127 reputation
3
bio website
location
age
visits member for 2 years, 5 months
seen Dec 9 at 23:18

Dec
9
awarded  Commentator
Dec
9
comment What to do about websites that store plain text passwords
Storing a password in plain text is never better than storing it hashed, and you haven't given any examples to the contrary. You are right. It gives everybody more time to react should a leak happen. People tend to reuse passwords, so this is certainly valuable. I'll delete my "answer" lest I get even more downvotes.
Dec
9
comment What to do about websites that store plain text passwords
Sure I can. I can bruteforce it. Since the input was not not uniformly distributed ('password1' is more likely than 'asd865$*sdf.aa'), I stand a good chance of getting reasonable results reasonably quickly.
Dec
9
comment What to do about websites that store plain text passwords
I wouldn't compare hashing passwords to locking house doors. It is more like installing bars on windows, something "extra". And yes, you should not bother installing barred windows if you have just a cheap lock on your door and the door can be easily kicked open anyway. Web apps usually have ton of problems with web security: XSS, SQL injections and so on. One should focus on that and not waste too much time on what is essentially obfuscation. Chrome browser developers know that news.ycombinator.com/item?id=6166731
Dec
9
comment What to do about websites that store plain text passwords
I never said anything about keys when I spoke about hasking. All I said is And any hashing scheme will be broken eventually, given enough compute power. and I stand by it.
Dec
9
comment What to do about websites that store plain text passwords
Exactly. Encrypting or hashing the passwords leaves you with a false sense of security. With encryption, the attacker will probably get to your passwords and key at the same time. And any hashing scheme will be broken eventually, given enough compute power. With plaintext, you always know where you stand. There is no pretense of endpoint security. Endpoints will be insecure whatever you do. Look for example at the recent well publicized SSL bugs. Instead, focus on securing the communication, which is the only area where you stand a chance to make a meaningful increases in security.
Dec
9
comment What to do about websites that store plain text passwords
@ChrisMurray In addition to that, plaintext gives you the flexibility to use multiple auth methods for different things. Let's say that I want to authenticate visitors on my webpage with HTTP Digest. I need to have plaintext passwords for that.
Dec
8
comment What to do about websites that store plain text passwords
@ChrisMurray Plaintext gives you the possibility to upgrade your authentication scheme if something better becomes available. Sometimes you are not able to perform the upgrade if you have stored is the hash. Then you have to keep using the old, less secure authentication scheme.
Dec
8
comment What to do about websites that store plain text passwords
Message to downvoters: don't just downvote, say why you do not like my answer. Storing passwords in plaintext is a good and common practice in the Jabber world.
Dec
8
answered What to do about websites that store plain text passwords
Apr
25
comment What is the most hardened set of options for GCC compiling C/C++?
@RJFalconer Compiling as X86_64 gives the application a lot more virtual address space. The ASLR is then more effective, since there is more addresses to choose from when randomizing.
Jul
19
awarded  Supporter
Sep
12
comment How to store salt?
Polynomial: You are right. I was so eager to post the article (I had it in my bookmarks and got excited that its time finally came) that I just skimmed over your answer and completely missed the last paragraph. Sorry
Jul
20
awarded  Teacher
Jul
20
answered How to store salt?