9 ms·
"The answer" doesn't exist and it never will. Everyone has to do their part. Services that store passwords in plaintext should definitely be publicly shamed, ev
by fauigerzigerk 13y ago
"The answer" doesn't exist and it never will. Everyone has to do their part. Services that store passwords in plaintext should definitely be publicly shamed, every single time.
- jiggy2011 13y agoThe problem is that "publicly shamed" means "shamed amongst security geeks". Most websites main demographic is not security geeks.
- fauigerzigerk 13y agoIt means being shamed among tech professionals and that's exactly the community in which those responsible for the disaster have to spend the rest of their professional lives. Peer pressure is very effective.
- jiggy2011 13y agoWe don't even know specifically who is responsible for this particular thing, as I've mentioned in other comments it's likely this came from some non tech person anyway.
- Cthulhu_ 13y agoI dunno, things like this make their way to more mainstream media too, making "the general public" more conscious of security, and making them wonder whether their passwords will be secure at parties they leave them at.
- ZoFreX 13y agoThe spin in mainstream media always puts the blame squarely on the hackers, and in my anecdotal experience typical users have no interest in the argument that the companies that were hacked are to blame.
- alephnil 13y agoBecause most people have not even thought of the possibility that password can be stored in anything but plaintext, and take it as granted that all websites do. Thus the websites can't possibly be blamed, and the hackers must be the bad guys.
- a1a 13y agoNot necessarily. If a relatively mainstream news site reported the event and quoted a security professional saying: "Website X didn't even try to keep your love life and dating profile a secret. Every single user's password is now publicly available. If you use the same password on multiple sites, be sure to change it quickly!" I think even the most non-tech people would react to such a news story.
- jiggy2011 13y agoThe adobe breach was fairly widely reported, but how many designers have sworn off adobe products? The same thing could be said about Linkedin or Microsoft products in the 90s.
- Bluestrike2 13y agoTrue, but I think this is one of those instances where you kind of have to take what you can get in terms of negative PR for Cupid Media and other companies that store passwords stupidly.
- thatthatis 13y agoA browser plugin that pre-hashes anything in a hidden text field (with a user secret key and the password origination domain) could mimic this as a layer on top of existing technology. It would have the obvious portability issues, and I'm sure other implementation issues.
- raverbashing 13y agowell, you could even do it manually echo 'this is my pass' | shasum 3b0c5dc943cd30dcd2ca1ff760145f219d3ba3f3 And use that as the password. Of course, this is a very basic example, you should make it more safer by adding a salt and running more iterations. May be easier (and safer) than installing "One password" kind of software.
- thatthatis 13y agoThat doesn't quite work in the unfortunately common case of user password re-use. If your hash is constant and stored in plain text somewhere and that place gets hacked -- then your password at every site is compromised.
- mazesc 13y agoecho "this is my pass for $URL" | shasum
- raverbashing 13y agoYes, you need to add a salt, it can be the URL (and something else added)
- Jach 13y agoIf you use an actual bash script instead of a one-liner, and you can do things like 'silently' read in the password with `read -s` in the standard *nix convention, even read it twice to avoid mistyping your master key and temporarily locking yourself out of an account you just created.
- 13y ago
- jorgem 13y agoI propose a scarlet letter "P" (for plaintext).