9 ms·

I should preface this by saying that I love Project Euler--I spent a ton of time there while learning to program. I also am impressed by anyone who volunteers t

I should preface this by saying that I love Project Euler--I spent a ton of time there while learning to program. I also am impressed by anyone who volunteers to create something for the community, and invests effort in maintaining it. However, not storing emails, and thereby giving up account recovery with the explanation that it's about security is a shit sandwich. My email is <myfirstname>.<mylastname>@gmail.com, a pattern I share with millions of people. This is public information. I could spray paint my email address on local bridges without in any way making my email less secure (cops might complain, though). I understand that some people have reasons to have private email addresses that they don't want released (they'll give them to family, but not the general public). They should never sign up for anything with those email addresses, because the moment you sign up for things, you will almost certainly be entered in a database somewhere, and eventually be spammed or subjected to whatever other bad consequences you're concerned about. Account recovery is a basic feature of a website (except those that contain data too sensitive to have account recovery), and they're giving it up for phantom security.

ntpl 12y ago
It's one thing to decide not to store emails (sure, why not?) but account recovery shouldn't even require one to store email addresses. Check the the email provided by user via the recovery form against a hash of the email saved during registration, if it matches send the reset link. This way when data is breached, figuring out what the original email should be hard (if not impossibly hard, depending on how they hash it). Am I missing something here?
- vog 12y ago
  You should not simply use a hash, but at least a salted hash, or even harder stuff like bcrypt. In other words, treat emails like passwords. Apart from that, I don't see any issues with that approach. Not sure why project euler doesn't use that approach.
  - seanp2k2 12y ago
    The irony here is that it's a site largely about computational complexity.
  - ntpl 12y ago
    Right, which is why I said > figuring out what the original email should be hard (if not impossibly hard, depending on how they hash it) I mean, passwords are way more sensitive than emails, especially given that many people re-use them. So, how you hash passwords is more critical than how you hash emails (which is rarely done, I guess). On the other hand, there is no reason to not have the same level of protection for emails, if you are already following best practices for passwords anyway (PBKDF2, bcrypt, scrypt etc.).
  - stouset 12y ago
    A salted hash would completely eliminate any ability to look up accounts by email address, since you would have to hasn't the email against the salt for every account in the database until you landed on the correct one.
    - mden 12y ago
      A noob question I suppose, but couldn't the salt be generated deterministically from the email and still serve it's purpose?
      - pushrax 12y ago
        Then it's just a more complicated hash function.
        mden 12y ago
        Ah of course. Thanks.
    - runamok 12y ago
      You could have one of two approaches. 1. Don't use a per user salt and just use a global salt. You can counteract this decrease (a bit) in security by increasing the key stretching part of your hashing algorithm. or 2. Require the user to submit their email address AND username and store the salt in the user's record. I agree with someone up there that email address != password. It's refreshing to see someone that gives a crap about my privacy though.
- hyperpape 12y ago
  Of course you're right, and I can't believe I didn't realize that. I think my point still stands that it's a bit silly to worry about storing emails, but you're right that you can even avoid that risk by encrypting them if desired. (And "hash" is a bit misleading: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/).
pgeorgi 12y ago
The combination of email address + password (even hashed in some way) isn't quite as public anymore. Not having any personally identifying information doesn't protect your Project Euler account, it protects your other assets.
- tormeh 12y ago
  Hm... Couldn't you just sign in by using only your email without any password or any other extra stuff? I mean, it's not like there's any sensitive information there. Could lead to some trolling, but I think trolls and Project Euler don't have much overlap. In some cases I think it's valid to ask "why security?".
  - superuser2 12y ago
    Euler has forums. Most likely you'd be looking at huge spam/abuse problems. For the core functionality, though, it might be okay.
- mikeash 12y ago
  I think this is the key point. Security for relatively obscure and unimportant sites isn't really about those sites, it's about other sites. People reuse passwords a lot. They shouldn't, of course, but you can shout that from the rooftops all week and it won't change the fact that a lot of people do. If you suffer a significant breach, then a decent percentage of users will have their bank accounts put at risk from it. You can simply put the blame on the dumb users who reused passwords, but it's reasonable to want to do more.
- hyperpape 12y ago
  This is a good point, and a reason to do the right thing with regard to emails--which is to store a safe version of them (bcrypt). Because while an email and a password is not public information, a username and a password isn't public information either. If you don't trust yourself to store the former, you shouldn't trust yourself to store the later much either.
  - 12y ago
bellerocky 12y ago
> "Account recovery will no longer be possible." A site that purports to teach is incapable of learning of how to strike a balance between securing confidential information and making it possible to recover an account. This is a solved problem. If my bank can have a password recovery system, a site about numbers can have one too. > " With respect to this issue it is quite possible that some members will have genuinely forgotten passwords." Who hasn't "genuinely" lost a password?
- taeric 12y ago
  To be fair, your bank likely has a bit more money to throw at this problem. I would think in this case the entire point is not so much to help them secure stuff, but an attempt to remove them as a target for hacking in the first place.
  - bellerocky 12y ago
    > but an attempt to remove them as a target for hacking in the first place. This is very short sighted. As long as you have a popular site you're a target for defacement. And the convenience expense is enormous. As others have mentioned oauth or a twitter or facebook login alternative would have been a sane choice, what they've decided wasn't sane, it's embarrassing for them and frustrating for users who trusted the site. Inconveniencing users to this degree is probably causing the hackers to laugh, this is in effect a huge win for them they can go brag about now in addition to accessing sensitive information.
    - taeric 12y ago
      I think you are at least slightly overstating how inconvenient this is. I mean, yes, I could wish it was easier. No, this isn't going to stop me from getting back on the site.
      - bellerocky 12y ago
        And how many answers did you lose? Because I lost a bunch. I'm not overstating anything, I'm honestly frustrated and dispirited because of a high degree of incompetence and bad judgment.
ics 12y ago
> [...] because the moment you sign up for things, you will almost certainly be entered in a database somewhere, [...] Oh, you've lost the game long before that. Grandma's email chain? Welcome to the database as soon as anyone on that list gets their email compromised. Apologies to all the grandmothers out there who know how to use the BCC field.

ntpl 12y ago

It's one thing to decide not to store emails (sure, why not?) but account recovery shouldn't even require one to store email addresses. Check the the email provided by user via the recovery form against a hash of the email saved during registration, if it matches send the reset link. This way when data is breached, figuring out what the original email should be hard (if not impossibly hard, depending on how they hash it). Am I missing something here?

vog 12y ago
You should not simply use a hash, but at least a salted hash, or even harder stuff like bcrypt. In other words, treat emails like passwords. Apart from that, I don't see any issues with that approach. Not sure why project euler doesn't use that approach.
- seanp2k2 12y ago
  The irony here is that it's a site largely about computational complexity.
- ntpl 12y ago
  Right, which is why I said > figuring out what the original email should be hard (if not impossibly hard, depending on how they hash it) I mean, passwords are way more sensitive than emails, especially given that many people re-use them. So, how you hash passwords is more critical than how you hash emails (which is rarely done, I guess). On the other hand, there is no reason to not have the same level of protection for emails, if you are already following best practices for passwords anyway (PBKDF2, bcrypt, scrypt etc.).
- stouset 12y ago
  A salted hash would completely eliminate any ability to look up accounts by email address, since you would have to hasn't the email against the salt for every account in the database until you landed on the correct one.
  - mden 12y ago
    A noob question I suppose, but couldn't the salt be generated deterministically from the email and still serve it's purpose?
    - pushrax 12y ago
      Then it's just a more complicated hash function.
      - mden 12y ago
        Ah of course. Thanks.
  - runamok 12y ago
    You could have one of two approaches. 1. Don't use a per user salt and just use a global salt. You can counteract this decrease (a bit) in security by increasing the key stretching part of your hashing algorithm. or 2. Require the user to submit their email address AND username and store the salt in the user's record. I agree with someone up there that email address != password. It's refreshing to see someone that gives a crap about my privacy though.
hyperpape 12y ago
Of course you're right, and I can't believe I didn't realize that. I think my point still stands that it's a bit silly to worry about storing emails, but you're right that you can even avoid that risk by encrypting them if desired. (And "hash" is a bit misleading: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/).

pgeorgi 12y ago

The combination of email address + password (even hashed in some way) isn't quite as public anymore. Not having any personally identifying information doesn't protect your Project Euler account, it protects your other assets.

tormeh 12y ago
Hm... Couldn't you just sign in by using only your email without any password or any other extra stuff? I mean, it's not like there's any sensitive information there. Could lead to some trolling, but I think trolls and Project Euler don't have much overlap. In some cases I think it's valid to ask "why security?".
- superuser2 12y ago
  Euler has forums. Most likely you'd be looking at huge spam/abuse problems. For the core functionality, though, it might be okay.
mikeash 12y ago
I think this is the key point. Security for relatively obscure and unimportant sites isn't really about those sites, it's about other sites. People reuse passwords a lot. They shouldn't, of course, but you can shout that from the rooftops all week and it won't change the fact that a lot of people do. If you suffer a significant breach, then a decent percentage of users will have their bank accounts put at risk from it. You can simply put the blame on the dumb users who reused passwords, but it's reasonable to want to do more.
hyperpape 12y ago
This is a good point, and a reason to do the right thing with regard to emails--which is to store a safe version of them (bcrypt). Because while an email and a password is not public information, a username and a password isn't public information either. If you don't trust yourself to store the former, you shouldn't trust yourself to store the later much either.
- 12y ago

bellerocky 12y ago

> "Account recovery will no longer be possible." A site that purports to teach is incapable of learning of how to strike a balance between securing confidential information and making it possible to recover an account. This is a solved problem. If my bank can have a password recovery system, a site about numbers can have one too. > " With respect to this issue it is quite possible that some members will have genuinely forgotten passwords." Who hasn't "genuinely" lost a password?

taeric 12y ago
To be fair, your bank likely has a bit more money to throw at this problem. I would think in this case the entire point is not so much to help them secure stuff, but an attempt to remove them as a target for hacking in the first place.
- bellerocky 12y ago
  > but an attempt to remove them as a target for hacking in the first place. This is very short sighted. As long as you have a popular site you're a target for defacement. And the convenience expense is enormous. As others have mentioned oauth or a twitter or facebook login alternative would have been a sane choice, what they've decided wasn't sane, it's embarrassing for them and frustrating for users who trusted the site. Inconveniencing users to this degree is probably causing the hackers to laugh, this is in effect a huge win for them they can go brag about now in addition to accessing sensitive information.
  - taeric 12y ago
    I think you are at least slightly overstating how inconvenient this is. I mean, yes, I could wish it was easier. No, this isn't going to stop me from getting back on the site.
    - bellerocky 12y ago
      And how many answers did you lose? Because I lost a bunch. I'm not overstating anything, I'm honestly frustrated and dispirited because of a high degree of incompetence and bad judgment.

ics 12y ago

> [...] because the moment you sign up for things, you will almost certainly be entered in a database somewhere, [...] Oh, you've lost the game long before that. Grandma's email chain? Welcome to the database as soon as anyone on that list gets their email compromised. Apologies to all the grandmothers out there who know how to use the BCC field.