4 ms·

T-Mobile USA storing passwords in clear?

81 points by ewindisch 12y ago

r00fus 12y ago
Note: This doesn't apply to their phone plan, just their mobile data only plans for iPads/tablets. I couldn't reproduce this issue for my phone plan as it uses a different management site.
dangrossman 12y ago
Sending, not storing. Not much better, but you don't know whether it's encrypted at rest without actually getting into the code.
- akerl_ 12y ago
  It doesn't much matter, given that their frontend either has the means to decrypt the passwords or plaintext passwords are decrypted behind it and passed through it. The problem is plaintext passwords existing on their systems; encrypting doesn't solve that.
  - sillysaurus3 12y ago
    Insightful comment from Thomas on this topic: https://news.ycombinator.com/item?id=2582344 https://news.ycombinator.com/item?id=2582344 When we're talking about passwords stored "encrypted" on customer-exposed applications, I agree. When we're talking about passwords "vaulted" in non-exposed systems used for customer support, I have a harder time getting upset about it. I don't like systems that work this way, but I see the support/security tradeoff and it's a valid one. It is likely but not certain that the site in question here did not go through the trouble of setting up a non-exposed secure password vault system for customer support people to use under supervision. Probably they do just store passwords in a column somewhere. But you don't know for sure whether they do.
    - akerl_ 12y ago
      I agree with the quoted segment, except that in this case they're sending back plaintext to users. As such, even if the passwords are being "vaulted", the plaintext passes back through the customer-exposed systems.
      - mikeryan 12y ago
        Alternatively however they're sending password reset links in plaintext to users. Either way if the communication chain is compromised so is the user's security.
        akerl_ 12y ago
        No; compromising the password reset URL lets an attacker change my password for that service. It leaves a clear audit trace on my end (the email) and it doesn't grant them my plaintext password (way too many people reuse passwords, so a plaintext password is likely to be reusable). If I didn't request the reset myself, the email alerts me to mischief. If I did, and they use the URL before me, the fact that the URL doesn't work when I use it alerts me.
sp332 12y ago
Yeah, it was reported to plaintextoffenders.com back in 2011 http://plaintextoffenders.com/post/11763953868/t-mobile-com-sends-your-full-plain-text-password http://plaintextoffenders.com/post/11763953868/t-mobile-com-...
- omervk 12y ago
  I'm one of the founders of plaintextoffenders.com and just came in to point that out myself. So happy you beat me to it ;)
  - sp332 12y ago
    Hey, is there an easy way to search that site?
    - omervk 12y ago
      Unfortunately, since Tumblr's search is completely broken, I would recommend searching for the domain name on Google with the modifier "site:plaintextoffenders.com". For instance, to search for the site something.com, google "something site:plaintextoffenders.com" (sans quotes). I usually remove the TLD because many sites use lots of different TLDs (which we try to find when posting).
rwmj 12y ago
Virgin UK stores and sends the password in the clear. (Evidence: Whenever I call them on the phone, I have to read out my password, which is the same as the one you use to log in through the website). TBH I'm not especially bothered by this.
- dublinben 12y ago
  It's entirely possible that the phone representative is entering your password into their system, which then checks it against the stored hash.
  - jerf 12y ago
    Try reading your password to somebody else and getting them to enter it correctly. Unless your password is terrible, you should find that you can tell the difference between them verifying a text field vs. entering it into the system pretty easily.
    - JoshTriplett 12y ago
      Yeah. I always use random passwords for the answers to "security questions", and it's fascinating to read them off over the phone. It's obvious that they're stored in the clear, because they don't care about (for instance) case or spacing.
      - icebraining 12y ago
        The system could normalize the password (convert to upper/lowercare, remove spaces) before hashing it. It'd be dumb, but not as bad as storing in plain text. I don't find that likely, though.
        streptomycin 12y ago
        Amazon used to do it: http://www.wired.com/2011/01/amazon-password-problem/ http://www.wired.com/2011/01/amazon-password-problem/
bahman2000 12y ago
FTA: "So, now I’ll just give my money to Verizon, since I can’t give it to T-Mobile." This, in the USA, normally comes at the cost of getting a Verizon-compatible device.
- dmdeller 12y ago
  The Verizon versions of iPad Air, iPad Retina Mini, iPhone 5S and iPhone 5C are identical to those sold for AT&T and T-Mobile, and will work on any of those three networks[1]. (It's different/more complicated for older devices.) Also, an agreement Verizon signed when buying their LTE spectrum from the FCC says that all Verizon LTE devices must be carrier-unlocked out of the box[2]. However, Verizon will refuse to activate any device that was not originally sold for use on its network (they use a unique device hardware ID for this). AT&T and T-Mobile don't do this. Therefore, for maximum flexibility, buy Verizon versions of recent Apple devices. You can then switch to AT&T or T-Mobile (not Sprint), or back again to Verizon, at any time, as many times as you wish. This is what the author did[3]. [1]: http://www.apple.com/iphone/LTE/ http://www.apple.com/iphone/LTE/ [2]: https://en.wikipedia.org/wiki/United_States_2008_wireless_spectrum_auction#Google_involvement https://en.wikipedia.org/wiki/United_States_2008_wireless_sp... [3]: http://www.caseyliss.com/2014/5/21/tmo-vs-vzw-plans http://www.caseyliss.com/2014/5/21/tmo-vs-vzw-plans
  - justin66 12y ago
    > Also, an agreement Verizon signed when buying their LTE spectrum from the FCC says that all Verizon LTE devices must be carrier-unlocked out of the box[2]. > However, Verizon will refuse to activate any device that was not originally sold for use on its network (they use a unique device hardware ID for this). Which is a violation of those FCC rules you linked to. It's monopolistic, shitty behavior. > AT&T and T-Mobile don't do this. > Therefore, for maximum flexibility, buy Verizon versions of recent Apple devices. Or just avoid Verizon entirely. That way you won't be rewarding their bad behavior.
- peterwwillis 12y ago
  Yeah, I don't get why people use the big-name providers unless they have a family plan. Prepaid services like Net10, Straight Talk, Cricket, Metro PCS, Boost, H2O, Jolt, Redpocket, etc are less than half the cost of the bigger ILECs/CLECs and most of them are or have GSM offerings. I like that Net10 and Straight Talk give you T-mobile or AT&T sims to bring over locked phones. My personal favorite combo at the moment is Straight Talk's "Unlimited" 30 day service for $45, combined with an AT&T Radiant pre-paid phone ($70 cash). This phone is the same specs as a new Moto-E smartphone but for half the price. (I find it hilarious that I can lose or break my phone 7 times and still pay less than for one iPhone 5)
mellowfish 12y ago
Being able to send passwords back over email and/or view them as an admin does not mean they are stored in the DB in the clear. It is a fairly common practice to strongly encrypt passwords in the DB and decrypt them when it is necessary for admin personnel to be able to use them.
- jerf 12y ago
  For practical purposes, that counts as "in the clear". Password should not be encrypted, they should be irreversibly hashed. (Preferably with bcrypt or scrypt or something meant for this use case; in this case I mean "hash" just in the technical sense of "irreversible", not that any ol' hash function is fine.)
  - mellowfish 12y ago
    For login purposes, it is indeed good to use hashes, this prevents timing attacks and the like. But I fail to see the harm in keeping encrypted passwords for admin purposes. It is very helpful in certain situations.
    - dmdeller 12y ago
      Where do you keep the decryption key? If it's stored in the same place as the encrypted password, then you have gained no security over storing it in plain text. If it's stored in a separate system, then you have substantially increased the complexity of the system, and in general, a more complex system is harder to implement securely.
    - riquito 12y ago
      If the server is hacked, the attacker can decrypt everything. Your users are going to have a lot of problems, and you'll have lost (rightfully) their faith in your service.
    - codesuela 12y ago
      Even if only the database is compromised it is still worth trying to find the key to decrypt all passwords whereas cracking a salted 10000 rounds of scypt or bcrypt hash is just not feasible unless you're the NSA on the hunt for Edward Snowden
depsypher 12y ago
Was there actually a password requirement change? Entering the first 15 chars of my (previously set) longer password actually works. I assumed they were not properly validating (and truncating) the input. In any case this is not confidence inspiring.

81 points by ewindisch 12y ago

Note: This doesn't apply to their phone plan, just their mobile data only plans for iPads/tablets. I couldn't reproduce this issue for my phone plan as it uses a different management site.

dangrossman 12y ago

Sending, not storing. Not much better, but you don't know whether it's encrypted at rest without actually getting into the code.

akerl_ 12y ago
It doesn't much matter, given that their frontend either has the means to decrypt the passwords or plaintext passwords are decrypted behind it and passed through it. The problem is plaintext passwords existing on their systems; encrypting doesn't solve that.
- sillysaurus3 12y ago
  Insightful comment from Thomas on this topic: https://news.ycombinator.com/item?id=2582344 https://news.ycombinator.com/item?id=2582344 When we're talking about passwords stored "encrypted" on customer-exposed applications, I agree. When we're talking about passwords "vaulted" in non-exposed systems used for customer support, I have a harder time getting upset about it. I don't like systems that work this way, but I see the support/security tradeoff and it's a valid one. It is likely but not certain that the site in question here did not go through the trouble of setting up a non-exposed secure password vault system for customer support people to use under supervision. Probably they do just store passwords in a column somewhere. But you don't know for sure whether they do.
  - akerl_ 12y ago
    I agree with the quoted segment, except that in this case they're sending back plaintext to users. As such, even if the passwords are being "vaulted", the plaintext passes back through the customer-exposed systems.
    - mikeryan 12y ago
      Alternatively however they're sending password reset links in plaintext to users. Either way if the communication chain is compromised so is the user's security.
      - akerl_ 12y ago
        No; compromising the password reset URL lets an attacker change my password for that service. It leaves a clear audit trace on my end (the email) and it doesn't grant them my plaintext password (way too many people reuse passwords, so a plaintext password is likely to be reusable). If I didn't request the reset myself, the email alerts me to mischief. If I did, and they use the URL before me, the fact that the URL doesn't work when I use it alerts me.

sp332 12y ago

Yeah, it was reported to plaintextoffenders.com back in 2011 http://plaintextoffenders.com/post/11763953868/t-mobile-com-sends-your-full-plain-text-password http://plaintextoffenders.com/post/11763953868/t-mobile-com-...

omervk 12y ago
I'm one of the founders of plaintextoffenders.com and just came in to point that out myself. So happy you beat me to it ;)
- sp332 12y ago
  Hey, is there an easy way to search that site?
  - omervk 12y ago
    Unfortunately, since Tumblr's search is completely broken, I would recommend searching for the domain name on Google with the modifier "site:plaintextoffenders.com". For instance, to search for the site something.com, google "something site:plaintextoffenders.com" (sans quotes). I usually remove the TLD because many sites use lots of different TLDs (which we try to find when posting).

rwmj 12y ago

Virgin UK stores and sends the password in the clear. (Evidence: Whenever I call them on the phone, I have to read out my password, which is the same as the one you use to log in through the website). TBH I'm not especially bothered by this.

dublinben 12y ago
It's entirely possible that the phone representative is entering your password into their system, which then checks it against the stored hash.
- jerf 12y ago
  Try reading your password to somebody else and getting them to enter it correctly. Unless your password is terrible, you should find that you can tell the difference between them verifying a text field vs. entering it into the system pretty easily.
  - JoshTriplett 12y ago
    Yeah. I always use random passwords for the answers to "security questions", and it's fascinating to read them off over the phone. It's obvious that they're stored in the clear, because they don't care about (for instance) case or spacing.
    - icebraining 12y ago
      The system could normalize the password (convert to upper/lowercare, remove spaces) before hashing it. It'd be dumb, but not as bad as storing in plain text. I don't find that likely, though.
      - streptomycin 12y ago
        Amazon used to do it: http://www.wired.com/2011/01/amazon-password-problem/ http://www.wired.com/2011/01/amazon-password-problem/

bahman2000 12y ago

FTA: "So, now I’ll just give my money to Verizon, since I can’t give it to T-Mobile." This, in the USA, normally comes at the cost of getting a Verizon-compatible device.

dmdeller 12y ago
The Verizon versions of iPad Air, iPad Retina Mini, iPhone 5S and iPhone 5C are identical to those sold for AT&T and T-Mobile, and will work on any of those three networks[1]. (It's different/more complicated for older devices.) Also, an agreement Verizon signed when buying their LTE spectrum from the FCC says that all Verizon LTE devices must be carrier-unlocked out of the box[2]. However, Verizon will refuse to activate any device that was not originally sold for use on its network (they use a unique device hardware ID for this). AT&T and T-Mobile don't do this. Therefore, for maximum flexibility, buy Verizon versions of recent Apple devices. You can then switch to AT&T or T-Mobile (not Sprint), or back again to Verizon, at any time, as many times as you wish. This is what the author did[3]. [1]: http://www.apple.com/iphone/LTE/ http://www.apple.com/iphone/LTE/ [2]: https://en.wikipedia.org/wiki/United_States_2008_wireless_spectrum_auction#Google_involvement https://en.wikipedia.org/wiki/United_States_2008_wireless_sp... [3]: http://www.caseyliss.com/2014/5/21/tmo-vs-vzw-plans http://www.caseyliss.com/2014/5/21/tmo-vs-vzw-plans
- justin66 12y ago
  > Also, an agreement Verizon signed when buying their LTE spectrum from the FCC says that all Verizon LTE devices must be carrier-unlocked out of the box[2]. > However, Verizon will refuse to activate any device that was not originally sold for use on its network (they use a unique device hardware ID for this). Which is a violation of those FCC rules you linked to. It's monopolistic, shitty behavior. > AT&T and T-Mobile don't do this. > Therefore, for maximum flexibility, buy Verizon versions of recent Apple devices. Or just avoid Verizon entirely. That way you won't be rewarding their bad behavior.
peterwwillis 12y ago
Yeah, I don't get why people use the big-name providers unless they have a family plan. Prepaid services like Net10, Straight Talk, Cricket, Metro PCS, Boost, H2O, Jolt, Redpocket, etc are less than half the cost of the bigger ILECs/CLECs and most of them are or have GSM offerings. I like that Net10 and Straight Talk give you T-mobile or AT&T sims to bring over locked phones. My personal favorite combo at the moment is Straight Talk's "Unlimited" 30 day service for $45, combined with an AT&T Radiant pre-paid phone ($70 cash). This phone is the same specs as a new Moto-E smartphone but for half the price. (I find it hilarious that I can lose or break my phone 7 times and still pay less than for one iPhone 5)

mellowfish 12y ago

Being able to send passwords back over email and/or view them as an admin does not mean they are stored in the DB in the clear. It is a fairly common practice to strongly encrypt passwords in the DB and decrypt them when it is necessary for admin personnel to be able to use them.

jerf 12y ago
For practical purposes, that counts as "in the clear". Password should not be encrypted, they should be irreversibly hashed. (Preferably with bcrypt or scrypt or something meant for this use case; in this case I mean "hash" just in the technical sense of "irreversible", not that any ol' hash function is fine.)
- mellowfish 12y ago
  For login purposes, it is indeed good to use hashes, this prevents timing attacks and the like. But I fail to see the harm in keeping encrypted passwords for admin purposes. It is very helpful in certain situations.
  - dmdeller 12y ago
    Where do you keep the decryption key? If it's stored in the same place as the encrypted password, then you have gained no security over storing it in plain text. If it's stored in a separate system, then you have substantially increased the complexity of the system, and in general, a more complex system is harder to implement securely.
  - riquito 12y ago
    If the server is hacked, the attacker can decrypt everything. Your users are going to have a lot of problems, and you'll have lost (rightfully) their faith in your service.
  - codesuela 12y ago
    Even if only the database is compromised it is still worth trying to find the key to decrypt all passwords whereas cracking a salted 10000 rounds of scypt or bcrypt hash is just not feasible unless you're the NSA on the hunt for Edward Snowden

depsypher 12y ago

Was there actually a password requirement change? Entering the first 15 chars of my (previously set) longer password actually works. I assumed they were not properly validating (and truncating) the input. In any case this is not confidence inspiring.