6 ms·

The majority of the items on the website are password reminder emails. This is after the initial sign up, which means the do indeed store it in plain text.

by conroy 14y ago

runako 14y ago
Either that, or they store it in encrypted format. Encryption typically implies that decryption is possible. Encrypted text is not plain text. These terms do have real meanings. You mean to say "the sites do not store the text in non-reversible format."
- marshray 14y ago
  Encrypted text is equivalent to plain text to anyone who has the ability to decrypt it. What passwords need is a secure password hashing method. It's a very special purpose sort of thing, different from ordinary hashing, encrypting, and key derivation. It's unfortunate that it doesn't have a proper name. Neither "PBKDF2", B-"crypt", nor S-"crypt" are helping much with this terminology.
  - runako 14y ago
    >> "Encrypted text is equivalent to plain text to anyone who has the ability to decrypt it." This is a vastly different claim than "these websites store passwords as plaintext." There are a lot of differences in assumptions and attack vectors, etc. It usually pays for security alarms to be precise, and this site almost goes out of its way to be imprecise (and likely inaccurate). In this case, your verbiage would work great for the site in question. Why not say these are sites that don't use "secure password hashing methods" instead of making bogus unverifiable claims?
    - jasonlingx 14y ago
      It doesn't matter how you spin the verbiage. It's all just as bad.
      - runako 14y ago
        Being accurate is not spinning. Accuracy matters, especially in matters of security. It's really not too much to ask for security alarmists to make precise claims.
        marshray 14y ago
        Would something like this satisfy you: The system provides functionality for (password reset via email|sending plaintext password reminder emails|other password-based credential recovery|other delegation or retention of password-based credentials) which strongly suggests that an attacker who succeeded in (cross site scripting (XSS)|cross site request forgery (XSRF)|obtaining production server access|obtaining production database access|obtaining back-up meda|observeing network traffic|actively injecting network traffic) would then be subsequently capable of (logging into this site with a targeted user's password-based credentials|mounting on-line attacks against (a specific user's|all users') password-based credentials|mounting (dictionary|non-dictionary) off-line brute-force attacks against (a specific user's|all users') password-based credentials)|passive decryption attacks|active man-in-the-middile attacks) (with little or no work factor). This (is|is not) recommended for (urgent) remediation. It (is likely|is not) sufficient to meet Payment Card Industry (PCI) standards or other adequate standards of care in the industry. Check all that apply. Also see http://cwe.mitre.org/data/definitions/719.html http://cwe.mitre.org/data/definitions/719.html , for example http://capec.mitre.org/data/definitions/55.html http://capec.mitre.org/data/definitions/55.html .
        jasonlingx 14y ago
        Websites sending passwords in email should be alarming. You are trying to spin it as not necessarily alarming, which is false.
    - marshray 14y ago
      ciphertext + key = plaintext I will agree with you, however, that this site is being a bit sloppy with its claims and I am going along with it because it suits my purposes (i.e., errs on the side of being conservative). But this is how security needs to work. Those claiming a system is secure should usually end up with a healthy burden of proof, whereas those claiming it's probably not should be listened to carefully.
      - laurent123456 14y ago
        By being vague about their claims, they are also being unclear on what should be done to fix the issue. Maybe in some cases, the offending websites even feel they don't need to do anything. I can already imagine some reactions: - "I'm not storing the password in plain text, I'm hashing it after sending the email confirmation" - "I'm not storing it in plain text, I'm encrypting it." And of course, they would entirely miss the point that the real issue is that they are sending the password by email.
        marshray 14y ago
        In other contexts of society it's perfectly reasonable (if not expected) to point out "offenders" (those who are increasing risk of harm to the public) without being obligated to at the same time to educate and reform the offender.
    - DanBC 14y ago
      I gently agree. To be fair to the site, they do mention (admittedly on the bottom of the about page) > More reading on why even _just sending the password_ via email without storing it in plain text is bad. Which has a hyperlink to (http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in http://plaintextoffenders.com/post/7006690494/whats-so-wrong...) > What's so wrong about sending a new password in plaintext? It doesn't mean that the password is saved in plaintext...
      - mathijs 14y ago
        Ironically enough, I went to log in to HN specifically to upvote comments in this thread, forgot my password and had to use the 'email yourself a new password' function. Granted, it sends a randomly generated password. And granted: it's probably meant for one-time use only (I presume). However, logging in with the new password does not automatically prompt (or even force) to change it to something of my own choosing. Result: hit 'remember password' in Chrome and forget about it. Now my active HN password is in my inbox, in plain text.
    - rictic 14y ago
      This is an objection without much substance. The main thing that you're worried about with a plain text password is that it will be obtained by a third party. These are sites which are sending emails with passwords in the clear. They are also storing your password near the decryption key (if any), so a single security breach can compromise many passwords. That is to say: even if the rest of their infrastructure is NSA-level paranoid, whichever server(s) are sending out these password reminder emails are prime targets. Please do not defend this behavior.
      - runako 14y ago
        Please read my comments: I'm not defending the sending of plaintext passwords. But please do not defend sloppy claims of security vulnerabilities.
laurent123456 14y ago
Just to be sure, I had a look at the first 20 websites - 50% of them are password reminders, the rest are registration confirmation emails so it's not the majority of them. In any case, sending a password by email is always bad, no doubt about it, but my point is that they claim these websites store passwords as plain text when, half of the time, they don't actually know. Although this is a useful website, they lose a bit in credibility by being more sensationalist than they need to be.

The majority of the items on the website are password reminder emails. This is after the initial sign up, which means the do indeed store it in plain text.

by conroy 14y ago

The majority of the items on the website are password reminder emails. This is after the initial sign up, which means the do indeed store it in plain text.

runako 14y ago

Either that, or they store it in encrypted format. Encryption typically implies that decryption is possible. Encrypted text is not plain text. These terms do have real meanings. You mean to say "the sites do not store the text in non-reversible format."

marshray 14y ago
Encrypted text is equivalent to plain text to anyone who has the ability to decrypt it. What passwords need is a secure password hashing method. It's a very special purpose sort of thing, different from ordinary hashing, encrypting, and key derivation. It's unfortunate that it doesn't have a proper name. Neither "PBKDF2", B-"crypt", nor S-"crypt" are helping much with this terminology.
- runako 14y ago
  >> "Encrypted text is equivalent to plain text to anyone who has the ability to decrypt it." This is a vastly different claim than "these websites store passwords as plaintext." There are a lot of differences in assumptions and attack vectors, etc. It usually pays for security alarms to be precise, and this site almost goes out of its way to be imprecise (and likely inaccurate). In this case, your verbiage would work great for the site in question. Why not say these are sites that don't use "secure password hashing methods" instead of making bogus unverifiable claims?
  - jasonlingx 14y ago
    It doesn't matter how you spin the verbiage. It's all just as bad.
    - runako 14y ago
      Being accurate is not spinning. Accuracy matters, especially in matters of security. It's really not too much to ask for security alarmists to make precise claims.
      - marshray 14y ago
        Would something like this satisfy you: The system provides functionality for (password reset via email|sending plaintext password reminder emails|other password-based credential recovery|other delegation or retention of password-based credentials) which strongly suggests that an attacker who succeeded in (cross site scripting (XSS)|cross site request forgery (XSRF)|obtaining production server access|obtaining production database access|obtaining back-up meda|observeing network traffic|actively injecting network traffic) would then be subsequently capable of (logging into this site with a targeted user's password-based credentials|mounting on-line attacks against (a specific user's|all users') password-based credentials|mounting (dictionary|non-dictionary) off-line brute-force attacks against (a specific user's|all users') password-based credentials)|passive decryption attacks|active man-in-the-middile attacks) (with little or no work factor). This (is|is not) recommended for (urgent) remediation. It (is likely|is not) sufficient to meet Payment Card Industry (PCI) standards or other adequate standards of care in the industry. Check all that apply. Also see http://cwe.mitre.org/data/definitions/719.html http://cwe.mitre.org/data/definitions/719.html , for example http://capec.mitre.org/data/definitions/55.html http://capec.mitre.org/data/definitions/55.html .
      - jasonlingx 14y ago
        Websites sending passwords in email should be alarming. You are trying to spin it as not necessarily alarming, which is false.
  - marshray 14y ago
    ciphertext + key = plaintext I will agree with you, however, that this site is being a bit sloppy with its claims and I am going along with it because it suits my purposes (i.e., errs on the side of being conservative). But this is how security needs to work. Those claiming a system is secure should usually end up with a healthy burden of proof, whereas those claiming it's probably not should be listened to carefully.
    - laurent123456 14y ago
      By being vague about their claims, they are also being unclear on what should be done to fix the issue. Maybe in some cases, the offending websites even feel they don't need to do anything. I can already imagine some reactions: - "I'm not storing the password in plain text, I'm hashing it after sending the email confirmation" - "I'm not storing it in plain text, I'm encrypting it." And of course, they would entirely miss the point that the real issue is that they are sending the password by email.
      - marshray 14y ago
        In other contexts of society it's perfectly reasonable (if not expected) to point out "offenders" (those who are increasing risk of harm to the public) without being obligated to at the same time to educate and reform the offender.
  - DanBC 14y ago
    I gently agree. To be fair to the site, they do mention (admittedly on the bottom of the about page) > More reading on why even _just sending the password_ via email without storing it in plain text is bad. Which has a hyperlink to (http://plaintextoffenders.com/post/7006690494/whats-so-wrong-about-sending-a-new-password-in http://plaintextoffenders.com/post/7006690494/whats-so-wrong...) > What's so wrong about sending a new password in plaintext? It doesn't mean that the password is saved in plaintext...
    - mathijs 14y ago
      Ironically enough, I went to log in to HN specifically to upvote comments in this thread, forgot my password and had to use the 'email yourself a new password' function. Granted, it sends a randomly generated password. And granted: it's probably meant for one-time use only (I presume). However, logging in with the new password does not automatically prompt (or even force) to change it to something of my own choosing. Result: hit 'remember password' in Chrome and forget about it. Now my active HN password is in my inbox, in plain text.
  - rictic 14y ago
    This is an objection without much substance. The main thing that you're worried about with a plain text password is that it will be obtained by a third party. These are sites which are sending emails with passwords in the clear. They are also storing your password near the decryption key (if any), so a single security breach can compromise many passwords. That is to say: even if the rest of their infrastructure is NSA-level paranoid, whichever server(s) are sending out these password reminder emails are prime targets. Please do not defend this behavior.
    - runako 14y ago
      Please read my comments: I'm not defending the sending of plaintext passwords. But please do not defend sloppy claims of security vulnerabilities.

laurent123456 14y ago

Just to be sure, I had a look at the first 20 websites - 50% of them are password reminders, the rest are registration confirmation emails so it's not the majority of them. In any case, sending a password by email is always bad, no doubt about it, but my point is that they claim these websites store passwords as plain text when, half of the time, they don't actually know. Although this is a useful website, they lose a bit in credibility by being more sensationalist than they need to be.