4 ms·

Sending, not storing. Not much better, but you don't know whether it's encrypted at rest without actually getting into the code.

akerl_ 12y ago
It doesn't much matter, given that their frontend either has the means to decrypt the passwords or plaintext passwords are decrypted behind it and passed through it. The problem is plaintext passwords existing on their systems; encrypting doesn't solve that.
- sillysaurus3 12y ago
  Insightful comment from Thomas on this topic: https://news.ycombinator.com/item?id=2582344 https://news.ycombinator.com/item?id=2582344 When we're talking about passwords stored "encrypted" on customer-exposed applications, I agree. When we're talking about passwords "vaulted" in non-exposed systems used for customer support, I have a harder time getting upset about it. I don't like systems that work this way, but I see the support/security tradeoff and it's a valid one. It is likely but not certain that the site in question here did not go through the trouble of setting up a non-exposed secure password vault system for customer support people to use under supervision. Probably they do just store passwords in a column somewhere. But you don't know for sure whether they do.
  - akerl_ 12y ago
    I agree with the quoted segment, except that in this case they're sending back plaintext to users. As such, even if the passwords are being "vaulted", the plaintext passes back through the customer-exposed systems.
    - mikeryan 12y ago
      Alternatively however they're sending password reset links in plaintext to users. Either way if the communication chain is compromised so is the user's security.
      - akerl_ 12y ago
        No; compromising the password reset URL lets an attacker change my password for that service. It leaves a clear audit trace on my end (the email) and it doesn't grant them my plaintext password (way too many people reuse passwords, so a plaintext password is likely to be reusable). If I didn't request the reset myself, the email alerts me to mischief. If I did, and they use the URL before me, the fact that the URL doesn't work when I use it alerts me.

akerl_ 12y ago

It doesn't much matter, given that their frontend either has the means to decrypt the passwords or plaintext passwords are decrypted behind it and passed through it. The problem is plaintext passwords existing on their systems; encrypting doesn't solve that.

sillysaurus3 12y ago
Insightful comment from Thomas on this topic: https://news.ycombinator.com/item?id=2582344 https://news.ycombinator.com/item?id=2582344 When we're talking about passwords stored "encrypted" on customer-exposed applications, I agree. When we're talking about passwords "vaulted" in non-exposed systems used for customer support, I have a harder time getting upset about it. I don't like systems that work this way, but I see the support/security tradeoff and it's a valid one. It is likely but not certain that the site in question here did not go through the trouble of setting up a non-exposed secure password vault system for customer support people to use under supervision. Probably they do just store passwords in a column somewhere. But you don't know for sure whether they do.
- akerl_ 12y ago
  I agree with the quoted segment, except that in this case they're sending back plaintext to users. As such, even if the passwords are being "vaulted", the plaintext passes back through the customer-exposed systems.
  - mikeryan 12y ago
    Alternatively however they're sending password reset links in plaintext to users. Either way if the communication chain is compromised so is the user's security.
    - akerl_ 12y ago
      No; compromising the password reset URL lets an attacker change my password for that service. It leaves a clear audit trace on my end (the email) and it doesn't grant them my plaintext password (way too many people reuse passwords, so a plaintext password is likely to be reusable). If I didn't request the reset myself, the email alerts me to mischief. If I did, and they use the URL before me, the fact that the URL doesn't work when I use it alerts me.