5 ms·

One thing worth pointing out is he's saying that they're storing plain text in the database, which may not be the case. They may be storing the password in the

by crad 17y ago

One thing worth pointing out is he's saying that they're storing plain text in the database, which may not be the case. They may be storing the password in the database with two way encryption. I'm not arguing the merits of that, only pointing out he's claiming fact on something he has no specific details on.

jonknee 17y ago
If the server can decode it so can anyone who has access to the server. Not only that, but 37S reveals the password of other people's accounts to the admin. Pathetic.
- deleted 17y ago
  [deleted]
- tarmac 17y ago
  "If the server can decode it so can anyone who has access to the server." Semantics. Any type of security made by humans is breakable by humans. Your reasoning is flawed.
  - deleted 17y ago
    [deleted]
- ramchip 17y ago
  "Pathetic." is a bit excessive...
  - jonknee 17y ago
    No, revealing people's passwords is pathetic. They are a multi-million dollar company, it's about time they Get Real.
tarmac 17y ago
Correct, the blog post is assuming the password is stored in plain text, when he doesn't even have hard evidence about it. Two way encryption would be an explanation to this, so I am waiting on what 37s' answer to this blog post. It's sad people quickly come to conclusions when only hearing one side of the story.
- sounddust 17y ago
  From a security standpoint, there is no difference between storing the password in plain text, and storing it encrypted with the keys on the server to decrypt it. It's like saying that having an unlocked safe is not the same thing as having a locked safe with the keys left in the lock. Why should the OP make the distinction?
  - tarmac 17y ago
    You're assuming the keys are the only way to get into the safe. There you go again with flawed reasoning. What if I drill into the safe and open it in a different manner? ANY type of security has it's weaknesses. The only way is to add layers of security to make it harder to crack.
    - Hexstream 17y ago
      But encrypting the passwords with a key on the server is an additional "layer of security" that doesn't actually making it harder to crack. You're just adding complexity for naught.
      - m_eiman 17y ago
        It prevents you from getting the passwords with an SQL injection attack (or by reading the users.txt or whatever storage is used for the user list), so it does add protection.
        Hexstream 17y ago
        Ok, I was assuming the attacker had full access to the server.

by crad 17y ago

jonknee 17y ago

If the server can decode it so can anyone who has access to the server. Not only that, but 37S reveals the password of other people's accounts to the admin. Pathetic.

deleted 17y ago
[deleted]
tarmac 17y ago
"If the server can decode it so can anyone who has access to the server." Semantics. Any type of security made by humans is breakable by humans. Your reasoning is flawed.
- deleted 17y ago
  [deleted]
ramchip 17y ago
"Pathetic." is a bit excessive...
- jonknee 17y ago
  No, revealing people's passwords is pathetic. They are a multi-million dollar company, it's about time they Get Real.

tarmac 17y ago

Correct, the blog post is assuming the password is stored in plain text, when he doesn't even have hard evidence about it. Two way encryption would be an explanation to this, so I am waiting on what 37s' answer to this blog post. It's sad people quickly come to conclusions when only hearing one side of the story.

sounddust 17y ago
From a security standpoint, there is no difference between storing the password in plain text, and storing it encrypted with the keys on the server to decrypt it. It's like saying that having an unlocked safe is not the same thing as having a locked safe with the keys left in the lock. Why should the OP make the distinction?
- tarmac 17y ago
  You're assuming the keys are the only way to get into the safe. There you go again with flawed reasoning. What if I drill into the safe and open it in a different manner? ANY type of security has it's weaknesses. The only way is to add layers of security to make it harder to crack.
  - Hexstream 17y ago
    But encrypting the passwords with a key on the server is an additional "layer of security" that doesn't actually making it harder to crack. You're just adding complexity for naught.
    - m_eiman 17y ago
      It prevents you from getting the passwords with an SQL injection attack (or by reading the users.txt or whatever storage is used for the user list), so it does add protection.
      - Hexstream 17y ago
        Ok, I was assuming the attacker had full access to the server.