5 ms·

A lot of people use only one password for everywhere... You'd be giving the attacker the keys to the kingdom.

jere 12y ago
This is certainly a good point.
kenny_r 12y ago
Which is still true if you don't know their passwords but if you have their email. You can reset the passwords for just about every conceivable account they have.
- mechanical_fish 12y ago
  If the password is in the email in cleartext, you don't need an active login for their email. All you need to do is be looking over their shoulder in the cafe, once, when they bring up the email on their iPad.
- octo_t 12y ago
  Given an uncertain amount of time. Your process requires access to their email account while you go through and reset all their passwords. Whereas if the passwords are in plaintext, you can download all their email and get access at your leisure.
- throwaway48372 12y ago
  Back when I was a teen I used to fraud people and scam ebay sellers through paypal. If I were to somehow gain access to an email (via RAT, Cookie hijacking), one of the easiest ways to recover a password was to look for a provider that sent out a plaintext password. Chances are the unfortunate target used the same password on every site (or if it was lowercase and alpha, that password + "1"). That would grant continued access to the email, and other sites that took protection a little more seriously like Paypal and Bank Logins (you can't reset a Paypal password with just an email, and if you could, such an action would make Paypal fraud detection software go nuts).
  - praneshp 12y ago
    "Back when I was a teen I used to fraud people and scam ebay sellers through paypal". Cool!
MrTortoise 12y ago
in which case they wouldnt be using the password reset mechanism
- weaksauce 12y ago
  One scenario of many: The attacker has brief access to the email of the victim. Hacker resets the password and now has the password for all accounts tied to that email address.
personZ 12y ago
You'd be giving the attacker the keys to the kingdom. No, the people who use a common password gave out the keys. There is simply no excusing it. The apologism for it has to stop. NEVER use the same password across multiple services. If one service gets compromised, the extent of their culpability is their own service. Anyone whose password exposes other things was the cause of their own demise. EDIT: I will not back down from this (and you shouldn't feel too ashamed for reusing passwords and falling in the above buckets, desperately hitting down arrow. Just correct your mistakes). It is utter idiocy to constantly defend the habit of shared passwords, when people give it to services of zero trust, and with unknown habits and practices. When some service of no consequence stores your password in plaintext, that is them being dumb. If you then complain because it's the same password used elsewhere, that is you being dumb.
- unreal37 12y ago
  I'm not going to presume to know anything about you, but as soon as your system interfaces with human beings, your system needs to adapt to human nature. You can't say "there's no excusing it" and "cause of their own demise". Humans act as humans tend to do - why should the security of your system rely on humans changing their natural behavior?
  - personZ 12y ago
    You can't say "there's no excusing it" and "cause of their own demise". Yes, you absolutely can and should say that. This isn't human nature, but is simply accepted and defended behavior that gets caught out again, and again, and again. I have absolutely no doubt that many visitors to HN are guilty of this, and instead of confronting the reality of their insecurity, pretend it's someone else's fault. Each time some random, irrelevant message board has a password exploit, everyone who should know better rushes forth to pillorize the operator because of the greater danger, yet the operator may have been sharing those passwords on the black market for time eternal. The operator may have been putting their plaintext backups on a compromised FTP site for years. They may have engaged endless contractors who made their own backups and are busy buying stuff on Amazon for it. But instead we argue pretend security measures, when the horses have not only bolted, they're several states away. It is complete idiocy to use passwords across services. Utter insanity. It is the worst possible practice imaginable, and is never, ever excusable. If you used the same password across sites, you simply must assume that since day one it has been compromised, and it is your own doing. But here we excuse it. And then, in excusing it and defending it and supporting it, claim that it's "human nature". It isn't human nature at all. How To Hack 60% of Hacker News: Create a service requiring users to create logins, submitting it as a show HN. Harvest email/passwords from very foolish people and enjoy their access everywhere else.

jere 12y ago

This is certainly a good point.

Which is still true if you don't know their passwords but if you have their email. You can reset the passwords for just about every conceivable account they have.

mechanical_fish 12y ago
If the password is in the email in cleartext, you don't need an active login for their email. All you need to do is be looking over their shoulder in the cafe, once, when they bring up the email on their iPad.
octo_t 12y ago
Given an uncertain amount of time. Your process requires access to their email account while you go through and reset all their passwords. Whereas if the passwords are in plaintext, you can download all their email and get access at your leisure.
throwaway48372 12y ago
Back when I was a teen I used to fraud people and scam ebay sellers through paypal. If I were to somehow gain access to an email (via RAT, Cookie hijacking), one of the easiest ways to recover a password was to look for a provider that sent out a plaintext password. Chances are the unfortunate target used the same password on every site (or if it was lowercase and alpha, that password + "1"). That would grant continued access to the email, and other sites that took protection a little more seriously like Paypal and Bank Logins (you can't reset a Paypal password with just an email, and if you could, such an action would make Paypal fraud detection software go nuts).
- praneshp 12y ago
  "Back when I was a teen I used to fraud people and scam ebay sellers through paypal". Cool!

MrTortoise 12y ago

in which case they wouldnt be using the password reset mechanism

weaksauce 12y ago
One scenario of many: The attacker has brief access to the email of the victim. Hacker resets the password and now has the password for all accounts tied to that email address.

personZ 12y ago

You'd be giving the attacker the keys to the kingdom. No, the people who use a common password gave out the keys. There is simply no excusing it. The apologism for it has to stop. NEVER use the same password across multiple services. If one service gets compromised, the extent of their culpability is their own service. Anyone whose password exposes other things was the cause of their own demise. EDIT: I will not back down from this (and you shouldn't feel too ashamed for reusing passwords and falling in the above buckets, desperately hitting down arrow. Just correct your mistakes). It is utter idiocy to constantly defend the habit of shared passwords, when people give it to services of zero trust, and with unknown habits and practices. When some service of no consequence stores your password in plaintext, that is them being dumb. If you then complain because it's the same password used elsewhere, that is you being dumb.

unreal37 12y ago
I'm not going to presume to know anything about you, but as soon as your system interfaces with human beings, your system needs to adapt to human nature. You can't say "there's no excusing it" and "cause of their own demise". Humans act as humans tend to do - why should the security of your system rely on humans changing their natural behavior?
- personZ 12y ago
  You can't say "there's no excusing it" and "cause of their own demise". Yes, you absolutely can and should say that. This isn't human nature, but is simply accepted and defended behavior that gets caught out again, and again, and again. I have absolutely no doubt that many visitors to HN are guilty of this, and instead of confronting the reality of their insecurity, pretend it's someone else's fault. Each time some random, irrelevant message board has a password exploit, everyone who should know better rushes forth to pillorize the operator because of the greater danger, yet the operator may have been sharing those passwords on the black market for time eternal. The operator may have been putting their plaintext backups on a compromised FTP site for years. They may have engaged endless contractors who made their own backups and are busy buying stuff on Amazon for it. But instead we argue pretend security measures, when the horses have not only bolted, they're several states away. It is complete idiocy to use passwords across services. Utter insanity. It is the worst possible practice imaginable, and is never, ever excusable. If you used the same password across sites, you simply must assume that since day one it has been compromised, and it is your own doing. But here we excuse it. And then, in excusing it and defending it and supporting it, claim that it's "human nature". It isn't human nature at all. How To Hack 60% of Hacker News: Create a service requiring users to create logins, submitting it as a show HN. Harvest email/passwords from very foolish people and enjoy their access everywhere else.