10 ms·

>7. Fine, but I still get to send users their passwords once they created them so they don’t forget them, right? Email is not a secure medium. It was never desi

• weaksauce 12y ago
  A lot of people use only one password for everywhere... You'd be giving the attacker the keys to the kingdom.
  • jere 12y ago
    This is certainly a good point.
  • kenny_r 12y ago
    Which is still true if you don't know their passwords but if you have their email. You can reset the passwords for just about every conceivable account they have.
    • mechanical_fish 12y ago
      If the password is in the email in cleartext, you don't need an active login for their email. All you need to do is be looking over their shoulder in the cafe, once, when they bring up the email on their iPad.
    • octo_t 12y ago
      Given an uncertain amount of time. Your process requires access to their email account while you go through and reset all their passwords. Whereas if the passwords are in plaintext, you can download all their email and get access at your leisure.
    • throwaway48372 12y ago
      Back when I was a teen I used to fraud people and scam ebay sellers through paypal. If I were to somehow gain access to an email (via RAT, Cookie hijacking), one of the easiest ways to recover a password was to look for a provider that sent out a plaintext password. Chances are the unfortunate target used the same password on every site (or if it was lowercase and alpha, that password + "1"). That would grant continued access to the email, and other sites that took protection a little more seriously like Paypal and Bank Logins (you can't reset a Paypal password with just an email, and if you could, such an action would make Paypal fraud detection software go nuts).
      • praneshp 12y ago
        "Back when I was a teen I used to fraud people and scam ebay sellers through paypal". Cool!
  • MrTortoise 12y ago
    in which case they wouldnt be using the password reset mechanism
    • weaksauce 12y ago
      One scenario of many: The attacker has brief access to the email of the victim. Hacker resets the password and now has the password for all accounts tied to that email address.
  • personZ 12y ago
    You'd be giving the attacker the keys to the kingdom. No, the people who use a common password gave out the keys. There is simply no excusing it. The apologism for it has to stop. NEVER use the same password across multiple services. If one service gets compromised, the extent of their culpability is their own service. Anyone whose password exposes other things was the cause of their own demise. EDIT: I will not back down from this (and you shouldn't feel too ashamed for reusing passwords and falling in the above buckets, desperately hitting down arrow. Just correct your mistakes). It is utter idiocy to constantly defend the habit of shared passwords, when people give it to services of zero trust, and with unknown habits and practices. When some service of no consequence stores your password in plaintext, that is them being dumb. If you then complain because it's the same password used elsewhere, that is you being dumb.
    • unreal37 12y ago
      I'm not going to presume to know anything about you, but as soon as your system interfaces with human beings, your system needs to adapt to human nature. You can't say "there's no excusing it" and "cause of their own demise". Humans act as humans tend to do - why should the security of your system rely on humans changing their natural behavior?
      • personZ 12y ago
        You can't say "there's no excusing it" and "cause of their own demise". Yes, you absolutely can and should say that. This isn't human nature, but is simply accepted and defended behavior that gets caught out again, and again, and again. I have absolutely no doubt that many visitors to HN are guilty of this, and instead of confronting the reality of their insecurity, pretend it's someone else's fault. Each time some random, irrelevant message board has a password exploit, everyone who should know better rushes forth to pillorize the operator because of the greater danger, yet the operator may have been sharing those passwords on the black market for time eternal. The operator may have been putting their plaintext backups on a compromised FTP site for years. They may have engaged endless contractors who made their own backups and are busy buying stuff on Amazon for it. But instead we argue pretend security measures, when the horses have not only bolted, they're several states away. It is complete idiocy to use passwords across services. Utter insanity. It is the worst possible practice imaginable, and is never, ever excusable. If you used the same password across sites, you simply must assume that since day one it has been compromised, and it is your own doing. But here we excuse it. And then, in excusing it and defending it and supporting it, claim that it's "human nature". It isn't human nature at all. How To Hack 60% of Hacker News: Create a service requiring users to create logins, submitting it as a show HN. Harvest email/passwords from very foolish people and enjoy their access everywhere else.
• Mithaldu 12y ago
  "Man In The Middle (MITM)" is the important bit. For example by sniffing the wireless traffic on an unencrypted wlan you can capture entire emails being sent or received, without ever compromising the account.
  • slight 12y ago
    - Request password reset. - Sniff email with reset link. - Go to reset link before user does and change password.
    • Mithaldu 12y ago
      That will work, however it will also leave the user with a clue that their account may have been compromised. It is also a noticable degree harder to pull off than simply sniffing a password being sent, due to needing to know the target's data necessary to request a reset.
    • asuffield 12y ago
      The key difference is that capturing a plaintext password means the user and attacker both share a password without the user realising, while capturing a reset link means that one of them will win and the other will observe their password reset has failed.
    • omervk 12y ago
      Hence our mentioning that the user must receive a mail notifying of the password change.
    • u124556 12y ago
      It would be better if the website allowed the user to set the new password first and then send an email to confirm the password change.
  • Rapzid 12y ago
    Entire clear text emails. Everyone SHOULD be using TLS wrapped email protocols. That doesn't mean they are, but gmail is https all the way and many providers now require TLS connections to the mail servers. Still, one time use password reset links with explicit instructions and set expectations to reset the password immediately is the way to go if you're emailing anything IMO.
• deleted 12y ago
  [deleted]
• jaredmcateer 12y ago
  Another thing to consider is if your email provider's offline backups get jacked in transit would you rather your emails contain your plain text passwords or links to a password reset with expired tokens?
  • x86_64Ubuntu 12y ago
    I have never thought of that, ever. I'm not being sarcastic. Usually I think of email as existing on some secure server, I never thought that backups are kept, maybe in a different medium which is then open to vulnerabilities.
    • jwl 12y ago
      It is frighteningly common to neglect backups when thinking in security. I have seen a couple of examples where the technical aspects of security with good firewalls, good access control to servers and so on were in place, but backup media could still be found laying around for everyone to grab.
    • mechanical_fish 12y ago
      This is why, for example, Amazon S3 has a little checkbox on each bucket to encrypt the contents of the bucket. At first glance this might seem a little silly. Amazon has the key. (You don't even get to see the key yourself.) So Amazon can read all your data. And every time you read from the bucket it's automatically decrypted, so the encryption won't protect you from anyone who has somehow achieved permission to read your data. But that's not the point. The point is to protect against attacks like "I found this pile of dusty drives stacked in the maintenance closet at Amazon," or "I went digging in the local dump near an Amazon data center and unearthed this hard drive, and look what I found backed up on it."
      • herge 12y ago
        I'd even make the effort of encrypting yourself any data you want to protect that you send to s3. GnuPG is not that hard to use with RSA.
• biggerfisch 12y ago
  The FAQ isn't saying that the only bad thing is that email accounts might be compromised, simply that that's one reason to not email passwords. While you're right about email comprises allowing an attacker to simply reset a password, the first few sentences are still very important. > Email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Email by default right not isn't encrypted. Anyone (eg, a 3-letter government agency or a malicous actor on an unencrypted wifi network) who can intercept your traffic can read that password - and you can't even tell. At least with a password reset there's the "notification" of "my password doesn't work anymore". That's mitigated by SSL/TLS, but it's still an important point to consider.
• pmjordan 12y ago
  If someone hacks into your email account, they can just trawl through the email archive and harvest passwords from past password reminder emails. With a temporary reset token, they have to initiate a password reset request, which you should notice: (a) you might notice the email if you have e.g. push notifications enabled, or if the attacker doesn't delete it quickly enough, and (b) your real password will suddenly stop working. Additionally, even if your reset request is harvested via MITM, if you use a single-use reset token, and an attacker uses it before you can, you know something is up. Even if it's not single-use, your password suddenly no longer working should ring alarm bells.
  • hackuser 12y ago
    And if someone hacks the system administrator's account, they may find everyone's passwords (for systems where the admin sets the pw and emails it).
  • bartwe 12y ago
    You're current password shouldn't stop working because otherwise that can be used as a denial of service without otherwise compromising the security of either the user or the site if the email address is known.
    • pmjordan 12y ago
      Obviously it shouldn't stop working straight away, but presumably an attacker would actually use the password reset code, at which point they would set your password to something else, which you would notice.
• ajanuary 12y ago
  I agree; this point shouldn't be about password reset emails being more secure, it should be about the fact you don't need to be able to email them their password to have a successful account recovery process. That said, it can be more secure. Firstly, people reuse passwords, so intercepting a plaintext password gives you access not only to the account on that site, but also several others. Secondly, if the link expires you can't use old account recovery emails to find out passwords. If you manage to compromise an account (rather than mitm), you can search through for old "here is your password" emails and use those without even having to initiate a new password recovery process, which in this age of mobile devices and push notifications risks the victim seeing the email and getting suspicious.
  • pbreit 12y ago
    Exactly. This action is so obviously horrendous it's had to believe it still happens. Once a password hits your inbox, you can almost count on it living forever. And Basically with one 5 second search of my inbox for "password" a thief could easily discover my password that I use for almost every web site. It's totally irresponsible for a service provider to essentially reveal a secret like that (without asking or really, ever).
    • shortstuffsushi 12y ago
      Does none of that responsibility lay with you for using the same password across all sites? What if, on the other side of the spectrum, their site was compromised, and your password was retrieved that way? You'd be vulnerable in the same way.
      • niels_olson 12y ago
        I think people are learning about password wallets. My mom, wife, and kids (12 and 9) all use and understand the value of password wallets. If google really does get in-browser crypto working, they might even understand pgp. They won't understand Diffie-Hellman, but they understand if words --> block of gibberish --> words, then there must be some math in between.
• powatom 12y ago
  True - but you can add an additional layer of security to the password reset request if this is a concern, such as personal questions.
  • gpvos 12y ago
    Using personal questions for security is the worst thing ever. Whenever I encounter them, I paste the output of "dd if=/dev/random bs=1k count=1 |uuencode x" into the field.
    • iopq 12y ago
      If you can use Facebook and Linkedin to hack someone's bank account you know that this is a bad idea. What's that, the make of your first car and the name of your first boss are actually freely posted on the Internet? You don't say.
  • 6d0debc071 12y ago
    I can never remember the answers to those damned things.
• 3pt14159 12y ago
  The main reason not to do it is that people don't always have control over their email, for example, school, work, etc. Also, some courts can force you to give up an encryption password, but many can't. By sending a password in the clear you can be inadvertently giving the court a password that they otherwise wouldn't have had.
• blkhawk 12y ago
  >This is one I always struggled to understand. If email is compromised, the attacker can request and immediately intercept a password reset anyway. Not really the main issue - if you always send the password the Thief controlling the email does not even need to reset the password. he can get in without leaving any trace at any time. It also allows the collection of all the Passwords from all the users in bulk. And if your users are reusing their passwords everything else is open too. Sending the Password is just a stupid policy. Its up there with restrictive Password requirements and Server-side unhashed Password storage.
• jcampbell1 12y ago
  In 2007, Gmail had a XSRF vulnerability for setting up filters. It was exploited by attackers that would create a filter 'Contains "password"', 'Forward to: evil@example.com', 'Run on all messages'. Basically you could visit a malicious webpage, and all emails containing the word "password", would be sent to the attacker.
• kateperry 12y ago
  my roomate's sister-in-law earned $14851 last month. she is getting paid on the laptop and moved in a $499100 house. All she did was get blessed and put to work the clues exposed on this web site ,,,,,,,, ,,,,,,,, WWW.MAX43.COM
• krambs 12y ago
  You shouldn't send the password because you shouldn't be storing the password. Worries about email security, etc. are secondary.
  • larrybrid 12y ago
    Yeah, I was surprised to see that this bit wasn't mentioned anywhere. If you are emailing someone their password in plaintext, that means you know their password in plaintext -- which you should not.
    • jere 12y ago
      You do when they first create it.
      • yebyen 12y ago
        And every time they enter it to log in, up until the moment when it's hashed and (maybe the memory is overwritten with zeros before being) garbage collected.
    • MertsA 12y ago
      That's not quite true, most random web services send out the welcome email from the same page that just hashed your password so during email creation they still have the plaintext copy around even though it dies after the request ends.
    • omervk 12y ago
      Yes, that's in the FAQ too.
• cookingrobot 12y ago
  Gmail should make you type your password again in order to open password-reset emails sent by other services. This would close the "I accidentally left my account logged in" hole.
  • xyproto 12y ago
    The "log in again to do something secure" is a rabbit hole, where suddenly you have to log in again to do anything it all. It could become a login nightmare.
    • bmelton 12y ago
      Only if 'something secure' is defined overbroadly. Using Amazon, as an example, I can idle my session indefinitely, and when I return, it will even allow me to do potentially secure things like browse my order history, look at my account details and such, but before I order something, or change my password, it prompts for a login, except where I've just recently logged in. There's a balance to be had, and while admittedly, getting the details right is tedium and minutiae, it can be done, and done right.
  • ademarre 12y ago
    I expect people would not understand this. They would start to get confused between their Google password and that of the service they are trying to access. Also, after users learn the new process, it opens up a new phishing attack vector for Gmail.
• chacham15 12y ago
  Most of the other points, while correct miss the big issue: the server should not store the password in case they themselves get hacked. If an attacker gains access to one persons email then he gets 1 password. If he gains access to a server then he can potentially gain access to thousands of passwords. Therefore, having plaintext passwords makes you a target for attackers.
• Sami_Lehtinen 12y ago
  True, email shouldn't be used for password recovery nor user authentication anyway. But guess what, many sites still do it. Even if site security is otherwise flawless, password recovery using email ruins everything.
• SkyMarshal 12y ago
  Would you send your user's password to them on a postcard? If so, by all means feel free to send it in email.
• deleted 12y ago
  [deleted]