3 ms·

"• The poor state of passwords protection in web services: passwords are too often either stored in clear (these are the services that send you your password by

by Zenst 14y ago

"• The poor state of passwords protection in web services: passwords are too often either stored in clear (these are the services that send you your password by email after hitting "I forgot my password"), or just hashed with a cryptographic hash function (like MD5 or SHA-1), which exposes users' passwords to efficient brute force cracking methods." That is a huge issue that I wished was made a criminal action. But when a user forgets there password, the issue of issuing a new one falls down to verifying the user is who they say they are without a password and falls down to the previous details held by that user. Be it phone number to SMS a reset code or email to issue a rest code or new password. It is a hard area that will always have a weakness. I do wonder if the postal system could step in by offering a service which you could walk in - show your passport or supporting ID and have them issue you with a rest code which you could use upon the site. Certianly would add to the services they offered and whilst it would not be instant or as easy for many it certainly would be far more robust way to address the issue. A service that until something better comes along that would work for everybodies best interests. Maybe a good opertunity for a startup to pursue.

cheald 14y ago
Hashing data with SHA1 should be a criminal offense? Seriously?
- Zenst 14y ago
  partialy in jest but what I mean we often come across sitess that have issues and boils down to unsalted weak security hashing. In that you only find out about such weakness's when things go wrong. Certainly MD5 I'd say less in jest but as for SHA1 and any hashing that is found to have flaws and known about for a while the ongoing use is really down to its working don't touch it. Now if you have a site using say MD5 or SHA1 hashing unsalted and they get attacked and leaked then the attacked can brute force those hash's into plain text. If a site works and uses poor security and is not attacked then what forced them to maintain there security or improve it as it is seemed just to work. Sadly hindsite and reaction to security issues or break ins with password hash tables stolen for many sites is when they do something and that is retrospectively. So in a way a law that forced or even focused site owners to deal with problems before they are problems would only be good for joe publics privacy. Maybe a law or other means are the way, maybe not. But certainly the current situaton and attitude by some managment in companies towards there IT people with regards to them wanting to fix issues that are not obviously an issue now can only but help. I know and I'm sure others have known of situations in IT when the IT people want to do something to fix a potentual problem and yet budgets prevent them as it is not an issue and certainly from my experience of companies that use ITIL or other approaches they bias towards retrospective approach's in contrast to proactive ones. So if it takes a law to focus and support the IT people in companies to enable them to do the right thing then it can only be good.
  - tptacek 14y ago
    The known flaws in MD5 do not damage its security as a password hash. Passwords are a particularly difficult cryptanalytic challenge; you need a preimage attack that works on data constrained to a very small number of blocks.
- harryh 14y ago
  It already is. The FCC regulates this sort of thing. If you are a large business with lots of user data and you don't take appropriate steps to protect it they can and will fine you.
  - tptacek 14y ago
    The FCC has never fined anyone for SHA1-hashing passwords.
    - harryh 14y ago
      I'll take your word for it, but I bet that has to do with the fact that once you get big enough for the FCC to care you probably know enough to properly store a password. They've certainly fined other companies for other transgressions of a similar nature.
      - tptacek 14y ago
        For instance...?
        harryh 14y ago
        Path just had to pay an 800k fine (though I think that was for coppa violations?). Twitter & Google have also had very prominent investigations & settlements in the past couple of years.
        dfc 14y ago
        I think tptacek might be using the socratic method or else he is just messing with you but I can't watch it any longer. The regulatory function you are talking about falls under the purview of the FTC, not the FCC. "Path Social Networking App Settles FTC Charges it Deceived Consumers and Improperly Collected Personal Information from Users' Mobile Address Books Company also Will Pay $800,000 for Allegedly Collecting Kids' Personal Information without their Parents’ Consent"[1] [1] http://www.ftc.gov/opa/2013/02/path.shtm http://www.ftc.gov/opa/2013/02/path.shtm
- deleted 14y ago
  [deleted]
dfc 14y ago
"I do wonder if the postal system could step in by offering a service which you could walk in - show your passport or supporting ID and have them issue you with a rest code which you could use upon the site." Was that a joke? You want to insert the government in the middle of every password reset? What about password resets on Sundays or after 8pm?
- Zenst 14y ago
  No no not a joke and be it post office or another trusted 3rd party that had physical presence so you could walk in and verify and get a reset token is the proposal. It would be optional and sites would have to offer the option. But it is a approach that for many would work much better. Also given the goverment has the legal right to your passwords in many countries the post office would certainly be a good option due to them already having presence in many locations. Now as for the Sunday or late resets - yes that currently would be a issue, but people should not forget there passwords that easily for there own sake and certainly with online orders and dilevry's the post office of today needs to evolve though that is another issue. So not a joke, just a solution that for many would be far better than the alternatives and one which less technicaly aware would be able to deal with should the need arose. Now until biometrics evolve and are more common in ther euse household wise then it is a viable option. May not be perfect but certainly better than other options security wise for joe public. It may not be perfect but, nothing is and with that it could work.
7952 14y ago
The post office idea doesn't solve all that much. People tend to conflate two different problems: * Is the person real with a legal presence somewhere? * Is the user the same unique person who logged in last time? Most websites need to establish uniqueness rather than real world identity. Giving websites data about real identity actually puts the user at greater risk. Do I have to enter a social security or driving licence number online so the post office can link the accounts?
- Zenst 14y ago
  Far from having to give more information if anything you could give far less. Post office of other physical trusted source would have that and issue a reset code that would be validated via the trusted route to the post office. So for example. You create a login to this site, you give usual stuff and in the password reset options register a unique ID number that would be issues by the post office and any rests of passwords and indeed verification could be handeled via a external source in this case the post office who can offer a physical verification as and when needed. Sites would have to support such things but in a day when we have official identification for physical verification of who we are then digitaly it all boild down to trust. Certainly when you have to reset a password you are in a situation which the site may have many ways to verify you and that is done by taking more information than they need sometimes. So in effect a form of national ID card that would be to the people advantage and allow them to protect themselfs if they forget passwords is certainly one solution. But the whole area of verifiying a user who has forgoten there password is one of those problems that really has no magic solution without the site holding more information than they need to hold. The option at least to have a secure/trusted 3rd party able to do that verification and issue a new password or token that can be used to obtain a new password is certainly a solution. But as for the website having real user details, that would not be so, they would have number which could be one of many the user has and with that nothing more than they get now from a IP or MAC or email address and in many respects the ability to protect there anomanimity with website far greater than they have now. Sure the authorities would be able to know who is who, fake name/deatils on websites or not, but they can do that already. Certainly having the option instead of not for many would be a solution they would prefer. So in short, no you wont be handing website private information, if anything you would offer them less.

by Zenst 14y ago

cheald 14y ago

Hashing data with SHA1 should be a criminal offense? Seriously?

Zenst 14y ago
partialy in jest but what I mean we often come across sitess that have issues and boils down to unsalted weak security hashing. In that you only find out about such weakness's when things go wrong. Certainly MD5 I'd say less in jest but as for SHA1 and any hashing that is found to have flaws and known about for a while the ongoing use is really down to its working don't touch it. Now if you have a site using say MD5 or SHA1 hashing unsalted and they get attacked and leaked then the attacked can brute force those hash's into plain text. If a site works and uses poor security and is not attacked then what forced them to maintain there security or improve it as it is seemed just to work. Sadly hindsite and reaction to security issues or break ins with password hash tables stolen for many sites is when they do something and that is retrospectively. So in a way a law that forced or even focused site owners to deal with problems before they are problems would only be good for joe publics privacy. Maybe a law or other means are the way, maybe not. But certainly the current situaton and attitude by some managment in companies towards there IT people with regards to them wanting to fix issues that are not obviously an issue now can only but help. I know and I'm sure others have known of situations in IT when the IT people want to do something to fix a potentual problem and yet budgets prevent them as it is not an issue and certainly from my experience of companies that use ITIL or other approaches they bias towards retrospective approach's in contrast to proactive ones. So if it takes a law to focus and support the IT people in companies to enable them to do the right thing then it can only be good.
- tptacek 14y ago
  The known flaws in MD5 do not damage its security as a password hash. Passwords are a particularly difficult cryptanalytic challenge; you need a preimage attack that works on data constrained to a very small number of blocks.
harryh 14y ago
It already is. The FCC regulates this sort of thing. If you are a large business with lots of user data and you don't take appropriate steps to protect it they can and will fine you.
- tptacek 14y ago
  The FCC has never fined anyone for SHA1-hashing passwords.
  - harryh 14y ago
    I'll take your word for it, but I bet that has to do with the fact that once you get big enough for the FCC to care you probably know enough to properly store a password. They've certainly fined other companies for other transgressions of a similar nature.
    - tptacek 14y ago
      For instance...?
      - harryh 14y ago
        Path just had to pay an 800k fine (though I think that was for coppa violations?). Twitter & Google have also had very prominent investigations & settlements in the past couple of years.
        dfc 14y ago
        I think tptacek might be using the socratic method or else he is just messing with you but I can't watch it any longer. The regulatory function you are talking about falls under the purview of the FTC, not the FCC. "Path Social Networking App Settles FTC Charges it Deceived Consumers and Improperly Collected Personal Information from Users' Mobile Address Books Company also Will Pay $800,000 for Allegedly Collecting Kids' Personal Information without their Parents’ Consent"[1] [1] http://www.ftc.gov/opa/2013/02/path.shtm http://www.ftc.gov/opa/2013/02/path.shtm
deleted 14y ago
[deleted]

dfc 14y ago

"I do wonder if the postal system could step in by offering a service which you could walk in - show your passport or supporting ID and have them issue you with a rest code which you could use upon the site." Was that a joke? You want to insert the government in the middle of every password reset? What about password resets on Sundays or after 8pm?

Zenst 14y ago
No no not a joke and be it post office or another trusted 3rd party that had physical presence so you could walk in and verify and get a reset token is the proposal. It would be optional and sites would have to offer the option. But it is a approach that for many would work much better. Also given the goverment has the legal right to your passwords in many countries the post office would certainly be a good option due to them already having presence in many locations. Now as for the Sunday or late resets - yes that currently would be a issue, but people should not forget there passwords that easily for there own sake and certainly with online orders and dilevry's the post office of today needs to evolve though that is another issue. So not a joke, just a solution that for many would be far better than the alternatives and one which less technicaly aware would be able to deal with should the need arose. Now until biometrics evolve and are more common in ther euse household wise then it is a viable option. May not be perfect but certainly better than other options security wise for joe public. It may not be perfect but, nothing is and with that it could work.

7952 14y ago

The post office idea doesn't solve all that much. People tend to conflate two different problems: * Is the person real with a legal presence somewhere? * Is the user the same unique person who logged in last time? Most websites need to establish uniqueness rather than real world identity. Giving websites data about real identity actually puts the user at greater risk. Do I have to enter a social security or driving licence number online so the post office can link the accounts?

Zenst 14y ago
Far from having to give more information if anything you could give far less. Post office of other physical trusted source would have that and issue a reset code that would be validated via the trusted route to the post office. So for example. You create a login to this site, you give usual stuff and in the password reset options register a unique ID number that would be issues by the post office and any rests of passwords and indeed verification could be handeled via a external source in this case the post office who can offer a physical verification as and when needed. Sites would have to support such things but in a day when we have official identification for physical verification of who we are then digitaly it all boild down to trust. Certainly when you have to reset a password you are in a situation which the site may have many ways to verify you and that is done by taking more information than they need sometimes. So in effect a form of national ID card that would be to the people advantage and allow them to protect themselfs if they forget passwords is certainly one solution. But the whole area of verifiying a user who has forgoten there password is one of those problems that really has no magic solution without the site holding more information than they need to hold. The option at least to have a secure/trusted 3rd party able to do that verification and issue a new password or token that can be used to obtain a new password is certainly a solution. But as for the website having real user details, that would not be so, they would have number which could be one of many the user has and with that nothing more than they get now from a IP or MAC or email address and in many respects the ability to protect there anomanimity with website far greater than they have now. Sure the authorities would be able to know who is who, fake name/deatils on websites or not, but they can do that already. Certainly having the option instead of not for many would be a solution they would prefer. So in short, no you wont be handing website private information, if anything you would offer them less.