4 ms·

The pedantry in some of the comments have me practically smashing my head into my desk. The semantic arguments about whether the actual password storage mechani

The pedantry in some of the comments have me practically smashing my head into my desk. The semantic arguments about whether the actual password storage mechanism is encrypted, encoded, etc, are wholly irrelevant. If a web site can sent you a "I forgot my password" reminder email which includes your plaintext password then the site operator is storing the password in a plaintext-equivalent format. If the password is stored as a plaintext-equivalent then attackers can steal your plaintext password when they "own" the site. To address the encryption pedantry: If a site is using encryption to store the password but the key to decrypt the password is available in the site's servers then, arguably, the encryption just amounts to an encoding. Symmetric encryption requires that the key be kept secret. Keeping the key on the servers means that it's not secret and means that it's not really encryption. Edit: I see that the discussion is heading this way so I'll head it off at the pass: I would argue that there is no reason that any site operator ever needs the plaintext of a user's password to be stored persistently for any reason. There is no valid reason passwords should be stored in a reversible manner. (Somebody is going to bring up storing credit card numbers with symmetric encryption, too. That's a broken system and, arguably, needs to be replaced with something based on asymmetric encryption instead of "secret numbers" that we have to transmit between quasi-trusted parties.)

marshray 14y ago
Don't smash your head. :-) Issues of authentication are inherently difficult for us humans to think about. Look at an issue one way and it's obvious, from a slightly different perspective it's extremely subtle.
runako 14y ago
Granted, a lot of this discussion is pedantic. Devil's advocate: why is it pedantry to ask for security alarms to be precise? We ask for e.g. the TSA to be precise about what it needs, should not computer security professionals be held to the same bar? Making bogus claims about a system's vulnerability (be it shoes at airports or passwords) damages the credibility of the next security alarm. Note: I'm not defending the practice of sending passwords in the clear. But I don't think it's too much to ask for security professionals to make precise claims, when doing so is a 5-second op.
- EvanAnderson 14y ago
  The pedantry that's irritating me is this argument about there somehow being a "safe" way to store the plaintext-equivalent version of a password (there isn't) or even that there is somehow a need to do so (there isn't). I agree that the Plain-Text Offenders site should state this plainly.
  - omervk 14y ago
    We are. http://plaintextoffenders.com/about http://plaintextoffenders.com/about
    - marshray 14y ago
      That's a nice little write-up, I think it would be great on the main page. I didn't look for it under "About" because I'm used to that being for personal details about the project's people rather than intro or summary info.

marshray 14y ago

Don't smash your head. :-) Issues of authentication are inherently difficult for us humans to think about. Look at an issue one way and it's obvious, from a slightly different perspective it's extremely subtle.

runako 14y ago

Granted, a lot of this discussion is pedantic. Devil's advocate: why is it pedantry to ask for security alarms to be precise? We ask for e.g. the TSA to be precise about what it needs, should not computer security professionals be held to the same bar? Making bogus claims about a system's vulnerability (be it shoes at airports or passwords) damages the credibility of the next security alarm. Note: I'm not defending the practice of sending passwords in the clear. But I don't think it's too much to ask for security professionals to make precise claims, when doing so is a 5-second op.

EvanAnderson 14y ago
The pedantry that's irritating me is this argument about there somehow being a "safe" way to store the plaintext-equivalent version of a password (there isn't) or even that there is somehow a need to do so (there isn't). I agree that the Plain-Text Offenders site should state this plainly.
- omervk 14y ago
  We are. http://plaintextoffenders.com/about http://plaintextoffenders.com/about
  - marshray 14y ago
    That's a nice little write-up, I think it would be great on the main page. I didn't look for it under "About" because I'm used to that being for personal details about the project's people rather than intro or summary info.