6 ms·

UK government's password checker sends plaintext password in the URL over HTTP

226 points by markhemmings 12y ago

PeekPoke 12y ago
Jesus wept....
facorreia 12y ago
This is appalling and inexcusable for a site who claims to help improve security and that claims to have in the team people such as "a foremost expert on information security awareness"[1]. So this cannot be attributed to ignorance. [1] https://www.getsafeonline.org/about-us/ https://www.getsafeonline.org/about-us/
- stuaxo 12y ago
  It was probably outsourced to accenture or similar who then paid the cheapest devs they could find in india.
opendais 12y ago
Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and should fix it? EDIT: Tried to contact them, got a "The form you submitted contained the following errors Missing Data.(DIFFERENT_IP)" error which has nothing to do with the form I submitted. XD Could someone contact them by their contact us page to get this fixed?
- ZoFreX 12y ago
  > Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel. There are adverts everywhere about it with obvious government endorsement. It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a little mistake" it's "who are you to tell people what is, or isn't, secure when you can't even manage the basics?"
  - opendais 12y ago
    I'm not from the UK and I never believe anything a company puts on its about us page. ;) If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are. Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page.
    - Tyrannosaurs 12y ago
      > Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page. That's genius because scammers would never say something like that because that would be lying and people don't lie because it's naughty.
      - opendais 12y ago
        I read that and concluded they meant "Do not use a real password on this site"
    - crashandburn4 12y ago
      > Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. I'd agree but I don't think anyone who reads hacker news is likely to use a password checker anyway. We all, however, know less technical people who could and would get compromised by something like this and to have it endorsed by the government sends the message that it is safe. That's the problem as far as I'm concerned.
    - daveslash 12y ago
      I give this site to people so they can check the strength of their twitter password. I think it get's the point across. http://www.ismytwitterpasswordsecure.com http://www.ismytwitterpasswordsecure.com
  - santosha 12y ago
- gtirloni 12y ago
  Just sent an email to their WHOIS contacts.
  - Torn 12y ago
    They're on twitter too @GetSafeOnline
- knotty66 12y ago
  Even over HTTPS it wouldn't be secure. The password is in the URL so would be stored in the users browser history, and possibly also web-server logs and sent as referrer headers with assets on the secured page.
- madaxe_again 12y ago
  It IS "UK Government" - it's a QUANGO, so they can keep it at arms length and wash their hands of it, but be under no illusions, this is a government led initiative for which they ultimately, if not in practice, bear responsibility. The cynic in me says that this is a deliberate effort to grab as many passwords as possible. It sounds outlandish, but what actions of our rogue agencies haven't been?
  - gtirloni 12y ago
    That would be a waste of resources given the chances of a real criminal testing his/her password strength on a government-operated website are very remote. Even then, they would have to invest in marketing to get people to actually use it when, we all know now, the GHCQ/NSA can simply collect everything at critical infrastructure points. This looks like a good idea, poorly executed.
    - madaxe_again 12y ago
      You think they're after "real criminals"? Tell me, what is this "real criminal" of what you speak? Is it someone who disagrees with the edicts of the state? Is it someone who has the wrong skin colour? Occam's razor says you're right, but while they're busy accusing us all of criminal acts, we may as well do the same.
- Alupis 12y ago
  This is the same government that thought they could "block all porn" on the internet?
- cs02rm0 12y ago
  True, ish, they are very much involved. https://www.cyberstreetwise.com https://www.cyberstreetwise.com is the website UK government used to get people to send them their passwords.
  - coriny 12y ago
    So this may be a coincidence, but I just followed that link and got a warning from malwarebytes about a malicious website trying to connect to my computer. I've tried a couple more times and not got it again. Anyone else see anything? EDIT: The IP address reported by MalwareBytes is blocked, but I still don't know if it was just coincidence that the warning popped up a second or two after clicking that link. If anyone else experiences anything similar let me know. Still it seems to me that this would be an awesome site to use as a watering hole for ensnaring naive web users, i.e. the kind who won't even notice when they are massively infected.
- tyho 12y ago
  I just called who I think is the head of the site, a little ironic that the head of a site that is funded by the government to educate how to secure ones privacy online publishes his mobile number in the WHOIS data for said site, he asked me to email him with my concerns, which I have now done.
- neura 12y ago
  If you do visit the https version of the page, some of the links back to page still have a hard coded http:// http:// instead of https:// https://
bitJericho 12y ago
http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=lolwhat%3F http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- TazeTSchnitzel 12y ago
  http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=http://www.getsafeonline.org/themes/passwrdcheck/results.html?password http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- dublinben 12y ago
  http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=CorrectHorseBatteryStaple http://www.getsafeonline.org/themes/passwrdcheck/results.htm... I wouldn't trust this site at all with actual passwords.
markhemmings 12y ago
My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.
- x1798DE 12y ago
  Not sure how this works, but if I were writing something that checks "goodness" of passwords, I'd want to check it against a large, sorted list of like the 100 million most common passwords (since almost anyone attackers would start with a dictionary attack, and 10-100 million passwords is decently quick to run against a weak key derivation function). Such a database would be huge, so you'd prefer to do that server-side.
  - dasmoth 12y ago
    Bloom filter?
  - gpvos 12y ago
    They don't seem to do a dictionary check at all.
  - neura 12y ago
    Look at the list of things they check. It shows you how they calculate the score for the password. The actual scoring is in fact done in JavaScript, which you can see when you inspect the page. They want the password on the server side purely for statistics or some other reason that has nothing to do with scoring how "secure" the password is.
  - nl 12y ago
    Like dasmoth says, use a Bloom filter. Or run the length and character checks in Javascript, then hash the password and send the hashed version for dictionary lookup.
maaarghk 12y ago
Hahahahaha. This is a total embarrassment and it is why we can't have nice things. There is always this for a decent alternative: https://howsecureismypassword.net/ https://howsecureismypassword.net/
- jacquesm 12y ago
  'abcdefghij' would take 9 hours to crack?
  - unfunco 12y ago
    Thankfully correcthorsebatterystaple takes a quintillion years. I'm safe.
  - maaarghk 12y ago
    I thought they did a bloom search over the top 1000 most common passwords or something, I guess if you feel very strongly about this you could contact the creator :)
- Pxtl 12y ago
  Password1234567890 It would take a desktop PC about A quadrillion years to crack your password [Tweet Result]
  - LeoPanthera 12y ago
    OK, but if you keep reading: "Your password looks like it might just be a word and a few digits. This is a very common pattern and would be cracked very quickly."
- danielweber 12y ago
  abcdefghijklmnopqrstuvwxyz 46 quintillion years score!
gtirloni 12y ago
(Never enter your real password into a password checker In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use. They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.
- yenoham 12y ago
  But their reasoning for not entering your real password into a checker is "...unlike this one, some may be fake" Then they follow it up with "Why not get your family, friends and workmates to test their passwords too?" And the placeholder in the input field is "Enter your password".
- gpvos 12y ago
  Not very clearly. Most people would read over that sentence (I did at first, although I of course wouldn't dream of entering my real password into that site). It should at least be displayed in bold red.
- usefulcat 12y ago
  And immediately after they tell you not to enter your real password, they say "Why not get your family, friends and workmates to test their passwords too?"
- Donzo 12y ago
  If the sentence you quoted were the one that they used, I would agree with you that it was stated clearly. Unfortunately, they chose to word it this way: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" The sentence is parenthetical, undermining it's importance, and it goes in two different directions, which makes it hard to follow. They should clearly advise users against entering their "real" password in one sentence, and then attest to the authenticity of their password checker in a separate sentence. By the end of their sentence, it's hard to tell whether they mean that I shouldn't put my "real" password into other password checkers. The implication is that their password checker is real and safe. A clearer way to phrase it would be like this: "Don't put your real password into this password checker."
iak8god 12y ago
Wow, their advice is terrible too: "86% Exceptional" http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=P@55w0rd http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- middus 12y ago
  XKCDs correct horse battery staple earns merely 40% ("Warning: Your passwords are weak and your digital life is at risk!") http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=correct%20horse%20battery%20staple http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
  - x1798DE 12y ago
    When in fact it should earn a 0%, because it's in most common password dictionaries now?
    - mikeash 12y ago
      I like the password checkers which just say, "This password is completely insecure, because you just gave it to a strange computer on the internet."
  - giancarlostoro 12y ago
    http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=Correct%20horse%20Battery%20staple http://www.getsafeonline.org/themes/passwrdcheck/results.htm... Capitalize the first letter of correct and battery. Then you get 100% :)
- splike 12y ago
  Change a '5' to a '6' and add a '1' and you get 100% http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=P@56w0rd1 http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- Pxtl 12y ago
  Password12345 gets 93%.
rikkus 12y ago
This is what I wrote in their 'Contact' form, which returned an error: 'The form you submitted contained the following errors Missing Data.(DIFFERENT_IP) Return to Previous Page' I used your password checker here: http://www.getsafeonline.org/themes/passwrdcheck/index.html http://www.getsafeonline.org/themes/passwrdcheck/index.html I notice that it has set the form field to hide my password as I type it, that there are two lock symbols next to the password box, and that the box is surrounded by a metallic looking image. These factors would probably lead one to believe that you were treating my password with care, ensuring that it would only be relayed to yourselves and no-one else would be able to read it. As an untrusting person, I typed something which is not one of my passwords into the box, just to see what would happen. When I submitted the form, my password was transmitted in clear text over the Internet, where it could be read by anyone who happened to be in a position to sniff traffic. This includes my office network! For a site named 'Get safe online', this seems like the most incredible irony. I will be spreading the word that this site is utterly unsafe to visit, as it is unlikely that I have co-incidentally found the single problem. I notice you advise people that a password 'like' 'SP1D3Rm@n' is secure. This is patently false as such a password is very simple to crack. Again, this one issue I found, after choosing a single page to test, gives me a complete lack in confidence in the advice of the site. I will also be telling people not to heed advice found here. Please get some real expert advice on security as the advice you are giving to others, and the problem[s] with your site are likely to cause real problems for people.
- zhte415 12y ago
  I did a WHOIS, and seeing a domain registration date back to 2005 gave an air of credibility. So then I visited Internet Archive and browsed several pages https://web.archive.org/web/20080701000000*/http://getsafeonline.org https://web.archive.org/web/20080701000000*/http://getsafeon... They seem like experts... experts in subtle verbal manipulation for those without technical understanding, at least that is how it reads for me. Over years of archives, including the OP post, 'protect your family' continually appears as a headline. Monetisation is not explicitly outlined, it appears to be government or PPP funded. Scare tactics, targeted at those probably less internet aware then the HN crowd, rather than education, appear to fund this website by whatever means.
chrismorgan 12y ago
Wow, “vwcsgwuqmhcmzlsfgdmbuvi” is laughable, 24%, while replacing the last two characters with “V:” is exceptional, 100%?
afandian 12y ago
This seems like the right venue to let them know that you have been a victim: https://www.getsafeonline.org/share-your-story/ https://www.getsafeonline.org/share-your-story/
pdpi 12y ago
Considering how they deduct points for "bad practices", and how avoiding those "bad practices" actually makes for a smaller password space, I have half a mind to spend some time figuring out exactly how much smaller the password space is for a given length if you follow all of their advice.
- Anderkent 12y ago
  That's not quite right. Assuming you were picking passwords randomly discarding ones that have repeat letters etc makes for a smaller password space, certainly. However that's not how most passwords are generated, especially among the people that need this advice most. If your password generation algorithm is 'think out a random string' and produces 'aabbbbdccdc' then your password space is tiny. Those practices are meant to address the most common 'patterns' in human-generated passwords, therefore effectively enlarging the password space (any cracker has to enumerate more complicated patterns or brute-force, rather than the simple pattern that our brains would generate by defualt)
  - pdpi 12y ago
    For each rule in isolation, that's true enough. But the point stands: once you add together all those good practices (repetitions, consecutive letters, multiple character sets), how much does that actually reduce the password space? I'm not saying that the space becomes tiny, I'm saying that it becomes smaller, and I'm not sure whether "smaller" is still acceptably large, and it's an assumption that's worth checking.
    - KMag 12y ago
      The cost in entropy for these restrictions isn't zero, but it's tiny and measurable. As a conservative estimate, let's assume passwords are only chosen from a set of 84 printable ASCII characters and users never choose passwords longer than 10 characters. (If users are using characters outside this set or longer passwords, they'll have more choices than we're estimating.) All combinations, including the null password yield 17700847248605297701 combinations, or 63.94 bits of entropy if a password is chosen truly randomly from this set. Restrict them to passwords at least 7 characters long, and that drops to 17700846893074759680, about 1.9e-9 bits less, still above 63.94 bits. Further add the restriction that no two adjacent characters are the same and that drops to 15894480881247564960, or 63.78 bits. Further force the user to use one digit and that drops to 11477476711812418840, or 63.32 bits. For the sake of my time, I'm going to get a bit sloppy and start over-estimating the cost of restrictions. Further force the user to have at least one upper-case and one lower-case letter and that drops to (more than) 10727550596265784840 passwords, or 63.22 bits. So, all of these restrictions together cost less than 0.72 bits of entropy. That an easy price to pay for eliminating large classes of trivial passwords.
Singletoned 12y ago
They are also encouraging people to type their password into random sites, which is IMO the worst aspect of this.
bkurtz13 12y ago
Pass#123 is "exceptional". It worries me that people are slow to accept the realities of the xkcd comic on pass phrases (http://xkcd.com/936/ http://xkcd.com/936/). We are training people to think they are secure with passwords that are ridiculously easy to brute force.
mydigitalself 12y ago
I think the best thing about this is that "Open, sesame" gives a green light, 87% and Exceptional status.
krzrak 12y ago
"Failure Your passwords are laughable which makes you an easy target for cyber criminals. You should disconnect your computer now or got to..." Seriously this is wording on government site? I find it offending.
ianamartin 12y ago
how safe is this password really? and is it better if I add a goat? Gets 100% safe
VBprogrammer 12y ago
The Data Protection Act Under the Data Protection Act, we have a legal duty to protect any information we collect from you. We use encryption software to safeguard your data, and keep strict security standards to prevent any unauthorised access to it. I'm lost for words.
danfolkes 12y ago
Yep, and they add the password to the url: https://www.getsafeonline.org/themes/passwrdcheck/results.html?password=poop https://www.getsafeonline.org/themes/passwrdcheck/results.ht...
mnw21cam 12y ago
<cynical> Nice way for UKGov to harvest a load of passwords for their own use </cynical>
Pxtl 12y ago
What a wonderful tool: http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=Password12345 http://www.getsafeonline.org/themes/passwrdcheck/results.htm... Password12345 is ranked 93% Exceptional!
- psychometry 12y ago
  It's great that the results page has the password right in the URL as a GET variable. Makes it much easier to share it on Facebook.
willvarfar 12y ago
Sort of like http://privatekeycheck.com/ http://privatekeycheck.com/ in the worst possible way?
passfree 12y ago
This is so wrong in some many levels. 1. They should not ask for any password first of all 2. They post the password to their server when they could have checked it on the client 3. The password is sent as GET meaning that it is in the URL and it will be recorded in your history and perhaps anything else that keeps log of the URLs you visit 100% fail
roywiggins 12y ago
password1234 50%: Sufficient a12345678910 92%: Exceptional So, they try to give you negative points for "sequential numbers" but you get more points for having numbers than you lose, so it's useless. As long as you have a 12-character string with at least one number and one letter, your password will probably pass.
hawkharris 12y ago
We should stop using the term "password" and start emphasizing passphrases. A full sentence is much easier to remember, yet harder to crack, than a shorter, cryptic password. Or, as XKCD put it: http://xkcd.com/936/ http://xkcd.com/936/ There's a widespread misconception that words are always bad because of dictionary attacks, but that concern is moot if you use unique words or simply use a long sentence. A major advantage of sentences is that, because they're memorable, you can more easily use a different password for every site.
- RussianCow 12y ago
  I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.
  - hawkharris 12y ago
    I agree. It is frustrating when websites place arbitrary limits on characters in a passphrase. It's even more frustrating when they add specific rules (e.g. must use at least one number) that actually lower the number of possible combos in the string.
    - tombrossman 12y ago
      The worst annoyance for me is when they accept my 32+ character password - which I generate and paste from a password manager - and then they silently truncate it to a shorter length! No error, nothing. I remember hearing about some services that did this but the longer passwords still worked, which gave users a false sense of security. What I run into more frequently is that I have to click the 'Forgot password' link and reset it. Then I cross my fingers and wait to see if they email it back in plain text (this is unforgivable) so I can count the characters and learn what the max length is that way.
  - l-p 12y ago
    Well, how would they fit the passwords in the database if there was no limit? =)
naturalethic 12y ago
They clearly need more money.
TimWolla 12y ago
Do they really subtract score for consecutive lowercase / uppercase letters or consecutive numbers? Disallowing that reduces the overall entropy.
dc2447 12y ago
http://ismycreditcardstolen.com/ http://ismycreditcardstolen.com/
TimWolla 12y ago
And it's down again. After submitting a password I get redirected to the homepage.
DanBC 12y ago
It is depressing that money is spent on that website rather than on curating a list of good password managers for all platforms and persuading people to move to those. UK government does do some great IT stuff. This isn't one of those. UK gov also has some horrifically over-budget under-performing train wrecks of IT projects so I guess I should be glad that this isn't one of those.
mraison 12y ago
It would be even more fun if they also asked for your email address at the same time (for security, you know, to protect against viruses).
PeekPoke 12y ago
lol - looks like they are in the process of removing the password checker from the site!
jwildeboer 12y ago
Page is gone now. Seems someone noticed and did the only right thing.
KaiserPro 12y ago
wait, they actually encourage entering you password into random websites? how in living fuck is that a clever idea?
Pxtl 12y ago
It's gone. Somebody noticed.
a3_nm 12y ago
Related: http://www.inutile.ens.fr/estatis/password-security-checker/ http://www.inutile.ens.fr/estatis/password-security-checker/
deleted 12y ago
[deleted]
LeoPanthera 12y ago
It seems they heard us, the page is now 404.
KMag 12y ago
password123; DROP TABLE PASSWORDS -- My password score is 502 Error: Bad Gateway. What did everyone else score? In all seriousness, among the http, the GET param, and the laughable entropy estimates, I wouldn't be surprised if they threw in an SQL injection vuln, a buffer overflow, and a couple of XSS vulns as Easter eggs.

226 points by markhemmings 12y ago

Jesus wept....

This is appalling and inexcusable for a site who claims to help improve security and that claims to have in the team people such as "a foremost expert on information security awareness"[1]. So this cannot be attributed to ignorance. [1] https://www.getsafeonline.org/about-us/ https://www.getsafeonline.org/about-us/

stuaxo 12y ago
It was probably outsourced to accenture or similar who then paid the cheapest devs they could find in india.

opendais 12y ago

Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/ https://www.getsafeonline.org/about-us/ It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html https://www.getsafeonline.org/themes/passwrdcheck/index.html So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and should fix it? EDIT: Tried to contact them, got a "The form you submitted contained the following errors Missing Data.(DIFFERENT_IP)" error which has nothing to do with the form I submitted. XD Could someone contact them by their contact us page to get this fixed?

ZoFreX 12y ago
> Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel. There are adverts everywhere about it with obvious government endorsement. It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a little mistake" it's "who are you to tell people what is, or isn't, secure when you can't even manage the basics?"
- opendais 12y ago
  I'm not from the UK and I never believe anything a company puts on its about us page. ;) If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are. Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page.
  - Tyrannosaurs 12y ago
    > Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page. That's genius because scammers would never say something like that because that would be lying and people don't lie because it's naughty.
    - opendais 12y ago
      I read that and concluded they meant "Do not use a real password on this site"
  - crashandburn4 12y ago
    > Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason. I'd agree but I don't think anyone who reads hacker news is likely to use a password checker anyway. We all, however, know less technical people who could and would get compromised by something like this and to have it endorsed by the government sends the message that it is safe. That's the problem as far as I'm concerned.
  - daveslash 12y ago
    I give this site to people so they can check the strength of their twitter password. I think it get's the point across. http://www.ismytwitterpasswordsecure.com http://www.ismytwitterpasswordsecure.com
- santosha 12y ago
gtirloni 12y ago
Just sent an email to their WHOIS contacts.
- Torn 12y ago
  They're on twitter too @GetSafeOnline
knotty66 12y ago
Even over HTTPS it wouldn't be secure. The password is in the URL so would be stored in the users browser history, and possibly also web-server logs and sent as referrer headers with assets on the secured page.
madaxe_again 12y ago
It IS "UK Government" - it's a QUANGO, so they can keep it at arms length and wash their hands of it, but be under no illusions, this is a government led initiative for which they ultimately, if not in practice, bear responsibility. The cynic in me says that this is a deliberate effort to grab as many passwords as possible. It sounds outlandish, but what actions of our rogue agencies haven't been?
- gtirloni 12y ago
  That would be a waste of resources given the chances of a real criminal testing his/her password strength on a government-operated website are very remote. Even then, they would have to invest in marketing to get people to actually use it when, we all know now, the GHCQ/NSA can simply collect everything at critical infrastructure points. This looks like a good idea, poorly executed.
  - madaxe_again 12y ago
    You think they're after "real criminals"? Tell me, what is this "real criminal" of what you speak? Is it someone who disagrees with the edicts of the state? Is it someone who has the wrong skin colour? Occam's razor says you're right, but while they're busy accusing us all of criminal acts, we may as well do the same.
Alupis 12y ago
This is the same government that thought they could "block all porn" on the internet?
cs02rm0 12y ago
True, ish, they are very much involved. https://www.cyberstreetwise.com https://www.cyberstreetwise.com is the website UK government used to get people to send them their passwords.
- coriny 12y ago
  So this may be a coincidence, but I just followed that link and got a warning from malwarebytes about a malicious website trying to connect to my computer. I've tried a couple more times and not got it again. Anyone else see anything? EDIT: The IP address reported by MalwareBytes is blocked, but I still don't know if it was just coincidence that the warning popped up a second or two after clicking that link. If anyone else experiences anything similar let me know. Still it seems to me that this would be an awesome site to use as a watering hole for ensnaring naive web users, i.e. the kind who won't even notice when they are massively infected.
tyho 12y ago
I just called who I think is the head of the site, a little ironic that the head of a site that is funded by the government to educate how to secure ones privacy online publishes his mobile number in the WHOIS data for said site, he asked me to email him with my concerns, which I have now done.
neura 12y ago
If you do visit the https version of the page, some of the links back to page still have a hard coded http:// http:// instead of https:// https://

bitJericho 12y ago

http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=lolwhat%3F http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

TazeTSchnitzel 12y ago
http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=http://www.getsafeonline.org/themes/passwrdcheck/results.html?password http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
dublinben 12y ago
http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=CorrectHorseBatteryStaple http://www.getsafeonline.org/themes/passwrdcheck/results.htm... I wouldn't trust this site at all with actual passwords.

markhemmings 12y ago

My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.

x1798DE 12y ago
Not sure how this works, but if I were writing something that checks "goodness" of passwords, I'd want to check it against a large, sorted list of like the 100 million most common passwords (since almost anyone attackers would start with a dictionary attack, and 10-100 million passwords is decently quick to run against a weak key derivation function). Such a database would be huge, so you'd prefer to do that server-side.
- dasmoth 12y ago
  Bloom filter?
- gpvos 12y ago
  They don't seem to do a dictionary check at all.
- neura 12y ago
  Look at the list of things they check. It shows you how they calculate the score for the password. The actual scoring is in fact done in JavaScript, which you can see when you inspect the page. They want the password on the server side purely for statistics or some other reason that has nothing to do with scoring how "secure" the password is.
- nl 12y ago
  Like dasmoth says, use a Bloom filter. Or run the length and character checks in Javascript, then hash the password and send the hashed version for dictionary lookup.

maaarghk 12y ago

Hahahahaha. This is a total embarrassment and it is why we can't have nice things. There is always this for a decent alternative: https://howsecureismypassword.net/ https://howsecureismypassword.net/

jacquesm 12y ago
'abcdefghij' would take 9 hours to crack?
- unfunco 12y ago
  Thankfully correcthorsebatterystaple takes a quintillion years. I'm safe.
- maaarghk 12y ago
  I thought they did a bloom search over the top 1000 most common passwords or something, I guess if you feel very strongly about this you could contact the creator :)
Pxtl 12y ago
Password1234567890 It would take a desktop PC about A quadrillion years to crack your password [Tweet Result]
- LeoPanthera 12y ago
  OK, but if you keep reading: "Your password looks like it might just be a word and a few digits. This is a very common pattern and would be cracked very quickly."
danielweber 12y ago
abcdefghijklmnopqrstuvwxyz 46 quintillion years score!

gtirloni 12y ago

(Never enter your real password into a password checker In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use. They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.

yenoham 12y ago
But their reasoning for not entering your real password into a checker is "...unlike this one, some may be fake" Then they follow it up with "Why not get your family, friends and workmates to test their passwords too?" And the placeholder in the input field is "Enter your password".
gpvos 12y ago
Not very clearly. Most people would read over that sentence (I did at first, although I of course wouldn't dream of entering my real password into that site). It should at least be displayed in bold red.
usefulcat 12y ago
And immediately after they tell you not to enter your real password, they say "Why not get your family, friends and workmates to test their passwords too?"
Donzo 12y ago
If the sentence you quoted were the one that they used, I would agree with you that it was stated clearly. Unfortunately, they chose to word it this way: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" The sentence is parenthetical, undermining it's importance, and it goes in two different directions, which makes it hard to follow. They should clearly advise users against entering their "real" password in one sentence, and then attest to the authenticity of their password checker in a separate sentence. By the end of their sentence, it's hard to tell whether they mean that I shouldn't put my "real" password into other password checkers. The implication is that their password checker is real and safe. A clearer way to phrase it would be like this: "Don't put your real password into this password checker."

iak8god 12y ago

Wow, their advice is terrible too: "86% Exceptional" http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=P@55w0rd http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

middus 12y ago
XKCDs correct horse battery staple earns merely 40% ("Warning: Your passwords are weak and your digital life is at risk!") http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=correct%20horse%20battery%20staple http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
- x1798DE 12y ago
  When in fact it should earn a 0%, because it's in most common password dictionaries now?
  - mikeash 12y ago
    I like the password checkers which just say, "This password is completely insecure, because you just gave it to a strange computer on the internet."
- giancarlostoro 12y ago
  http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=Correct%20horse%20Battery%20staple http://www.getsafeonline.org/themes/passwrdcheck/results.htm... Capitalize the first letter of correct and battery. Then you get 100% :)
splike 12y ago
Change a '5' to a '6' and add a '1' and you get 100% http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=P@56w0rd1 http://www.getsafeonline.org/themes/passwrdcheck/results.htm...
Pxtl 12y ago
Password12345 gets 93%.

rikkus 12y ago

This is what I wrote in their 'Contact' form, which returned an error: 'The form you submitted contained the following errors Missing Data.(DIFFERENT_IP) Return to Previous Page' I used your password checker here: http://www.getsafeonline.org/themes/passwrdcheck/index.html http://www.getsafeonline.org/themes/passwrdcheck/index.html I notice that it has set the form field to hide my password as I type it, that there are two lock symbols next to the password box, and that the box is surrounded by a metallic looking image. These factors would probably lead one to believe that you were treating my password with care, ensuring that it would only be relayed to yourselves and no-one else would be able to read it. As an untrusting person, I typed something which is not one of my passwords into the box, just to see what would happen. When I submitted the form, my password was transmitted in clear text over the Internet, where it could be read by anyone who happened to be in a position to sniff traffic. This includes my office network! For a site named 'Get safe online', this seems like the most incredible irony. I will be spreading the word that this site is utterly unsafe to visit, as it is unlikely that I have co-incidentally found the single problem. I notice you advise people that a password 'like' 'SP1D3Rm@n' is secure. This is patently false as such a password is very simple to crack. Again, this one issue I found, after choosing a single page to test, gives me a complete lack in confidence in the advice of the site. I will also be telling people not to heed advice found here. Please get some real expert advice on security as the advice you are giving to others, and the problem[s] with your site are likely to cause real problems for people.

zhte415 12y ago
I did a WHOIS, and seeing a domain registration date back to 2005 gave an air of credibility. So then I visited Internet Archive and browsed several pages https://web.archive.org/web/20080701000000*/http://getsafeonline.org https://web.archive.org/web/20080701000000*/http://getsafeon... They seem like experts... experts in subtle verbal manipulation for those without technical understanding, at least that is how it reads for me. Over years of archives, including the OP post, 'protect your family' continually appears as a headline. Monetisation is not explicitly outlined, it appears to be government or PPP funded. Scare tactics, targeted at those probably less internet aware then the HN crowd, rather than education, appear to fund this website by whatever means.

chrismorgan 12y ago

Wow, “vwcsgwuqmhcmzlsfgdmbuvi” is laughable, 24%, while replacing the last two characters with “V:” is exceptional, 100%?

afandian 12y ago

This seems like the right venue to let them know that you have been a victim: https://www.getsafeonline.org/share-your-story/ https://www.getsafeonline.org/share-your-story/

pdpi 12y ago

Considering how they deduct points for "bad practices", and how avoiding those "bad practices" actually makes for a smaller password space, I have half a mind to spend some time figuring out exactly how much smaller the password space is for a given length if you follow all of their advice.

Anderkent 12y ago
That's not quite right. Assuming you were picking passwords randomly discarding ones that have repeat letters etc makes for a smaller password space, certainly. However that's not how most passwords are generated, especially among the people that need this advice most. If your password generation algorithm is 'think out a random string' and produces 'aabbbbdccdc' then your password space is tiny. Those practices are meant to address the most common 'patterns' in human-generated passwords, therefore effectively enlarging the password space (any cracker has to enumerate more complicated patterns or brute-force, rather than the simple pattern that our brains would generate by defualt)
- pdpi 12y ago
  For each rule in isolation, that's true enough. But the point stands: once you add together all those good practices (repetitions, consecutive letters, multiple character sets), how much does that actually reduce the password space? I'm not saying that the space becomes tiny, I'm saying that it becomes smaller, and I'm not sure whether "smaller" is still acceptably large, and it's an assumption that's worth checking.
  - KMag 12y ago
    The cost in entropy for these restrictions isn't zero, but it's tiny and measurable. As a conservative estimate, let's assume passwords are only chosen from a set of 84 printable ASCII characters and users never choose passwords longer than 10 characters. (If users are using characters outside this set or longer passwords, they'll have more choices than we're estimating.) All combinations, including the null password yield 17700847248605297701 combinations, or 63.94 bits of entropy if a password is chosen truly randomly from this set. Restrict them to passwords at least 7 characters long, and that drops to 17700846893074759680, about 1.9e-9 bits less, still above 63.94 bits. Further add the restriction that no two adjacent characters are the same and that drops to 15894480881247564960, or 63.78 bits. Further force the user to use one digit and that drops to 11477476711812418840, or 63.32 bits. For the sake of my time, I'm going to get a bit sloppy and start over-estimating the cost of restrictions. Further force the user to have at least one upper-case and one lower-case letter and that drops to (more than) 10727550596265784840 passwords, or 63.22 bits. So, all of these restrictions together cost less than 0.72 bits of entropy. That an easy price to pay for eliminating large classes of trivial passwords.

Singletoned 12y ago

They are also encouraging people to type their password into random sites, which is IMO the worst aspect of this.

bkurtz13 12y ago

Pass#123 is "exceptional". It worries me that people are slow to accept the realities of the xkcd comic on pass phrases (http://xkcd.com/936/ http://xkcd.com/936/). We are training people to think they are secure with passwords that are ridiculously easy to brute force.

mydigitalself 12y ago

I think the best thing about this is that "Open, sesame" gives a green light, 87% and Exceptional status.

krzrak 12y ago

"Failure Your passwords are laughable which makes you an easy target for cyber criminals. You should disconnect your computer now or got to..." Seriously this is wording on government site? I find it offending.

ianamartin 12y ago

how safe is this password really? and is it better if I add a goat? Gets 100% safe

VBprogrammer 12y ago

The Data Protection Act Under the Data Protection Act, we have a legal duty to protect any information we collect from you. We use encryption software to safeguard your data, and keep strict security standards to prevent any unauthorised access to it. I'm lost for words.

danfolkes 12y ago

Yep, and they add the password to the url: https://www.getsafeonline.org/themes/passwrdcheck/results.html?password=poop https://www.getsafeonline.org/themes/passwrdcheck/results.ht...

mnw21cam 12y ago

<cynical> Nice way for UKGov to harvest a load of passwords for their own use </cynical>

Pxtl 12y ago

What a wonderful tool: http://www.getsafeonline.org/themes/passwrdcheck/results.html?password=Password12345 http://www.getsafeonline.org/themes/passwrdcheck/results.htm... Password12345 is ranked 93% Exceptional!

psychometry 12y ago
It's great that the results page has the password right in the URL as a GET variable. Makes it much easier to share it on Facebook.

willvarfar 12y ago

Sort of like http://privatekeycheck.com/ http://privatekeycheck.com/ in the worst possible way?

passfree 12y ago

This is so wrong in some many levels. 1. They should not ask for any password first of all 2. They post the password to their server when they could have checked it on the client 3. The password is sent as GET meaning that it is in the URL and it will be recorded in your history and perhaps anything else that keeps log of the URLs you visit 100% fail

roywiggins 12y ago

password1234 50%: Sufficient a12345678910 92%: Exceptional So, they try to give you negative points for "sequential numbers" but you get more points for having numbers than you lose, so it's useless. As long as you have a 12-character string with at least one number and one letter, your password will probably pass.

hawkharris 12y ago

We should stop using the term "password" and start emphasizing passphrases. A full sentence is much easier to remember, yet harder to crack, than a shorter, cryptic password. Or, as XKCD put it: http://xkcd.com/936/ http://xkcd.com/936/ There's a widespread misconception that words are always bad because of dictionary attacks, but that concern is moot if you use unique words or simply use a long sentence. A major advantage of sentences is that, because they're memorable, you can more easily use a different password for every site.

RussianCow 12y ago
I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.
- hawkharris 12y ago
  I agree. It is frustrating when websites place arbitrary limits on characters in a passphrase. It's even more frustrating when they add specific rules (e.g. must use at least one number) that actually lower the number of possible combos in the string.
  - tombrossman 12y ago
    The worst annoyance for me is when they accept my 32+ character password - which I generate and paste from a password manager - and then they silently truncate it to a shorter length! No error, nothing. I remember hearing about some services that did this but the longer passwords still worked, which gave users a false sense of security. What I run into more frequently is that I have to click the 'Forgot password' link and reset it. Then I cross my fingers and wait to see if they email it back in plain text (this is unforgivable) so I can count the characters and learn what the max length is that way.
- l-p 12y ago
  Well, how would they fit the passwords in the database if there was no limit? =)

naturalethic 12y ago

They clearly need more money.

TimWolla 12y ago

Do they really subtract score for consecutive lowercase / uppercase letters or consecutive numbers? Disallowing that reduces the overall entropy.

dc2447 12y ago

http://ismycreditcardstolen.com/ http://ismycreditcardstolen.com/

TimWolla 12y ago

And it's down again. After submitting a password I get redirected to the homepage.

DanBC 12y ago

It is depressing that money is spent on that website rather than on curating a list of good password managers for all platforms and persuading people to move to those. UK government does do some great IT stuff. This isn't one of those. UK gov also has some horrifically over-budget under-performing train wrecks of IT projects so I guess I should be glad that this isn't one of those.

mraison 12y ago

It would be even more fun if they also asked for your email address at the same time (for security, you know, to protect against viruses).

PeekPoke 12y ago

lol - looks like they are in the process of removing the password checker from the site!

jwildeboer 12y ago

Page is gone now. Seems someone noticed and did the only right thing.

KaiserPro 12y ago

wait, they actually encourage entering you password into random websites? how in living fuck is that a clever idea?

Pxtl 12y ago

It's gone. Somebody noticed.

a3_nm 12y ago

Related: http://www.inutile.ens.fr/estatis/password-security-checker/ http://www.inutile.ens.fr/estatis/password-security-checker/

deleted 12y ago

[deleted]

LeoPanthera 12y ago

It seems they heard us, the page is now 404.

KMag 12y ago

password123; DROP TABLE PASSWORDS -- My password score is 502 Error: Bad Gateway. What did everyone else score? In all seriousness, among the http, the GET param, and the laughable entropy estimates, I wouldn't be surprised if they threw in an SQL injection vuln, a buffer overflow, and a couple of XSS vulns as Easter eggs.