3 ms·

Really? We're going to downmod the most active security professional on HN? A guy who's built a 25+ person company on the basis of analyzing web applications

Really? We're going to downmod the most active security professional on HN? A guy who's built a 25+ person company on the basis of analyzing web applications for security? FFS, did we learn nothing from yesterday's expert kerfuffle? If Thomas says it's not really a big deal in practice, then it's not really a big deal in practice.

ryanwaggoner 18y ago
On the contrary, it's a big deal to me because it's my password and I judge that it's being stored in an insecure manner. I really appreciate Thomas's expertise, but since my data is at risk as a customer, my opinion is really the one that counts.
- axod 18y ago
  If you're not already using different passwords for each website, you can't really complain too much.
  - ErrantX 18y ago
    but it's still the password for THAT site.
    - axod 18y ago
      Sure, but if someones managed to hack into the server, they can steal your account regardless of if the password is plain text or not.
      - mdg 18y ago
        no its cool, they use macs
tptacek 18y ago
Note that I might not be "the most active security professional on HN", but am certainly "the security professional most active on HN". There's a big difference. ;) Note: I don't know who this "kubrick" person is, because he won't tell us, but "CISO of a financial institution or not", he's wrong about the OWASP Top 10. Neither "broken authentication" nor "poor encryption" "top vulnerabilities" discuss password encryption. "Storing plaintext passwords" is not an OWASP Top 10 flaw. "A7 Broken Authentication and Session Management" is a proxy for session fixation, and the catch-all category for things like "cookies that store the bit that tells the app whether you're the admin. It mentions passwords repeatedly without ever recommending they be encrypted; in fact, by talking about "Question and Answer" features, it tacitly acknowledges the practice. "A8 Insecure Cryptographic Storage" means "don't invent your own crypto", and now also "don't use MD5". It mentions passwords zero times; the only thing it says need to be encrypted are credit cards. This makes sense, because if it said anything else, no real-world web app would pass muster. Having said all that, I wouldn't put much stock in the OWASP Top 10 either. It's the most popular list of web flaws, but it isn't the most complete, nor is it the most coherent. It's not like there's science behind it.
kubrick 18y ago
I've been in the security business for 15 years and have never heard of Thomas. I'm a CISSP, was a CISO of a financial institution for 6 years, and do professional security auditing. I don't care what this Thomas guys says -- if you don't believe me, believe OWASP (http://owasp.org/ http://owasp.org/) -- this is a serious and fundamental security problem.

ryanwaggoner 18y ago

On the contrary, it's a big deal to me because it's my password and I judge that it's being stored in an insecure manner. I really appreciate Thomas's expertise, but since my data is at risk as a customer, my opinion is really the one that counts.

axod 18y ago
If you're not already using different passwords for each website, you can't really complain too much.
- ErrantX 18y ago
  but it's still the password for THAT site.
  - axod 18y ago
    Sure, but if someones managed to hack into the server, they can steal your account regardless of if the password is plain text or not.
    - mdg 18y ago
      no its cool, they use macs

tptacek 18y ago

Note that I might not be "the most active security professional on HN", but am certainly "the security professional most active on HN". There's a big difference. ;) Note: I don't know who this "kubrick" person is, because he won't tell us, but "CISO of a financial institution or not", he's wrong about the OWASP Top 10. Neither "broken authentication" nor "poor encryption" "top vulnerabilities" discuss password encryption. "Storing plaintext passwords" is not an OWASP Top 10 flaw. "A7 Broken Authentication and Session Management" is a proxy for session fixation, and the catch-all category for things like "cookies that store the bit that tells the app whether you're the admin. It mentions passwords repeatedly without ever recommending they be encrypted; in fact, by talking about "Question and Answer" features, it tacitly acknowledges the practice. "A8 Insecure Cryptographic Storage" means "don't invent your own crypto", and now also "don't use MD5". It mentions passwords zero times; the only thing it says need to be encrypted are credit cards. This makes sense, because if it said anything else, no real-world web app would pass muster. Having said all that, I wouldn't put much stock in the OWASP Top 10 either. It's the most popular list of web flaws, but it isn't the most complete, nor is it the most coherent. It's not like there's science behind it.

kubrick 18y ago

I've been in the security business for 15 years and have never heard of Thomas. I'm a CISSP, was a CISO of a financial institution for 6 years, and do professional security auditing. I don't care what this Thomas guys says -- if you don't believe me, believe OWASP (http://owasp.org/ http://owasp.org/) -- this is a serious and fundamental security problem.