a password by email is always bad, no doubt about it, but my point is that they claim these websites store passwords as plain text when, half of the time, they don't actually know. Although this is a useful website, they lose a bit in credibility by being more sensationalist than they need to be.

runako 14y ago

You're entirely correct; an outsider cannot determine whether a password is stored in encrypted format or not. I agree that sending passwords by email is a bad idea, but I also believe that the folks behind this site should learn what it means to say "website storing a password in plain text" (from their about page). They're right, but for the wrong reasons.

marshray 14y ago
If at some later time you can click a button that says "I forgot my password", and they email you the plain text password, then we know that they have stored the plain text password.
- runako 14y ago
  I'll play along. How do you know that they didn't store the password in an encrypted format using e.g. DSA? For argument's sake, let's say this happens: 1. You create your password ("ABCDEF"). 2. Their system stores it to the database encrypted ("a;kdjfa;oisdurpoqiwur,m c3249um zxc,vmvsdflkgjad[fiualmdr23,4mo;icuzvlcm œ rtoqieuroier"). 3. You click "I forgot my password". 4. Their system transforms the encrypted format to your original ("ABCDEF"). I think you mean to say "we know that they have not stored the password in a non-reversible format". This is pedantic, but specifics matter when talking about security.
  - michaelt 14y ago
    Seems to me your example is like a bank storing things in a secure locked vault, then leaving the key in the vault door at all times. It's technically accurate to say the valuables are stored in a locked vault - but the actual security level is no better than being stored in an unlocked vault. In other words, what is technically correct doesn't convey an accurate impression. If you're dealing with a bank that keeps their vault key in their vault door, or a member of the public choosing a bank, they might not have the nuanced understanding of security to understand the problem if you use too much technical jargon.
  - marshray 14y ago

_ikke_ 14y ago

Sending passwords in plain-text over email is bad enough in itself, and it also tells a lot about how they think about plain-text passwords in general.