Full Disclosure mailing list archives
Re: password.incleartext.com
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Thu, 7 Apr 2011 04:27:17 +0000
One way to handle this would be to take the password on signup and both hash it and encrypt it with the recovery key's public key in 2 separate fields (a hash field and an encrypted field). That way you've always got a hash of it for validation even if you lose the keys. Of course, you could still always re-encrypt it to see if the two values matched, but I would probably continue to use the hash for logon validation. The private key would be stored on a completely separate machine/instance which was only used for recovery purposes. There could be any number of ways to validate the actual recovery request, but that way you separate out the encrypted data from any on-machine ability to decrypt it. I wouldn't have the private key in memory on the same box because that makes it trivial to decrypt, but of course it all depends on what problem we are trying to solve. t From: Cal Leeming [mailto:cal () foxwhisper co uk] Sent: Wednesday, April 06, 2011 11:58 AM To: Peter Osterberg Cc: Thor (Hammer of God); Mario Vilas; Romain Bourdy; full-disclosure; Inc leartext Subject: Re: [Full-disclosure] password.incleartext.com Tbh, I'd be unhappy about any company storing a password in anything other than a hash of itself. But, like many things in life, we have absolutely no control over it, so best to just use a new pass for every external service :) On Wed, Apr 6, 2011 at 7:48 PM, Peter Osterberg <j () vel nu<mailto:j () vel nu>> wrote: Security is relative and the pwd might be handled in a secure enough fashion compared to the value of the information it is protecting, even though it is stored in a reversable fashion. But I wouldn't, generally speaking, hesitate to claim that it isn't stored securely if it is reversable. Could you givd an example? ----- Ursprungsmeddelande -----
This isn't necessarily true - without knowledge of how the data may be encrypted and what processes are involved in decrypting the data, one can't make the "it isn't secure" statement. That being said, it is probably safe to argue that sites that do not require PCI, SOX, HIPPA, etc would be less inclined to engage in this level of security. But that doesn't mean that it is not being done. t From: full-disclosure-bounces () lists grok org uk<mailto:full-disclosure-bounces () lists grok org uk> [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Mario Vilas Sent: Wednesday, April 06, 2011 9:05 AM To: Romain Bourdy Cc: full-disclosure; Inc leartext Subject: Re: [Full-disclosure] password.incleartext.com<http://password.incleartext.com> Actually, if they can get the data back (be it because it's stored in plaintext or in obfuscated plaintext) then it's not secure. Obfuscation doesn't make it more secure, or any less plaintext. On Wed, Apr 6, 2011 at 11:01 AM, Romain Bourdy <achileos () gmail com<mailto:achileos () gmail com><mailto:achileos () gmail com>> wrote: Hi Full-Disclosure, Just my two cents but ... the fact they can give your password back doesn't mean it's stored in cleartext, just that it's not hashed but encrypted with some way to get the original data back, this doesn't mean at all it's not secured, even though in most case it's not. -Romain On Wed, Apr 6, 2011 at 1:36 PM, <Maksim.Filenko () fuib com<mailto:Maksim.Filenko () fuib com><mailto:Maksim.Filenko () fuib com>> wrote: Kinda plaintextoffenders.com<http://plaintextoffenders.com><http://plaintextoffenders.com>?<http://plaintextoffenders.com%3E?> wbr, - Max full-disclosure-bounces () lists grok org uk<mailto:full-disclosure-bounces () lists grok org uk><mailto:full-disclosure-bounces () lists grok org uk> wrote on 01.04.2011 02:17:24:Inc leartext <staff () incleartext com<mailto:staff () incleartext com><mailto:staff () incleartext com>> Sent by: full-disclosure-bounces () lists grok org uk<mailto:full-disclosure-bounces () lists grok org uk><mailto:full-disclosure-bounces () lists grok org uk> 01.04.2011 13:14 To full-disclosure () lists grok org uk<mailto:full-disclosure () lists grok org uk><mailto:full-disclosure () lists grok org uk> cc Subject [Full-disclosure] password.incleartext.com<http://password.incleartext.com><http://password.incleartext.com> Hi FD, Just launched a new website to keep a list of websites storing passwords in clear text, so far the database is small but feel free to add some: http://password.incleartext.com/Cheers, Inc Leartext_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -- "My daughter was asked by a little old lady in a London hotel restaurant what her daddy did - she answered, 'He's a pirate.' I was very proud of that answer." - Johnny Depp
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- password.incleartext.com Inc leartext (Apr 01)
- The US Government Officially Confirms the Existence of Extraterrestrial Civilizations Valery Marchuk (Apr 01)
- Re: password.incleartext.com Maksim . Filenko (Apr 06)
- Re: password.incleartext.com Romain Bourdy (Apr 06)
- Re: password.incleartext.com Mario Vilas (Apr 06)
- Re: password.incleartext.com Thor (Hammer of God) (Apr 06)
- Re: password.incleartext.com Peter Osterberg (Apr 06)
- Re: password.incleartext.com Cal Leeming (Apr 07)
- Re: password.incleartext.com Thor (Hammer of God) (Apr 06)
- Re: password.incleartext.com Peter Osterberg (Apr 07)
- Re: password.incleartext.com Inc Leartext (Apr 07)
- Re: password.incleartext.com Romain Bourdy (Apr 06)
- Re: password.incleartext.com Cal Leeming (Apr 07)
- Re: password.incleartext.com Valdis . Kletnieks (Apr 07)
- Re: password.incleartext.com Cal Leeming (Apr 07)
- Message not available
- Re: password.incleartext.com T Biehn (Apr 06)
- Re: password.incleartext.com Romain Bourdy (Apr 06)
- Re: password.incleartext.com Valdis . Kletnieks (Apr 06)