Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I was implementing my webapp, I decided to hash and salt users' passwords in order to protect them, even though I knew that there will never be a lot of them ... if any. Of course, I'm not saying that my implementation is perfect and will stand on the face of potential attackers, but at least I tried.

I thought this is how things work.

But after many big names in the tech industry were hacked (Sony, Adobe, Yahoo! ...), I found out that they are not hashing passwords and if they do, they don't salt them. I even read somewhere on the news that OkCupid is storing passwords in PLAINTEXT !

I am not a security guy, but I'm sure that some of you work(ed) for these companies or ones that are as big (and as reckless). So, maybe you can answer my question :

Why does a huge company with as many users decides NOT to take necessary measures to protect them ? What am I missing ?

share|improve this question
3  
If my experience taught me anything, it is to not question why people would do stupid things - and never to assume that "noone can be that stupid" to do something really dumb. –  Jan Schejbal Dec 8 '13 at 2:28
1  
HBGary en.wikipedia.org/wiki/… didn't salt their hashed passwords... look what happened to them. –  K7AAY Dec 10 '13 at 1:35
    
Because they haven't seen the reasons why they should, and the default (if you don't know anything about security) is to neither salt nor hash. –  immibis Jun 24 at 6:44

3 Answers 3

It's not possible for anyone who didn't make their decision to make an authoritative comment about why they chose not to hash & salt the passwords. That said, the companies that didn't hash & salt did the 'wrong' thing from a security perspective. The only time you encrypt is if you need the original secret back. The only time you hash without salting is if you need the same value to hash to the same hash every time (or for backward compatibility in rare cases).

share|improve this answer
    
Of course, I am aware that this kind of decisions can only make sense to those who made them. That's exactly whay mentioned those who "work(ed) for these companies or ones that are as big (and as reckless)" ;). In the other hand, I believe that companies like those one have the ability (at least technically and financially) to come up with better solutions (like temporary passwords to use internally where needed instead of leaving real passwords unprotected ...) –  ahmed Dec 8 '13 at 15:48

This is speculation, of course, but they may have implemented their original system before security was at the front of everyone's minds.

Once you've implemented a system like that, you tend to reuse it in many places, and so you build up a lot of dependencies on it. And once you have dependencies, making changes becomes very expensive. Even if they had knowledgable people telling them it was insecure, and they need to change it, the cost would likely have been higher than the perceived risk.

Until the risk is realized. Then they learned the hard way that they need to take such things very seriously.

share|improve this answer
    
I can't understand that a company, who is selling software for hundreds of dollars apiece, would not invest (even if this is a heavy investment) in protecting me in the Wild Cyber Web ! This may NOT justify what they're doing, but it may explain it. I hope they learnt that nobody is safe any longer, even if it's called Sony, Yahoo or Adobe ... –  ahmed Dec 8 '13 at 15:52
2  
Instead of spending a $1,000,000 to redesign the database to be secure, perhaps they chose to spend $50,000 on firewalls. Risk management is a complex game of numbers. Nobody wants to spend money they don't have to, especially if it won't increase their profits. And they could only guess at the risks and damages possible. It's like the old saying, "You always have 20/20 vision with hindsight." –  John Deters Dec 8 '13 at 19:10

Of the systems and sites which have been developed recently, there are two main reasons why any company would store passwords in un-hashed and -salted plaintext.

Option 1: They didn't think about it when creating the storage medium. As has been seen often in the past, security (both computer and otherwise) isn't something people think about until they feel they need it. In some parts of the world, people leave their front doors unlocked, and their neighbours will come over and make themselves a cup of tea whilst they wait for the owner to come back. Only once they have something stolen do they rethink that plan. Similarly, how many times have you used, or seen someone else using, an insecure password to access something... like your date of birth or 1234 for your credit card PIN, "password" for a website, etc? It's the same as closing your front door but not locking it. Fine, until someone malicious wants to gain access.

Option 2: They thought about it, and decided they didn't need it. I've seen companies say "If we have a site which stores no personal information, does not handle any monetary transactions, and otherwise has nothing of value, then there is no real issue with not having security, is there?". Unfortunately they are always wrong in this for one reason, and sometimes for a second also. The first is that people reuse passwords. If they have the same password on this unsecure storage medium as they do for their email or banking, they have a problem. Although not the company's responsibility, it's a small thing they could do to help the security field as a whole. The second reason this is wrong is that things of no actual value often have perceived value. Take for example your reputation - often internet forums are completely anonymous, and hold no personal information about the user. If someone else could access your account and make disparaging remarks about others, the reputation of your digital identity would be harmed, even though you have not lost anything with any actual quantifiable value.

In simple terms, security is something often bolted on at the end of any software development lifecycle, rather than thought about carefully from the ground up. Many systems will have the "secure" method of salted and hashed passwords added into the system shortly before release to testing. Although it's good they have it in, there's flaws with this way of thinking, as the rest of the system may have vulnerabilities which preclude the security steps they have taken from being of any use. The NTLM authentication for Windows is an example. This hashed password is very effectively protected against brute-force attacks, however if the system still has the old LM password hash (for the same password) stored alongside the better method, you can dramatically reduce the time needed to break the NTLM password hash by first breaking the LM password hash.

Even people who should know better are storing passwords in plaintext. Whenever you get an email confirmation from a website you've signed up and they tell you what password you've used, my recommendation is to delete your account immediately. One fine example of this until a couple of years ago was none other than the British Computing Society (who should certainly know better!)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.