5 ms·

Many do. E.g. 37signals.

by ichverstehe 17y ago

tptacek 17y ago
37signals lost a bunch of plaintext passwords? When did that happen?
- qeorge 17y ago
  They didn't lose them, someone just noticed that they would send you your original password if you requested it and made a blog post about it. The conclusion was that they must be storing passwords plaintext, although that's not necessarily true. IIRC, your opinion was that this was not a big deal in the grand scheme of things.
  - tptacek 17y ago
    I said it wasn't a vulnerability, or, if it was, it was a minor one compared to a real vulnerability; sev:low compared to sev:medium for a stored XSS flaw and sev:high for SQL Injection. And I believe that. But if we're comparing one password storage mechanism to another, I get religious fast. There's a right and a wrong way to do it. 37s did it the wrong way. Now I understand they do it the right way. Good for them!
    - qeorge 17y ago
      Yeah, I remember that better now. There were a lot of pitchforks that day. 37s has a great track record of listening to and acting on community feedback, which is all you can really ask for. I second your kudos.
tree5 17y ago
I doubt that. They're led by probably the strongest Rails team anywhere, and they (DHH + team) wrote books on avoiding what RockYou just did. EDIT: I'm specifically referring to DHH's "Agile Web Development With Rails", Chapter 11, Administration
- tsally 17y ago
  It happened (storing in plaintext, not losing the actual passwords): http://www.jgc.org/blog/2009/05/can-you-trust-37signals-with-your.html http://www.jgc.org/blog/2009/05/can-you-trust-37signals-with... We've covered 37signals poor approach to security before: http://news.ycombinator.com/item?id=804257 http://news.ycombinator.com/item?id=804257 It's my understanding that they've since reformed. I'd be interested in what books you think they've written that provide credible security advice. Blind "fanboyism" (if I may invent a word) is a bad thing.
  - tree5 17y ago
    "Agile Web Development With Rails", Chapter 11, Administration
    - tsally 17y ago
      Here's the sample code they give in that chapter: def self.encrypted_password(password, salt) string_to_hash = password + "wibble" + salt # 'wibble' makes it harder to guess Digest::SHA1.hexdigest(string_to_hash) end They are using SHA1 with a salt, the exact method that security experts recommend against when storing passwords: http://news.ycombinator.com/item?id=995645 http://news.ycombinator.com/item?id=995645. And obviously they didn't even use this insecure method internally. EDIT: tptacek makes a good point. I haven't quite been fair. 37signals did what most companies never do when confronted with a security issue: they quickly acknowledged the problem, fixed it based on the suggestions of the security researchers, and moved on.
      - tptacek 17y ago
        You're right. Just give them credit for taking their lumps, apologizing, and getting religion.
  - cloudkj 17y ago
    I'm guessing tree5 is talking about "Agile Web Development With Rails," in which the authors do give examples of creating hashed passwords with a unique salt and running a SHA1 digest. The book also talks about preventing plain text passwords from showing up in log files from form submissions. From what I understand however, AWDWR is only tangentially related to 37signals.
deleted 17y ago
[deleted]

Many do. E.g. 37signals.

tptacek 17y ago

37signals lost a bunch of plaintext passwords? When did that happen?

qeorge 17y ago
They didn't lose them, someone just noticed that they would send you your original password if you requested it and made a blog post about it. The conclusion was that they must be storing passwords plaintext, although that's not necessarily true. IIRC, your opinion was that this was not a big deal in the grand scheme of things.
- tptacek 17y ago
  I said it wasn't a vulnerability, or, if it was, it was a minor one compared to a real vulnerability; sev:low compared to sev:medium for a stored XSS flaw and sev:high for SQL Injection. And I believe that. But if we're comparing one password storage mechanism to another, I get religious fast. There's a right and a wrong way to do it. 37s did it the wrong way. Now I understand they do it the right way. Good for them!
  - qeorge 17y ago
    Yeah, I remember that better now. There were a lot of pitchforks that day. 37s has a great track record of listening to and acting on community feedback, which is all you can really ask for. I second your kudos.

tree5 17y ago

I doubt that. They're led by probably the strongest Rails team anywhere, and they (DHH + team) wrote books on avoiding what RockYou just did. EDIT: I'm specifically referring to DHH's "Agile Web Development With Rails", Chapter 11, Administration

tsally 17y ago
It happened (storing in plaintext, not losing the actual passwords): http://www.jgc.org/blog/2009/05/can-you-trust-37signals-with-your.html http://www.jgc.org/blog/2009/05/can-you-trust-37signals-with... We've covered 37signals poor approach to security before: http://news.ycombinator.com/item?id=804257 http://news.ycombinator.com/item?id=804257 It's my understanding that they've since reformed. I'd be interested in what books you think they've written that provide credible security advice. Blind "fanboyism" (if I may invent a word) is a bad thing.
- tree5 17y ago
  "Agile Web Development With Rails", Chapter 11, Administration
  - tsally 17y ago
    Here's the sample code they give in that chapter: def self.encrypted_password(password, salt) string_to_hash = password + "wibble" + salt # 'wibble' makes it harder to guess Digest::SHA1.hexdigest(string_to_hash) end They are using SHA1 with a salt, the exact method that security experts recommend against when storing passwords: http://news.ycombinator.com/item?id=995645 http://news.ycombinator.com/item?id=995645. And obviously they didn't even use this insecure method internally. EDIT: tptacek makes a good point. I haven't quite been fair. 37signals did what most companies never do when confronted with a security issue: they quickly acknowledged the problem, fixed it based on the suggestions of the security researchers, and moved on.
    - tptacek 17y ago
      You're right. Just give them credit for taking their lumps, apologizing, and getting religion.
- cloudkj 17y ago
  I'm guessing tree5 is talking about "Agile Web Development With Rails," in which the authors do give examples of creating hashed passwords with a unique salt and running a SHA1 digest. The book also talks about preventing plain text passwords from showing up in log files from form submissions. From what I understand however, AWDWR is only tangentially related to 37signals.

deleted 17y ago

[deleted]