Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

On the face of it, PTO seems like a good idea in educating people about password security.

On the other hand, if I were an attacker, PTO would be the first place I would start if I wanted to start collecting a list of plaintext passwords.

share|improve this question
10  
I thought that was one of the main reasons the site existed. –  David Murdoch Jun 17 at 14:21

3 Answers 3

Not really.

Knowing that example.com is a plaintext offender doesn't help me much in mass-compromising accounts for that website. I could try to compromise their peering-router to sniff all their outgoing emails, but that would be quite difficult, because that router is likely to be properly secured. Trying to attack their website itself is likely more promising.

The more plausible attack scenarios which become possible through plaintext offenders target the individual user and all websites they use, not all users of the individual service. When an attacker could read the mail communication of a private user (much more plausible than with a professionally administrated system), they can obtain their login credentials for all plaintext-offending services they register to. That means an attacker would rather be interested in finding vulnerable users so they can get logins for random websites, not finding a vulnerable website to get logins from random users.

Besides, finding out which sites are PTOs is trivial: You just have to register an account and you know. Fully automatic account registration is something spammers got frighteningly efficient at.

share|improve this answer
10  
The most promising route might be to try to get a job with them, particularly one that includes the prospect of database access... –  Julia Hayward Jun 17 at 11:30

This is the usual vulnerability disclosure debate: when you find a vulnerability, what do you do with it ? Bringing it to the public view right away can be considered as "helping the attackers"; however, discussing it in private with the affected systems' operators or vendors can turn unpleasant; in particular, some vendors or server owners are prone to consider any such private warning as an attempt at extortion, and call the cops.

Some security researchers want money out of their work; many others want fame; quite a few want both. Publishing the security issue immediately is of questionable responsibility, but is "safer" for the researcher and has the highest probability of bringing fame (and the lowest probability of bringing money).

Compounding the issue is the idea that a "plaintext offender" is a site designed and managed by people with only cursory knowledge of information security; therefore, they cannot be expected to react with the technical alacrity and mutual respect that would be most liable to induce an happy outcome (researcher gets the money and the fame, vulnerability is fixed, the server owner appears as a good and efficient manager of security issues). From the point of view of an honest researcher, such sites look like trouble. You can have a quiet technical chat with Google or Microsoft; with a site that stores plaintext passwords (and, more often than not, sends them by email !), drama is a definite possibility.

As others have noted, storing passwords in plaintext does not really make attacks more likely; they make them more devastating when they occur. The targets are not easier, but juicier. In that sense, PTO does not really help attackers.

(The overall strategy of PTO is to become known enough to the general public to be able to exert some pressure on site owners, ultimately resulting in a safer Web altogether. That's education through point-and-shame -- it should theoretically work in a capitalist free market, customers being the ultimate force. However, I don't see PTO as having achieved that level of fame yet, by a long shot. They need a logo, a cleaner Web site, promotional videos, and endorsement by George Clooney, at least.)

share|improve this answer

I agree with the notion that all knowledge can be used for both good and evil but in the case of PTO I honestly believe their main goal is to "shame" sites that store user passwords in plain text and thereby put the users at a security risk.

As they mention on the site, even if the user was smart enough and created the strongest password possible, if the website stores it in plain text or uses easily reversible encryption then it's vulnerable.

I think it's about educating people about password security but also criticizing or shaming websites that don't take the necessary precautions to protect their user's account information.

share|improve this answer
3  
Why is a password vulnerable because a website stores it in plain text? The password is only vulnerable if the website suffers a breach, which is very different to it being vulnerable in general. –  paj28 Jun 17 at 16:45
5  
Website vulnerability is a separate matter yes, but a website must ensure that in the event of a breach, however dangerous it may be, user information (specially security information) leakage is kept to a minimum so the users themselves do not suffer (or suffer less) from the attack. On a totally separate note, in the case of PTO, they also criticize websites that send passwords via email, which is an unsafe medium. –  Abbas Javan Jafari Jun 17 at 16:54
3  
@paj28 Many people use the same password on different sites, so even after an attacker gets complete control over your database, things can get even worse for your clients if their passwords are available in plain text. –  Cory Jun 17 at 18:27
2  
@paj28 *when the website suffers a breach. –  daviewales Jun 18 at 0:18
    
@paj28: Because it's not actually different from being vulnerable in general. Any nation with a military will tell you that you need multiple lines of defense: this is why most of them have bases scattered throughout the homeland where they keep some troops, even if they send the most of their militaries to the borders or even beyond. Otherwise, if the border guards are defeated or somehow sidestepped (and given enough time, this WILL eventually happen) they're helpless. Proper password storage is the same: a last line of defense in case the worst occurs. –  The Spooniest Jun 18 at 12:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.