4 ms·

I think the point is that while it does matter in some ways, it doesn't matter for security issues Lavabit claimed it addressed. Think of a site that says your

I think the point is that while it does matter in some ways, it doesn't matter for security issues Lavabit claimed it addressed. Think of a site that says your password is secure. When you call them on it, they say "well, we do store your passwords in plaintext, but we use SSL to transfer them."

Dylan16807 13y ago
I don't understand your analogy. 100%* of sites with passwords use the same method, transmitting the plain text to the server where it is hashed and discarded. Do you want 0%* of sites to claim that passwords are secure, even if they use a well-configured bcrypt and follow best practices? *rounded to the nearest percent
- hyperpape 13y ago
  I meant SSL. Edited for clarity.
- gknoy 13y ago
  It's a difference in who you care about it being secure from, and what it is you're trying to protect. SSL is enough (I think?) to prevent a random attacker from snooping your traffic to get your _credentials_. However, now imagine a judge gives them a subpoena saying, "We need Dylan's password. You receive it in plaintext over a secure tunnel, and you must give it to us." There's no wiggle room for that kind of request, and then a court-backed attacker would be able to do things like use your password as evidence, and probably even use it to try to gain access to other things of yours. A way to prevent a court-ordered harvesting of your credentials would be for the service to have your public key, and require you to cryptographically sign something as part of the login process: Your secret stays secret on your end. Back to what you are trying to protect. There are many things that can be secure, and from different types of attackers. We would ideally like to be able to keep our credentials (keys, passwords) secure from attackers both black-hat and police-hat, and we would like to also be able to keep the contents of our communications secret from those same entities. Most services safeguard your credentials against everyone except the court, and try to only protect your data similarly.
  - Dylan16807 13y ago
    Well I would deal with that problem in an entirely different way. Courts should not have the power to compel either party in a private communication to keep records of what was said/transmitted.
- betterunix 13y ago
  "Do you want 0%* of sites to claim that passwords are secure, even if they use a well-configured bcrypt and follow best practices?" Yes, because passwords are insecure even if you follow "best practices." Here is a straightforward attack: http://www.businessinsider.com/how-mark-zuckerberg-hacked-into-the-harvard-crimson-2010-3 http://www.businessinsider.com/how-mark-zuckerberg-hacked-in...
  - Dylan16807 13y ago
    Uhh, I don't think best practices include logging the passwords people try to login with.
    - betterunix 13y ago
      You are missing the point. It makes no difference if your website is following best practices if your users enter their passwords on a website that fails to do so. Maybe your users are using the same passwords in many places. Maybe they accidentally entered the password for one website when trying to log in to another because their username is the same.

Dylan16807 13y ago

I don't understand your analogy. 100%* of sites with passwords use the same method, transmitting the plain text to the server where it is hashed and discarded. Do you want 0%* of sites to claim that passwords are secure, even if they use a well-configured bcrypt and follow best practices? *rounded to the nearest percent

hyperpape 13y ago
I meant SSL. Edited for clarity.
gknoy 13y ago
It's a difference in who you care about it being secure from, and what it is you're trying to protect. SSL is enough (I think?) to prevent a random attacker from snooping your traffic to get your _credentials_. However, now imagine a judge gives them a subpoena saying, "We need Dylan's password. You receive it in plaintext over a secure tunnel, and you must give it to us." There's no wiggle room for that kind of request, and then a court-backed attacker would be able to do things like use your password as evidence, and probably even use it to try to gain access to other things of yours. A way to prevent a court-ordered harvesting of your credentials would be for the service to have your public key, and require you to cryptographically sign something as part of the login process: Your secret stays secret on your end. Back to what you are trying to protect. There are many things that can be secure, and from different types of attackers. We would ideally like to be able to keep our credentials (keys, passwords) secure from attackers both black-hat and police-hat, and we would like to also be able to keep the contents of our communications secret from those same entities. Most services safeguard your credentials against everyone except the court, and try to only protect your data similarly.
- Dylan16807 13y ago
  Well I would deal with that problem in an entirely different way. Courts should not have the power to compel either party in a private communication to keep records of what was said/transmitted.
betterunix 13y ago
"Do you want 0%* of sites to claim that passwords are secure, even if they use a well-configured bcrypt and follow best practices?" Yes, because passwords are insecure even if you follow "best practices." Here is a straightforward attack: http://www.businessinsider.com/how-mark-zuckerberg-hacked-into-the-harvard-crimson-2010-3 http://www.businessinsider.com/how-mark-zuckerberg-hacked-in...
- Dylan16807 13y ago
  Uhh, I don't think best practices include logging the passwords people try to login with.
  - betterunix 13y ago
    You are missing the point. It makes no difference if your website is following best practices if your users enter their passwords on a website that fails to do so. Maybe your users are using the same passwords in many places. Maybe they accidentally entered the password for one website when trying to log in to another because their username is the same.