Re: Password security

[Joe St Sauver <joe () OREGON UOREGON EDU>]

Hi,

While I share everyone's concern about plain text passwords, there 
*are* many, many, mainstream applications that *do* store passwords 
unencrypted, and often in ways that are publicly accessible. 
(Anyone skeptical of this can quickly lose that skepticism via a 
little Google dorking, e.g., see for example
http://www[dot]exploit-db[dot]com/google-dorks/9/ )

> From my POV, the *real* issue is this: given that plain text passwords
ARE out there all over the place, how do we get that problem sorted? 

I suspect that a straightforward find-and-notify strategy might be an 
excellent way to trigger a "shoot the messenger bearing bad news" sort 
of reaction, unfortunately.

Regards,

Joe