Re: password.incleartext.com

["Thor (Hammer of God)" <thor () hammerofgod com>]

One way to handle this would be to take the password on signup and both hash it and encrypt it with the recovery key's 
public key in 2 separate fields (a hash field and an encrypted field).  That way you've always got a hash of it for 
validation even if you lose the keys.   Of course, you could still always re-encrypt it to see if the two values 
matched, but I would probably continue to use the hash for logon validation.

The private key would be stored on a completely separate machine/instance which was only used for recovery purposes.   
There could be any number of ways to validate the actual recovery request, but that way you separate out the encrypted 
data from any on-machine ability to decrypt it.   I wouldn't have the private key in memory on the same box because 
that makes it trivial to decrypt, but of course it all depends on what problem we are trying to solve.

t

From: Cal Leeming [mailto:cal () foxwhisper co uk]
Sent: Wednesday, April 06, 2011 11:58 AM
To: Peter Osterberg
Cc: Thor (Hammer of God); Mario Vilas; Romain Bourdy; full-disclosure; Inc leartext
Subject: Re: [Full-disclosure] password.incleartext.com

Tbh, I'd be unhappy about any company storing a password in anything other than a hash of itself. But, like many things 
in life, we have absolutely no control over it, so best to just use a new pass for every external service :)

On Wed, Apr 6, 2011 at 7:48 PM, Peter Osterberg <j () vel nu<mailto:j () vel nu>> wrote:

Security is relative and the pwd might be handled in a secure enough fashion compared to the value of the information 
it is protecting, even though it is stored in a reversable fashion. But I wouldn't, generally speaking, hesitate to 
claim that it isn't stored securely if it is reversable.

Could you givd an example?

----- Ursprungsmeddelande -----
> This isn't necessarily true - without knowledge of how the data may be
> encrypted and what processes are involved in decrypting the data, one
> can't make the "it isn't secure" statement.
>
> That being said, it is probably safe to argue that sites that do not
> require PCI, SOX, HIPPA, etc would be less inclined to engage in this
> level of security.  But that doesn't mean that it is not being done.
>
> t
>
> From: full-disclosure-bounces () lists grok org uk<mailto:full-disclosure-bounces () lists grok org uk>
> [mailto:full-disclosure-bounces () lists grok org uk] On Behalf Of Mario
> Vilas Sent: Wednesday, April 06, 2011 9:05 AM To: Romain Bourdy
> Cc: full-disclosure; Inc leartext
> Subject: Re: [Full-disclosure] password.incleartext.com<http://password.incleartext.com>
>
> Actually, if they can get the data back (be it because it's stored in
> plaintext or in obfuscated plaintext) then it's not secure. Obfuscation
> doesn't make it more secure, or any less plaintext. On Wed, Apr 6, 2011
> at 11:01 AM, Romain Bourdy
> <achileos () gmail com<mailto:achileos () gmail com><mailto:achileos () gmail com>> wrote: Hi
> Full-Disclosure,
>
> Just my two cents but ... the fact they can give your password back
> doesn't mean it's stored in cleartext, just that it's not hashed but
> encrypted with some way to get the original data back, this doesn't mean
> at all it's not secured, even though in most case it's not.
>
>  -Romain
>
> On Wed, Apr 6, 2011 at 1:36 PM,
> <Maksim.Filenko () fuib com<mailto:Maksim.Filenko () fuib com><mailto:Maksim.Filenko () fuib com>> wrote: Kinda
> plaintextoffenders.com<http://plaintextoffenders.com><http://plaintextoffenders.com>?<http://plaintextoffenders.com%3E?>
>
> wbr,
>  - Max
>
> full-disclosure-bounces () lists grok org uk<mailto:full-disclosure-bounces () lists grok org 
> uk><mailto:full-disclosure-bounces () lists grok org uk>
> wrote on 01.04.2011 02:17:24:
>
> > Inc leartext <staff () incleartext com<mailto:staff () incleartext com><mailto:staff () incleartext com>>
> > Sent by:
> > full-disclosure-bounces () lists grok org uk<mailto:full-disclosure-bounces () lists grok org 
> > uk><mailto:full-disclosure-bounces () lists grok org uk>
> >
> > 01.04.2011 13:14
> >
> > To
> >
> > full-disclosure () lists grok org uk<mailto:full-disclosure () lists grok org uk><mailto:full-disclosure () lists 
> > grok org uk>
> >
> > cc
> >
> > Subject
> >
> > [Full-disclosure]
> > password.incleartext.com<http://password.incleartext.com><http://password.incleartext.com&gt;
> >
> > Hi FD,
> >
> > Just launched a new website to keep a list of websites storing
> > passwords in clear text, so far the database is small but feel free
> > to add some:
> > http://password.incleartext.com/
>
> > Cheers,
> > Inc Leartext_______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
> --
> "My daughter was asked by a little old lady in a London hotel restaurant
> what her daddy did - she answered, 'He's a pirate.' I was very proud of
> that answer." - Johnny Depp

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/