Full Disclosure mailing list archives
Re: password.incleartext.com
From: Inc Leartext <staff () incleartext com>
Date: Thu, 7 Apr 2011 17:04:10 +1000
Hi FD, thanks Thor for the secure version of the recovery process... we will make sure we include a time component during our testing process to ensure no human interaction is involved. We are now on twitter to add some lulz and media whoring: https://twitter.com/#!/incleartext. Cheers, Inc Leartext. On Thu, Apr 7, 2011 at 4:38 PM, Peter Osterberg <j () vel nu> wrote:
I can see how it can be stored securely, but how would distribution after recovery be accomplished? In an envelope? Or by sending me a one-time random https-link where I can retrieve it myself? Sounds like more trouble compared to what can be gained from it. Wouldn't it be just as easy to send a one time password that needs to be changed... Too impracitcal to be implemented in a real-world situation... This is probably why I still wouldn't hesitate to say that it is insecure if it is in clear text. Even though I must give you credit for having shown a way to do it. ;-) I am sure someone will come and beat me with saying that they already did this. :-p Ppl do all sorts of crazy stuff just because they can... Thor (Hammer of God) skrev 2011-04-07 06:27: One way to handle this would be to take the password on signup and both hash it and encrypt it with the recovery key’s public key in 2 separate fields (a hash field and an encrypted field). That way you’ve always got a hash of it for validation even if you lose the keys. Of course, you could still always re-encrypt it to see if the two values matched, but I would probably continue to use the hash for logon validation. The private key would be stored on a completely separate machine/instance which was only used for recovery purposes. There could be any number of ways to validate the actual recovery request, but that way you separate out the encrypted data from any on-machine ability to decrypt it. I wouldn’t have the private key in memory on the same box because that makes it trivial to decrypt, but of course it all depends on what problem we are trying to solve. t *From:* Cal Leeming [mailto:cal () foxwhisper co uk <cal () foxwhisper co uk>] *Sent:* Wednesday, April 06, 2011 11:58 AM *To:* Peter Osterberg *Cc:* Thor (Hammer of God); Mario Vilas; Romain Bourdy; full-disclosure; Inc leartext *Subject:* Re: [Full-disclosure] password.incleartext.com Tbh, I'd be unhappy about any company storing a password in anything other than a hash of itself. But, like many things in life, we have absolutely no control over it, so best to just use a new pass for every external service :) On Wed, Apr 6, 2011 at 7:48 PM, Peter Osterberg <j () vel nu> wrote: Security is relative and the pwd might be handled in a secure enough fashion compared to the value of the information it is protecting, even though it is stored in a reversable fashion. But I wouldn't, generally speaking, hesitate to claim that it isn't stored securely if it is reversable. Could you givd an example? ----- Ursprungsmeddelande -----This isn't necessarily true - without knowledge of how the data may be encrypted and what processes are involved in decrypting the data, one can't make the "it isn't secure" statement. That being said, it is probably safe to argue that sites that do not require PCI, SOX, HIPPA, etc would be less inclined to engage in this level of security. But that doesn't mean that it is not being done. t From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk<full-disclosure-bounces () lists grok org uk>]On Behalf Of MarioVilas Sent: Wednesday, April 06, 2011 9:05 AM To: Romain Bourdy Cc: full-disclosure; Inc leartext Subject: Re: [Full-disclosure] password.incleartext.com Actually, if they can get the data back (be it because it's stored in plaintext or in obfuscated plaintext) then it's not secure. Obfuscation doesn't make it more secure, or any less plaintext. On Wed, Apr 6, 2011 at 11:01 AM, Romain Bourdy<achileos () gmail com<mailto:achileos () gmail com <achileos () gmail com>>>wrote: HiFull-Disclosure, Just my two cents but ... the fact they can give your password back doesn't mean it's stored in cleartext, just that it's not hashed but encrypted with some way to get the original data back, this doesn't mean at all it's not secured, even though in most case it's not. -Romain On Wed, Apr 6, 2011 at 1:36 PM,<Maksim.Filenko () fuib com<mailto:Maksim.Filenko () fuib com<Maksim.Filenko () fuib com>>>wrote: Kindaplaintextoffenders.com<http://plaintextoffenders.com>? wbr, - Max full-disclosure-bounces () lists grok org uk<mailto:full-disclosure-bounces () lists grok org uk<full-disclosure-bounces () lists grok org uk>>wrote on 01.04.2011 02:17:24:Inc leartext <staff () incleartext com<mailto:staff () incleartext com<staff () incleartext com>>>Sent by: full-disclosure-bounces () lists grok org uk<mailto:full-disclosure-bounces () lists grok org uk<full-disclosure-bounces () lists grok org uk>>01.04.2011 13:14 Tofull-disclosure () lists grok org uk<mailto:full-disclosure () lists grok org uk<full-disclosure () lists grok org uk>>cc Subject [Full-disclosure] password.incleartext.com<http://password.incleartext.com>Hi FD, Just launched a new website to keep a list of websites storing passwords in clear text, so far the database is small but feel free to add some: http://password.incleartext.com/Cheers, Inc Leartext_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -- "My daughter was asked by a little old lady in a London hotel restaurant what her daddy did - she answered, 'He's a pirate.' I was very proud of that answer." - Johnny Depp_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- The US Government Officially Confirms the Existence of Extraterrestrial Civilizations, (continued)
- The US Government Officially Confirms the Existence of Extraterrestrial Civilizations Valery Marchuk (Apr 01)
- Re: password.incleartext.com Maksim . Filenko (Apr 06)
- Re: password.incleartext.com Romain Bourdy (Apr 06)
- Re: password.incleartext.com Mario Vilas (Apr 06)
- Re: password.incleartext.com Thor (Hammer of God) (Apr 06)
- Re: password.incleartext.com Peter Osterberg (Apr 06)
- Re: password.incleartext.com Cal Leeming (Apr 07)
- Re: password.incleartext.com Thor (Hammer of God) (Apr 06)
- Re: password.incleartext.com Peter Osterberg (Apr 07)
- Re: password.incleartext.com Inc Leartext (Apr 07)
- Re: password.incleartext.com Romain Bourdy (Apr 06)
- Re: password.incleartext.com Cal Leeming (Apr 07)
- Re: password.incleartext.com Valdis . Kletnieks (Apr 07)
- Re: password.incleartext.com Cal Leeming (Apr 07)
- Message not available
- Re: password.incleartext.com T Biehn (Apr 06)
- Re: password.incleartext.com Romain Bourdy (Apr 06)
- Re: password.incleartext.com Valdis . Kletnieks (Apr 06)