12 ms·

Feds tell web firms to turn over user passwords

234 points by antman 13y ago

zedstar 13y ago
So all we need to do is change our password every day or so? As long as it is faster than the bureaucracy?
- wesley 13y ago
  Some kind of automated solution to handle this would be nice. Think 1password with automated password changes daily. How hard can it be? It can already log in by itself, now it just needs to know the page where you can change your password.
  - AlexeiSadeski 13y ago
    Then the Feds will just get the info straight from 1password - or whichever password manager implements such a plan. Really, the only solution to this kind of thing is offshore corps.
    - Styn 13y ago
      1Password doesn't store your passwords, it generates them on the fly. You would need to hand over your encrypted password storage and your passphrase. Both of which 1Password has no control over.
      - nwh 13y ago
        That's not entirely correct. 1Password is a local, encrypted store of known passwords. Nothing is generated, except for the original passphrases themselves, which are completely random (not from a seed).
        Styn 13y ago
        Yeah, I was a little too quick in writing that. What I meant to write was that 1. passwords are stored locally and 2. you have the option to generate passwords with predefined complexity parameters. It would be possible to use this password generating feature to update your passwords automatically at a set interval.
    - deleted 13y ago
      [deleted]
    - wesley 13y ago
      So really what we need is some kind of API design that allows for password changes that all websites should adopt. Of course that's never going to happen... Still, if 1password made scraping work for the biggest sites out there (google, microsoft, etc) then that in itself would already be worthwhile.
    - a3n 13y ago
      No, the only solution is offline data. The only reason any of this is an issue is because we have our data and communication in the internet. That's what makes mass surveillance possible. If you keep your data off the internet, then you're only at risk of individual surveillance. But even that's difficult; stuxnet demonstrated that even air gapped computers are at risk, because we move data around on usb sticks and the like. So, speech and paper, or human memory, are the only really secure media. As for all the apps we carry around in our pockets ... do you really need instant online access to your bank balance over the internet on the bus? We used to carry around checkbooks and make entries in the register. If you really need to know your balance 24/7, carry a register booklet, or a moleskin. Then you don't have to wonder if Mint et al. are giving up your passwords. Opt out.
  - nwh 13y ago
    > How hard can it be? It can already log in by itself, now it just needs to know the page where you can change your password. The main issue is; scraping is hard and breaks at the drop of a hat. Sure you could script hourly password changes if you wanted to, but as soon as the host service modifies their forms a little, the whole system breaks and you could possibly be locked out of your account.
- adamnemecek 13y ago
  I mean couldn't they just request direct access to the database without going through the pain of cracking your password? They can probably run the sql query on their own and get whatever they need.
  - oelmekki 13y ago
    I think the point here is that feds don't want to have to ask access to companies, or even getting noticed. Operating directly on the database means either : * requesting a dump that get quickly deprecated * having a direct access to database, which can be traced Using common interface, you can use it without rising any flags, except if companies specifically implement warning feature for known NSA/feds/whatever ips. The best of that is that many people use the same password for several websites. So, having one, you may access data on an other website without the company knowing it. As it becomes more and more clear big companies are fighting agencies here, decyphering passwords and using them abroad makes perfect sense.
    - adamnemecek 13y ago
      > don't want to have to ask access to companies I mean, isn't the article about the gov't asking the companies for user passwords? How is asking for direct db access any different than this?
      - antninja 13y ago
        Say they ask Amazon for your password, if you reuse the same password elsewhere like 99% of people, then they can access all your other accounts without any permission to ask. In this scheme, only one 'traitor' company compromises all others. People should really use unique passwords.
- ihsw 13y ago
  Changing your password frequently could be construed as obstruction of justice (US) or perverting the course of justice (UK). Also, if there is an automated system for sending new passwords to your local clandestine operations agency then you're simply speeding up the process of them hoovering your data.
oelmekki 13y ago
We really need to systematically implement in our login systems what many ssh access does when you login : "Hello <username>. Your last login was at <time> from <ip>". It won't solve the problem, but it'll certainly help a bit. EDIT after a few comments : This will not make it impossible to steal identity. But this will cost us almost nothing and imply high cost for spooks : if you have a user password, you can use it on many website, for common users, without the related company even knowing it. If you implement last login timestamp, it's something you can do within hours, without any need for heavy architectural changes, and it will cost a lot to spooks to try to fake it on every websites, for a large amount of users. Cheap to us, costly to them. That's the way to go for me.
- chrischen 13y ago
  They could always modify that as well.
  - oelmekki 13y ago
    Well, in the context of a specific targeting, certainly. I have no problem with that. What is a problem is mass surveillance. A simple measure like that could make it very costly to achieve mass operations. EDIT : also, please note that the problem with password is that once you get one, for common people, you can hope they used it on many other sites. This allow feds to access website without the company even knowing it. If you have to fake login timestamp, all related companies must be aware of your action.
- sgk284 13y ago
  Google already does this with GMail. Scroll down to the bottom and it's in the lower right corner. Facebook also provides access to all recent/active sessions and their last accessed time under Settings -> Security. They've got all kinds of other good security features that are worth enabling too. I suspect a better long-term approach here is going to be something like Mozilla Persona (with the option of easily using your own domain for auth & auth if you like). Then the service doesn't have your password. They could still give the Feds access to your data, but at least the Feds won't be able to leverage your password against other services (greater adoption of password managers would also help this scenario). And of course, enable two-factor auth on any site that supports it.
falk 13y ago
This is why I won't be using iCloud Keychain.
- rahoulb 13y ago
  Depends how it is implemented. LastPass say that all your details are encrypted client-side via your master password, so they cannot access anything of yours. There's nothing to stop Apple doing the same - but I suspect they won't.
  - drivingmenuts 13y ago
    On the other hand, Apple might be rethinking that policy right now. I hope they are, anyway.
- ancarda 13y ago
  I'm going to wait and see if it uses client-side encryption. If it does, it's probably safe to use.
chrischen 13y ago
Aren't most passwords 1-way hashed? Seems like this is only going to give them access to low-level passwords.
- nwh 13y ago
  Meant to be, but most aren't. I know that my bank, ISP, and mobile carrier all store my passwords in plain text. Along with all these jokers — http://plaintextoffenders.com/ http://plaintextoffenders.com/
  - chrischen 13y ago
    Someone should create a third party certification program where they take a look at your password storage code, and if it uses industry best practices, you can display a badge on your site.
    - nly 13y ago
      Better to switch to authentication protocols where the server never sees your password.
    - venomsnake 13y ago
      And what prevents me to create a simple page that redirects to plaintext on login if given an order after the audit. With NSL currently the situation is whatever lola wants, lola gets.
      - stan_rogers 13y ago
        There's no need to; the password plaintext is available during the login process anyway. There's a difference between not storing it and not having it. All that would be required, really (assuming you don't want to store passwords, but are terribly, terribly concerned with the ability to extract a particular passwords under particular circumstances) is a conditional that shunts the plaintext somewhere before the login script/module dies. The login then continues as normal, but the bells and sirens go off and the plaintext password is available outside of the system. This, though, depends on user login after the fact, so to speak; turning over the hashes may mean more work for the interested authorities, but it won't depend on new logins.
cs648 13y ago
Was this image[1] generated by Instacode[2]? [1] http://asset2.cbsistatic.com/cnwk.1d/i/tim2/2013/07/25/bcrypt_610x357.png http://asset2.cbsistatic.com/cnwk.1d/i/tim2/2013/07/25/bcryp... [2] http://instacod.es http://instacod.es
- declan 13y ago
  Nope! I did it the old fashioned way with a Canon 1Ds Mark III and a macro lens.
downandout 13y ago
If you communicate information to a third party, it is vulnerable to disclosure. End of story. Either encrypt it or don't, and if you don't, then you don't complain if you find it being used against you in the future.
- precisioncoder 13y ago
  That sounds to me similar to the sentence: "Either wear a bulletproof vest or don't, and if you don't then you have waived your right to get upset if you get shot in the chest in the future." You always have the right to be upset if a third party accesses your data. Getting upset about unjust things is exactly how changes happen that make the world a better place. I understand that it's important to take safeguards but not everyone has the technical expertise or interest to protect their data. Many people don't even realize that the problem exists.
  - deleted 13y ago
    [deleted]
josteink 13y ago
OwnCloud is just looking better and better.
- benev 13y ago
  I set it up just to have a play with after the PRISM story broke, and I've been really impressed. Now, if only OX office [1] finally gets released, I'll have all my cloud stuff running on my own server. [1]https://www.ox.io/ https://www.ox.io/ EDIT: It's OX Text I'm most after (https://www.ox.io/ox_text https://www.ox.io/ox_text)
  - pestaa 13y ago
    Is there anything else you're running besides ownCloud and soon OX?
    - benev 13y ago
      Not at the moment. ownCloud does my file backup and sync between devices, calendar, cloud music player and to-do list manager. I'm considering setting up my own e-mail system, but haven't gotten around to it yet. EDIT: Actually, I forgot I installed Piwik for web analytics. Not that it's in any way needed for what I do, but I wanted to see what it's like. I was impressed, but haven't pushed it yet.
- Joeboy 13y ago
  I need to install owncloud, or git-annex-assistant, or something. If anybody wants to evangelise their favoured option here, that would be great.
  - peng 13y ago
    PRISM Break has more free cloud storage options for your perusal: https://prism-break.org/#cloud-storage https://prism-break.org/#cloud-storage I'm using rsync for backup and Seafile for file sync myself.
- Pym 13y ago
elchief 13y ago
How fast could the NSA crack a BCrypt-hashed password?
- rythie 13y ago
  It depends on what cost has been used
- dchest 13y ago
  It's in the article.
  - uxp 13y ago
    Not quite. From the article: > A 2009 paper (PDF) by computer scientist Colin Percival estimated that it would cost a mere $4 to crack, in an average of one year, an 8-character bcrypt password composed only of letters. Yet the linked paper by cpercival specifically states that a 8 _letter_ password would only take $4 per year to crack, but a 8 _character_ password would jump to $130k. Also, these numbers, as quoted from the paper, are referenced from 2002 dollars, including dollar costs of hardware from 2002, but do not include hardware other than the CPU, such as power supplies.
- svantana 13y ago
  it depends on whether your password is "kittenz" (one minute) or "A39cBiwe&4j2fqVz1uQ" (years and years)
  - hahainternet 13y ago
    No. It depends on the number of rounds.
Robin_Message 13y ago
Hear me out: with a sensible court order and oversight, requesting a single user's password makes a lot of sense. Let's say you've taken a suspect in to custody, but want to capture their co-conspirators [1]. One way to do that might be to impersonate them online so as to keep their plot moving forward. In what ways is it in a different category to their phone company handing over their call logs and getting someone to impersonate their voice (or send a text message) to an associate? A single password, in an active situation, with oversight [2], is a totally different proposition from something like Prism or handing over SSL private keys. [1] Not sure about US law on entrapment, but "bring the kit, we're doing it tonight, rendezvous is XYZ" and then seeing who turns up with what doesn't sound like entrapment to me. [2] I have no idea what oversight might or might not be applied. "No comment" from the government is admittedly not an encouraging sign.
- jgeerts 13y ago
  This is a whole other thing, this is a single users password, I think in the article they are talking about every user's password, correct me if I'm wrong. And even then, a password should be encrypted. If there is a court order to reveal information, then there has to be a way to get this information rather than sending unencrypted passwords to the government so they can snoop through your mail without even being proven that you are guilty.
  - Karunamon 13y ago
    >they can snoop through your mail without even being proven that you are guilty. I must point out, "snooping through your mail" requires probable cause, not proof of guilt (that's for a court to decide).
- pfisch 13y ago
  No because competent companies don't just have peoples' passwords. They would have to give the encrypted password, encryption method and salt which would greatly weaken the companies own internal security because now a bunch of people know a lot about the encryption system of the company and those people can't be trusted to keep the information secure.
noloqy 13y ago
It is time for software companies to unite. Feds can't just continue roaming around, asking companies for their users' password hashes and other things. In the current state, some big companies have the means to fight such requests, some big companies are very willing to cooperate, and small companies rarely have the means to go into a legal battle. Because of the current fragmentation and secrecy surrounding feds' requests with software companies, users do not have the possibility of knowing what they're in for with which company. Also, the divide and conquer tactics used by the Feds really allow them to extract much more information than what would otherwise be the case. Ideally there should be a union for software companies, which makes agreements with the feds concerning their access rights; agreements which then apply to all members of the union. Currently I have two rules of thumb: 1) for critical services, avoid companies located or significantly involved in the US or UK and 2) at all costs, stay away from Microsoft.
- kybernetyk 13y ago
  1) For critical services run them locally where possible. Avoid 'cloud' or 'remote' at all costs - no matter where the hosting company is located.
  - toble 13y ago
    This is more apt advice. At Hacker News we are swimming in a sea of start-ups, who are constantly evangelising the 'cloud' (it's often their bread and butter). But if you genuinely want privacy then keep it local and locked down. Stick to mainstream open source products and keep things as simple as possible.
    - hariis 13y ago
      And what will you do when Feds knock on your door?
      - kybernetyk 13y ago
        At least they need a warrant in that case and you know that there's something going on. Also: You can encrypt the server hard drives.
EnderMB 13y ago
This is probably a stupid comment to make, but when the feds request these passwords what is stopping a firm from giving over a set of tampered passwords? Let's say a request is made for Google give over loads of Gmail passwords. Could they not silently implement an extremely strong password encryption on the affected accounts, and hand over these passwords, knowing that the feds wouldn't be able to crack them without a significant amount of time. Also, are the feds likely to check to see if these passwords are legitimate? If my password was 12345 and Google simply told them that my password was 54321 then how could the feds possibly know that the passwords sent over are real? EDIT: Obviously, I know this is highly illegal, and would land any company in trouble. I'm just wondering whether, theoretically, this is possible for a firm to do to circumvent any action from the feds.
- coldtea 13y ago
  >Also, are the feds likely to check to see if these passwords are legitimate? If my password was 12345 and Google simply told them that my password was 54321 then how could the feds possibly know that the passwords sent over are real? By them NOT WORKING?
  - EnderMB 13y ago
    Well, they're not going to crack a ton of passwords that quickly, and I'm guessing that they're testing against the live server, so if the password doesn't work then surely the most obvious answer is that the password has changed. A lot of people have already stated that one way around this would be to change your password before the feds have had a chance to crack the provided hashes. This would surely be a similar system. Of course, I don't know if this would work at all. I was basically thinking aloud to see if this idea would have some merit.
    - 3825 13y ago
      Google will tell you that you changed your password {0} days ago if you try to log in with the previous password.
- 13y ago
jgeerts 13y ago
Welcome to the world, this is a webcam, put it on your head so we can watch your every move at all times. What the hell is wrong with the government, is it really their business to interfere with personal life? It's their job to facilitate the community, to find solutions for peoples lives, this is not a solution, they are creating overly complex problems, unnecessary spent money. We need less government, less people there with less money, it seems they have too much of it and way too much time.
- nodata 13y ago
  That really is the missing piece in the puzzle: what on earth do they need such deep and complete access into everyones' lives for?
  - sillysaurus 13y ago
    It's a government. Their natural desire is to govern lives.
  - meddlepal 13y ago
    You're asking the wrong question. They don't need this data, but they can acquire it. Why can they? Because nobody has said otherwise. I don't expect a quick resolution to this problem and others. Political philosophy and legal theory have not kept up with technical advancements in society.
- deleted 13y ago
  [deleted]
- jes 13y ago
  With respect, I don't think government should be facilitating the community or finding solutions for people's lives, as that quickly becomes a license to violate the rights of some individuals in order to give a benefit to some others.
downandout 13y ago
I'm not sure how beneficial it is to ask for salted password hashes, when a simple change in the wording of the request to a judge (or the FISA court rubber stamp factory) would yield an order for the provider to capture and turn over the plaintext password the next time the user logs in. US judges will do almost anything they are asked, especially if the requesting agency uses the "T" word. Either these agencies don't know what to ask for, or they are already doing this and no one has written a story about it.
- pestaa 13y ago
  What's the "T" word, please?
  - downandout 13y ago
    Terrorism.
    - pestaa 13y ago
      Thanks, obvious in hindsight.
saurabhnanda 13y ago
How does this play with DMCA anti-circumvention provisions?
fexl 13y ago
They're also demanding private SSL keys: http://news.cnet.com/8301-13578_3-57595202-38/feds-put-heat-on-web-firms-for-master-encryption-keys/ http://news.cnet.com/8301-13578_3-57595202-38/feds-put-heat-... In that case they can easily sniff passwords as they are used.
- dhimes 13y ago
  This is actually the bigger story because it's a smarter way for them to go IMHO.
forgotAgain 13y ago
This strikes me as a very thin story with a lot of filler added. A red flag for me with the article is that the headline uses the word "tell" while quotes from anonymous sources use the word "request". There's nothing wrong with the government asking for access to a user account if they have a legitimate (ie. named) court order. This is the most important story for this country since 9/11. Third rate journalism won't be part of the solution.
- jrwoodruff 13y ago
  Over-reliance on anonymous sources is always a red flag for me. His main sources are "...one internet industry source" and "...a person who has worked at a large Silicon Valley Company." That's about as vague and unverifiable as you can get for the foundation of a story like this.
- dhimes 13y ago
  For the general public this type of article works well. The filler is useful because a lot of people are coming to the issue for the first time. Hopefully NBC &c. will also fill in pertinent background information as they bring their audiences up to speed.
- ChikkaChiChi 13y ago
  I'm well aware of Journalism's yellow history, I feel like things have devolved quickly and depressingly in the era of the blog and the pageview/story break Twitter one-upsmanship that exists today.
- bpatrianakos 13y ago
  It's so frustrating to see the vast majority of comments here take this seriously. Thank you for having the guts to call it like it is.
- film42 13y ago
  There's been a few articles like this recently. The problem is, it's so easy to flip a world like "request" to "tell", or drum up a government looking document asking for xyz. There's just no way to determine the validity of this stuff.
deleted 13y ago
[deleted]
hawleyal 13y ago
I don't store plaintext passwords. Nor should anyone else. Only a hash and salt.
- stan_rogers 13y ago
  Hash, salt and algorithm. That will allow you to upgrade the algorithm or work factor as your server becomes more capable (or if a deficiency in the algorithm you're using is identified), authenticate the user under the old system and re-hash on the fly, all seamlessly to the user. (If you're depending on the algorithm being a "secret sauce", you're doing it wrong.)
8654395 13y ago
Throwaway account just to post this. Of course the Feds will have access to whatever they deem necessary even if it takes them time to get the pieces in place. It's the users who ultimately lose the most. I'm learning the hard way just how much the user is the one ultimately screwed when it comes to account access. My father just recently died very unexpectedly and tragically. He was generally retired but still doing a dozen or so small tech consulting projects here and there and using his personal accounts on Gmail/Facebook/etc. for everything. Facebook simply will not give any family member access to a deceased person's account. Google will consider it after you fill out a form and send them a bunch of documentation. Then they will consider and may possibly end up sending you off to get a court order and the like, but you're entirely subject to their own decision about whether you can get access to your deceased family member's main form of personal and business communication. You do not own your Gmail account, regardless of the shit they spout about you being able to download your data using takeout. If your estate can't get "your" data, you didn't really own it. Yes, I know there are steps that could have been taken to have given access to others on the event of one's death, but realistically what percentage of Gmail/Facebook users have taken those steps? And why should those accounts be different from normal digital accounts like bank accounts where a standard court estate document is enough?
- Karunamon 13y ago
  >Then they will consider and may possibly end up sending you off to get a court order and the like, So you expect them to accept any old paper that looks like a court order without a vetting and verification process? >If your estate can't get "your" data, you didn't really own it. If you can't legally prove that you are part of "your" estate, then you're SOL. And getting anything done legally takes time. Sometimes lots of it.
  - 8654395 13y ago
    I never said I expected them to accept a court order without verification. Simply that there should not be discretion on their part if proper estate documents are presented. They have made it clear that they have discretion, so the account itself it not actually considered part of the estate by Google.
diminoten 13y ago
Why do web firms have my passwords in the first place?
deleted 13y ago
[deleted]

234 points by antman 13y ago

zedstar 13y ago

So all we need to do is change our password every day or so? As long as it is faster than the bureaucracy?

wesley 13y ago
Some kind of automated solution to handle this would be nice. Think 1password with automated password changes daily. How hard can it be? It can already log in by itself, now it just needs to know the page where you can change your password.
- AlexeiSadeski 13y ago
  Then the Feds will just get the info straight from 1password - or whichever password manager implements such a plan. Really, the only solution to this kind of thing is offshore corps.
  - Styn 13y ago
    1Password doesn't store your passwords, it generates them on the fly. You would need to hand over your encrypted password storage and your passphrase. Both of which 1Password has no control over.
    - nwh 13y ago
      That's not entirely correct. 1Password is a local, encrypted store of known passwords. Nothing is generated, except for the original passphrases themselves, which are completely random (not from a seed).
      - Styn 13y ago
        Yeah, I was a little too quick in writing that. What I meant to write was that 1. passwords are stored locally and 2. you have the option to generate passwords with predefined complexity parameters. It would be possible to use this password generating feature to update your passwords automatically at a set interval.
  - deleted 13y ago
    [deleted]
  - wesley 13y ago
    So really what we need is some kind of API design that allows for password changes that all websites should adopt. Of course that's never going to happen... Still, if 1password made scraping work for the biggest sites out there (google, microsoft, etc) then that in itself would already be worthwhile.
  - a3n 13y ago
    No, the only solution is offline data. The only reason any of this is an issue is because we have our data and communication in the internet. That's what makes mass surveillance possible. If you keep your data off the internet, then you're only at risk of individual surveillance. But even that's difficult; stuxnet demonstrated that even air gapped computers are at risk, because we move data around on usb sticks and the like. So, speech and paper, or human memory, are the only really secure media. As for all the apps we carry around in our pockets ... do you really need instant online access to your bank balance over the internet on the bus? We used to carry around checkbooks and make entries in the register. If you really need to know your balance 24/7, carry a register booklet, or a moleskin. Then you don't have to wonder if Mint et al. are giving up your passwords. Opt out.
- nwh 13y ago
  > How hard can it be? It can already log in by itself, now it just needs to know the page where you can change your password. The main issue is; scraping is hard and breaks at the drop of a hat. Sure you could script hourly password changes if you wanted to, but as soon as the host service modifies their forms a little, the whole system breaks and you could possibly be locked out of your account.
adamnemecek 13y ago
I mean couldn't they just request direct access to the database without going through the pain of cracking your password? They can probably run the sql query on their own and get whatever they need.
- oelmekki 13y ago
  I think the point here is that feds don't want to have to ask access to companies, or even getting noticed. Operating directly on the database means either : * requesting a dump that get quickly deprecated * having a direct access to database, which can be traced Using common interface, you can use it without rising any flags, except if companies specifically implement warning feature for known NSA/feds/whatever ips. The best of that is that many people use the same password for several websites. So, having one, you may access data on an other website without the company knowing it. As it becomes more and more clear big companies are fighting agencies here, decyphering passwords and using them abroad makes perfect sense.
  - adamnemecek 13y ago
    > don't want to have to ask access to companies I mean, isn't the article about the gov't asking the companies for user passwords? How is asking for direct db access any different than this?
    - antninja 13y ago
      Say they ask Amazon for your password, if you reuse the same password elsewhere like 99% of people, then they can access all your other accounts without any permission to ask. In this scheme, only one 'traitor' company compromises all others. People should really use unique passwords.
ihsw 13y ago
Changing your password frequently could be construed as obstruction of justice (US) or perverting the course of justice (UK). Also, if there is an automated system for sending new passwords to your local clandestine operations agency then you're simply speeding up the process of them hoovering your data.

oelmekki 13y ago

We really need to systematically implement in our login systems what many ssh access does when you login : "Hello <username>. Your last login was at <time> from <ip>". It won't solve the problem, but it'll certainly help a bit. EDIT after a few comments : This will not make it impossible to steal identity. But this will cost us almost nothing and imply high cost for spooks : if you have a user password, you can use it on many website, for common users, without the related company even knowing it. If you implement last login timestamp, it's something you can do within hours, without any need for heavy architectural changes, and it will cost a lot to spooks to try to fake it on every websites, for a large amount of users. Cheap to us, costly to them. That's the way to go for me.

chrischen 13y ago
They could always modify that as well.
- oelmekki 13y ago
  Well, in the context of a specific targeting, certainly. I have no problem with that. What is a problem is mass surveillance. A simple measure like that could make it very costly to achieve mass operations. EDIT : also, please note that the problem with password is that once you get one, for common people, you can hope they used it on many other sites. This allow feds to access website without the company even knowing it. If you have to fake login timestamp, all related companies must be aware of your action.
sgk284 13y ago
Google already does this with GMail. Scroll down to the bottom and it's in the lower right corner. Facebook also provides access to all recent/active sessions and their last accessed time under Settings -> Security. They've got all kinds of other good security features that are worth enabling too. I suspect a better long-term approach here is going to be something like Mozilla Persona (with the option of easily using your own domain for auth & auth if you like). Then the service doesn't have your password. They could still give the Feds access to your data, but at least the Feds won't be able to leverage your password against other services (greater adoption of password managers would also help this scenario). And of course, enable two-factor auth on any site that supports it.

falk 13y ago

This is why I won't be using iCloud Keychain.

rahoulb 13y ago
Depends how it is implemented. LastPass say that all your details are encrypted client-side via your master password, so they cannot access anything of yours. There's nothing to stop Apple doing the same - but I suspect they won't.
- drivingmenuts 13y ago
  On the other hand, Apple might be rethinking that policy right now. I hope they are, anyway.
ancarda 13y ago
I'm going to wait and see if it uses client-side encryption. If it does, it's probably safe to use.

chrischen 13y ago

Aren't most passwords 1-way hashed? Seems like this is only going to give them access to low-level passwords.

nwh 13y ago
Meant to be, but most aren't. I know that my bank, ISP, and mobile carrier all store my passwords in plain text. Along with all these jokers — http://plaintextoffenders.com/ http://plaintextoffenders.com/
- chrischen 13y ago
  Someone should create a third party certification program where they take a look at your password storage code, and if it uses industry best practices, you can display a badge on your site.
  - nly 13y ago
    Better to switch to authentication protocols where the server never sees your password.
  - venomsnake 13y ago
    And what prevents me to create a simple page that redirects to plaintext on login if given an order after the audit. With NSL currently the situation is whatever lola wants, lola gets.
    - stan_rogers 13y ago
      There's no need to; the password plaintext is available during the login process anyway. There's a difference between not storing it and not having it. All that would be required, really (assuming you don't want to store passwords, but are terribly, terribly concerned with the ability to extract a particular passwords under particular circumstances) is a conditional that shunts the plaintext somewhere before the login script/module dies. The login then continues as normal, but the bells and sirens go off and the plaintext password is available outside of the system. This, though, depends on user login after the fact, so to speak; turning over the hashes may mean more work for the interested authorities, but it won't depend on new logins.

cs648 13y ago

Was this image[1] generated by Instacode[2]? [1] http://asset2.cbsistatic.com/cnwk.1d/i/tim2/2013/07/25/bcrypt_610x357.png http://asset2.cbsistatic.com/cnwk.1d/i/tim2/2013/07/25/bcryp... [2] http://instacod.es http://instacod.es

declan 13y ago
Nope! I did it the old fashioned way with a Canon 1Ds Mark III and a macro lens.

downandout 13y ago

If you communicate information to a third party, it is vulnerable to disclosure. End of story. Either encrypt it or don't, and if you don't, then you don't complain if you find it being used against you in the future.

precisioncoder 13y ago
That sounds to me similar to the sentence: "Either wear a bulletproof vest or don't, and if you don't then you have waived your right to get upset if you get shot in the chest in the future." You always have the right to be upset if a third party accesses your data. Getting upset about unjust things is exactly how changes happen that make the world a better place. I understand that it's important to take safeguards but not everyone has the technical expertise or interest to protect their data. Many people don't even realize that the problem exists.
- deleted 13y ago
  [deleted]

josteink 13y ago

OwnCloud is just looking better and better.

benev 13y ago
I set it up just to have a play with after the PRISM story broke, and I've been really impressed. Now, if only OX office [1] finally gets released, I'll have all my cloud stuff running on my own server. [1]https://www.ox.io/ https://www.ox.io/ EDIT: It's OX Text I'm most after (https://www.ox.io/ox_text https://www.ox.io/ox_text)
- pestaa 13y ago
  Is there anything else you're running besides ownCloud and soon OX?
  - benev 13y ago
    Not at the moment. ownCloud does my file backup and sync between devices, calendar, cloud music player and to-do list manager. I'm considering setting up my own e-mail system, but haven't gotten around to it yet. EDIT: Actually, I forgot I installed Piwik for web analytics. Not that it's in any way needed for what I do, but I wanted to see what it's like. I was impressed, but haven't pushed it yet.
Joeboy 13y ago
I need to install owncloud, or git-annex-assistant, or something. If anybody wants to evangelise their favoured option here, that would be great.
- peng 13y ago
  PRISM Break has more free cloud storage options for your perusal: https://prism-break.org/#cloud-storage https://prism-break.org/#cloud-storage I'm using rsync for backup and Seafile for file sync myself.
Pym 13y ago

elchief 13y ago

How fast could the NSA crack a BCrypt-hashed password?

rythie 13y ago
It depends on what cost has been used
dchest 13y ago
It's in the article.
- uxp 13y ago
  Not quite. From the article: > A 2009 paper (PDF) by computer scientist Colin Percival estimated that it would cost a mere $4 to crack, in an average of one year, an 8-character bcrypt password composed only of letters. Yet the linked paper by cpercival specifically states that a 8 _letter_ password would only take $4 per year to crack, but a 8 _character_ password would jump to $130k. Also, these numbers, as quoted from the paper, are referenced from 2002 dollars, including dollar costs of hardware from 2002, but do not include hardware other than the CPU, such as power supplies.
svantana 13y ago
it depends on whether your password is "kittenz" (one minute) or "A39cBiwe&4j2fqVz1uQ" (years and years)
- hahainternet 13y ago
  No. It depends on the number of rounds.

Robin_Message 13y ago

Hear me out: with a sensible court order and oversight, requesting a single user's password makes a lot of sense. Let's say you've taken a suspect in to custody, but want to capture their co-conspirators [1]. One way to do that might be to impersonate them online so as to keep their plot moving forward. In what ways is it in a different category to their phone company handing over their call logs and getting someone to impersonate their voice (or send a text message) to an associate? A single password, in an active situation, with oversight [2], is a totally different proposition from something like Prism or handing over SSL private keys. [1] Not sure about US law on entrapment, but "bring the kit, we're doing it tonight, rendezvous is XYZ" and then seeing who turns up with what doesn't sound like entrapment to me. [2] I have no idea what oversight might or might not be applied. "No comment" from the government is admittedly not an encouraging sign.

jgeerts 13y ago
This is a whole other thing, this is a single users password, I think in the article they are talking about every user's password, correct me if I'm wrong. And even then, a password should be encrypted. If there is a court order to reveal information, then there has to be a way to get this information rather than sending unencrypted passwords to the government so they can snoop through your mail without even being proven that you are guilty.
- Karunamon 13y ago
  >they can snoop through your mail without even being proven that you are guilty. I must point out, "snooping through your mail" requires probable cause, not proof of guilt (that's for a court to decide).
pfisch 13y ago
No because competent companies don't just have peoples' passwords. They would have to give the encrypted password, encryption method and salt which would greatly weaken the companies own internal security because now a bunch of people know a lot about the encryption system of the company and those people can't be trusted to keep the information secure.

noloqy 13y ago

It is time for software companies to unite. Feds can't just continue roaming around, asking companies for their users' password hashes and other things. In the current state, some big companies have the means to fight such requests, some big companies are very willing to cooperate, and small companies rarely have the means to go into a legal battle. Because of the current fragmentation and secrecy surrounding feds' requests with software companies, users do not have the possibility of knowing what they're in for with which company. Also, the divide and conquer tactics used by the Feds really allow them to extract much more information than what would otherwise be the case. Ideally there should be a union for software companies, which makes agreements with the feds concerning their access rights; agreements which then apply to all members of the union. Currently I have two rules of thumb: 1) for critical services, avoid companies located or significantly involved in the US or UK and 2) at all costs, stay away from Microsoft.

kybernetyk 13y ago
1) For critical services run them locally where possible. Avoid 'cloud' or 'remote' at all costs - no matter where the hosting company is located.
- toble 13y ago
  This is more apt advice. At Hacker News we are swimming in a sea of start-ups, who are constantly evangelising the 'cloud' (it's often their bread and butter). But if you genuinely want privacy then keep it local and locked down. Stick to mainstream open source products and keep things as simple as possible.
  - hariis 13y ago
    And what will you do when Feds knock on your door?
    - kybernetyk 13y ago
      At least they need a warrant in that case and you know that there's something going on. Also: You can encrypt the server hard drives.

EnderMB 13y ago

This is probably a stupid comment to make, but when the feds request these passwords what is stopping a firm from giving over a set of tampered passwords? Let's say a request is made for Google give over loads of Gmail passwords. Could they not silently implement an extremely strong password encryption on the affected accounts, and hand over these passwords, knowing that the feds wouldn't be able to crack them without a significant amount of time. Also, are the feds likely to check to see if these passwords are legitimate? If my password was 12345 and Google simply told them that my password was 54321 then how could the feds possibly know that the passwords sent over are real? EDIT: Obviously, I know this is highly illegal, and would land any company in trouble. I'm just wondering whether, theoretically, this is possible for a firm to do to circumvent any action from the feds.

coldtea 13y ago
>Also, are the feds likely to check to see if these passwords are legitimate? If my password was 12345 and Google simply told them that my password was 54321 then how could the feds possibly know that the passwords sent over are real? By them NOT WORKING?
- EnderMB 13y ago
  Well, they're not going to crack a ton of passwords that quickly, and I'm guessing that they're testing against the live server, so if the password doesn't work then surely the most obvious answer is that the password has changed. A lot of people have already stated that one way around this would be to change your password before the feds have had a chance to crack the provided hashes. This would surely be a similar system. Of course, I don't know if this would work at all. I was basically thinking aloud to see if this idea would have some merit.
  - 3825 13y ago
    Google will tell you that you changed your password {0} days ago if you try to log in with the previous password.
13y ago

jgeerts 13y ago

Welcome to the world, this is a webcam, put it on your head so we can watch your every move at all times. What the hell is wrong with the government, is it really their business to interfere with personal life? It's their job to facilitate the community, to find solutions for peoples lives, this is not a solution, they are creating overly complex problems, unnecessary spent money. We need less government, less people there with less money, it seems they have too much of it and way too much time.

nodata 13y ago
That really is the missing piece in the puzzle: what on earth do they need such deep and complete access into everyones' lives for?
- sillysaurus 13y ago
  It's a government. Their natural desire is to govern lives.
- meddlepal 13y ago
  You're asking the wrong question. They don't need this data, but they can acquire it. Why can they? Because nobody has said otherwise. I don't expect a quick resolution to this problem and others. Political philosophy and legal theory have not kept up with technical advancements in society.
deleted 13y ago
[deleted]
jes 13y ago
With respect, I don't think government should be facilitating the community or finding solutions for people's lives, as that quickly becomes a license to violate the rights of some individuals in order to give a benefit to some others.

downandout 13y ago

I'm not sure how beneficial it is to ask for salted password hashes, when a simple change in the wording of the request to a judge (or the FISA court rubber stamp factory) would yield an order for the provider to capture and turn over the plaintext password the next time the user logs in. US judges will do almost anything they are asked, especially if the requesting agency uses the "T" word. Either these agencies don't know what to ask for, or they are already doing this and no one has written a story about it.

pestaa 13y ago
What's the "T" word, please?
- downandout 13y ago
  Terrorism.
  - pestaa 13y ago
    Thanks, obvious in hindsight.

saurabhnanda 13y ago

How does this play with DMCA anti-circumvention provisions?

fexl 13y ago

They're also demanding private SSL keys: http://news.cnet.com/8301-13578_3-57595202-38/feds-put-heat-on-web-firms-for-master-encryption-keys/ http://news.cnet.com/8301-13578_3-57595202-38/feds-put-heat-... In that case they can easily sniff passwords as they are used.

dhimes 13y ago
This is actually the bigger story because it's a smarter way for them to go IMHO.

forgotAgain 13y ago

This strikes me as a very thin story with a lot of filler added. A red flag for me with the article is that the headline uses the word "tell" while quotes from anonymous sources use the word "request". There's nothing wrong with the government asking for access to a user account if they have a legitimate (ie. named) court order. This is the most important story for this country since 9/11. Third rate journalism won't be part of the solution.

jrwoodruff 13y ago
Over-reliance on anonymous sources is always a red flag for me. His main sources are "...one internet industry source" and "...a person who has worked at a large Silicon Valley Company." That's about as vague and unverifiable as you can get for the foundation of a story like this.
dhimes 13y ago
For the general public this type of article works well. The filler is useful because a lot of people are coming to the issue for the first time. Hopefully NBC &c. will also fill in pertinent background information as they bring their audiences up to speed.
ChikkaChiChi 13y ago
I'm well aware of Journalism's yellow history, I feel like things have devolved quickly and depressingly in the era of the blog and the pageview/story break Twitter one-upsmanship that exists today.
bpatrianakos 13y ago
It's so frustrating to see the vast majority of comments here take this seriously. Thank you for having the guts to call it like it is.
film42 13y ago
There's been a few articles like this recently. The problem is, it's so easy to flip a world like "request" to "tell", or drum up a government looking document asking for xyz. There's just no way to determine the validity of this stuff.

deleted 13y ago

[deleted]

hawleyal 13y ago

I don't store plaintext passwords. Nor should anyone else. Only a hash and salt.

stan_rogers 13y ago
Hash, salt and algorithm. That will allow you to upgrade the algorithm or work factor as your server becomes more capable (or if a deficiency in the algorithm you're using is identified), authenticate the user under the old system and re-hash on the fly, all seamlessly to the user. (If you're depending on the algorithm being a "secret sauce", you're doing it wrong.)

8654395 13y ago

Throwaway account just to post this. Of course the Feds will have access to whatever they deem necessary even if it takes them time to get the pieces in place. It's the users who ultimately lose the most. I'm learning the hard way just how much the user is the one ultimately screwed when it comes to account access. My father just recently died very unexpectedly and tragically. He was generally retired but still doing a dozen or so small tech consulting projects here and there and using his personal accounts on Gmail/Facebook/etc. for everything. Facebook simply will not give any family member access to a deceased person's account. Google will consider it after you fill out a form and send them a bunch of documentation. Then they will consider and may possibly end up sending you off to get a court order and the like, but you're entirely subject to their own decision about whether you can get access to your deceased family member's main form of personal and business communication. You do not own your Gmail account, regardless of the shit they spout about you being able to download your data using takeout. If your estate can't get "your" data, you didn't really own it. Yes, I know there are steps that could have been taken to have given access to others on the event of one's death, but realistically what percentage of Gmail/Facebook users have taken those steps? And why should those accounts be different from normal digital accounts like bank accounts where a standard court estate document is enough?

Karunamon 13y ago
>Then they will consider and may possibly end up sending you off to get a court order and the like, So you expect them to accept any old paper that looks like a court order without a vetting and verification process? >If your estate can't get "your" data, you didn't really own it. If you can't legally prove that you are part of "your" estate, then you're SOL. And getting anything done legally takes time. Sometimes lots of it.
- 8654395 13y ago
  I never said I expected them to accept a court order without verification. Simply that there should not be discretion on their part if proper estate documents are presented. They have made it clear that they have discretion, so the account itself it not actually considered part of the estate by Google.

diminoten 13y ago

Why do web firms have my passwords in the first place?

deleted 13y ago

[deleted]