3 ms·

Being able to send passwords back over email and/or view them as an admin does not mean they are stored in the DB in the clear. It is a fairly common practice t

Being able to send passwords back over email and/or view them as an admin does not mean they are stored in the DB in the clear. It is a fairly common practice to strongly encrypt passwords in the DB and decrypt them when it is necessary for admin personnel to be able to use them.

jerf 12y ago
For practical purposes, that counts as "in the clear". Password should not be encrypted, they should be irreversibly hashed. (Preferably with bcrypt or scrypt or something meant for this use case; in this case I mean "hash" just in the technical sense of "irreversible", not that any ol' hash function is fine.)
- mellowfish 12y ago
  For login purposes, it is indeed good to use hashes, this prevents timing attacks and the like. But I fail to see the harm in keeping encrypted passwords for admin purposes. It is very helpful in certain situations.
  - dmdeller 12y ago
    Where do you keep the decryption key? If it's stored in the same place as the encrypted password, then you have gained no security over storing it in plain text. If it's stored in a separate system, then you have substantially increased the complexity of the system, and in general, a more complex system is harder to implement securely.
  - riquito 12y ago
    If the server is hacked, the attacker can decrypt everything. Your users are going to have a lot of problems, and you'll have lost (rightfully) their faith in your service.
  - codesuela 12y ago
    Even if only the database is compromised it is still worth trying to find the key to decrypt all passwords whereas cracking a salted 10000 rounds of scypt or bcrypt hash is just not feasible unless you're the NSA on the hunt for Edward Snowden
  - jerf 12y ago
    Even stipulating perfectly correct use of encryption libraries to encrypt passwords (which is, in practice, an enormous stipulation on its own), there is a significant correlation between having enough access to obtain encrypted passwords, and having enough access to obtain the decryption keys and routines. Yes, there are breaks where the hacker can only get one or the other, but that's such a tenuous "security measure" that it's hardly worthy of the term.
krapp 12y ago
I think it should never be possible for admin personnel to access a users' plain password, much less necessary. Given that you're an admin anyway, you don't need the extra privileges, and there are already established methods for dealing with resetting and recovering accounts without having to decrypt a password.
akerl_ 12y ago
If it's ever "necessary" for an employee to decrypt and use my password, something very wrong is happening. That is not acceptable practice.
- seandougall 12y ago
  Yeah, most companies worth their salt (so to speak) make a point of saying their employees will never ask for your password. That not only frees them up to do the right thing with password hashing, but gives users a clear red flag when scammers call.
anExcitedBeast 12y ago
No, no, a thousand times no. Passwords should never be stored in a reversible format. Your users get shafted if you get hacked (more like 'when', these days). Here's a guide to handling passwords properly: https://crackstation.net/hashing-security.htm https://crackstation.net/hashing-security.htm

jerf 12y ago

For practical purposes, that counts as "in the clear". Password should not be encrypted, they should be irreversibly hashed. (Preferably with bcrypt or scrypt or something meant for this use case; in this case I mean "hash" just in the technical sense of "irreversible", not that any ol' hash function is fine.)

mellowfish 12y ago
For login purposes, it is indeed good to use hashes, this prevents timing attacks and the like. But I fail to see the harm in keeping encrypted passwords for admin purposes. It is very helpful in certain situations.
- dmdeller 12y ago
  Where do you keep the decryption key? If it's stored in the same place as the encrypted password, then you have gained no security over storing it in plain text. If it's stored in a separate system, then you have substantially increased the complexity of the system, and in general, a more complex system is harder to implement securely.
- riquito 12y ago
  If the server is hacked, the attacker can decrypt everything. Your users are going to have a lot of problems, and you'll have lost (rightfully) their faith in your service.
- codesuela 12y ago
  Even if only the database is compromised it is still worth trying to find the key to decrypt all passwords whereas cracking a salted 10000 rounds of scypt or bcrypt hash is just not feasible unless you're the NSA on the hunt for Edward Snowden
- jerf 12y ago
  Even stipulating perfectly correct use of encryption libraries to encrypt passwords (which is, in practice, an enormous stipulation on its own), there is a significant correlation between having enough access to obtain encrypted passwords, and having enough access to obtain the decryption keys and routines. Yes, there are breaks where the hacker can only get one or the other, but that's such a tenuous "security measure" that it's hardly worthy of the term.

krapp 12y ago

I think it should never be possible for admin personnel to access a users' plain password, much less necessary. Given that you're an admin anyway, you don't need the extra privileges, and there are already established methods for dealing with resetting and recovering accounts without having to decrypt a password.

akerl_ 12y ago

If it's ever "necessary" for an employee to decrypt and use my password, something very wrong is happening. That is not acceptable practice.

seandougall 12y ago
Yeah, most companies worth their salt (so to speak) make a point of saying their employees will never ask for your password. That not only frees them up to do the right thing with password hashing, but gives users a clear red flag when scammers call.

anExcitedBeast 12y ago

No, no, a thousand times no. Passwords should never be stored in a reversible format. Your users get shafted if you get hacked (more like 'when', these days). Here's a guide to handling passwords properly: https://crackstation.net/hashing-security.htm https://crackstation.net/hashing-security.htm