3 ms·
> After the first shock of seeing iCloud passwords stored in clear text(how hard would it be to encrypt them?) Not going to defend shady businesses, but I disl
by kpcyrd 11y ago
> After the first shock of seeing iCloud passwords stored in clear text(how hard would it be to encrypt them?)
Not going to defend shady businesses, but I dislike this knee jerk reaction without understanding the actual issue. I've seen software that encrypts (encrypts, not hashes) passwords for security™, but stores the secret in the database, too. Sure, technically they didn't store plaintext passwords, but practically they did.
What you could do to defend the passwords:
* hash them - doesn't work in this case, because it's not an authentication system
* symmetrically encrypt them - useless, the secret would be stored on the compromised server
* asymmetrically encrypt them - works, assuming the private key isn't stored on the server. Therefore, it's not possible to decrypt the passwords from within the application again
- Lancey 11y agoEven if you store the secret on the same server it shows some effort went into the protection of user credentials.
- kpcyrd 11y agoYou aren't protecting anything, you're playing hide and seek. This isn't how security works.
- nobotty 11y agoIt's called defense in depth. Get a clue.
- meatysnapper 11y agoFORD: Yeah, well, at least it’s better than, ooh, than er… ZAPHOD: It isn’t better than anything at all, is it?!