1

I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext.

Last week I installed a VPN add-on for Firefox then created an account and changed the default password before using it. It is good and also fast, but a few days later, when I checked my spam, I saw that the VPN provider sent me an email dated on the day I changed the password, with my password in plaintext. I thought it could be just a bug on their side.

So what I did next was to try to forgot my password, to see if they would send me my actual password or a reset link. But unfortunately they sent my password back in plaintext.

I sent them an email to their support but I didn't get a reply. After a few days of silence, I wrote a review on their Firefox page and sent a report abuse. After an hour they emailed me saying that:

they need to be stored plain because of vpn authentication. you send them there plain. Otherwise they cannot work

My question is, is it true that they need to store the password in plaintext to make the VPN works? Or it is just beyond there capabilities to safely store user credentials?

Just think about the users that use the same password on their other accounts. That could be the case for most of us.

Thank you.

Improve this question
4
  • I'm not confident about your specific example, but if they say they have to store it as "plain text", is not good. Maybe they mean they store your password in a two-way encryption as it needs to be retrieved in order to be used to authenticate to the VPN. Maybe they didn't want to explain too much to you (I hope so). Anyway, its better if you set a really difficult and unique password for this one (you do it always anyway, right?) as you don't know how they are really handle it (and they don't help too much in explaining it). Better to be safe.
    – lepe
    Apr 26, 2016 at 5:55
  • When you say "Or it is just beyond there capabilities to implement an encryption for there users.", are you asking about securely storing user passwords?
    – Yuriko
    Apr 26, 2016 at 6:14
  • @lepe yeah luckily i used different password. the only problem I see in two way encryption, is that they can decrypt it. now the probability of other users that will use the same password as the password of there other online account is high. and when i read there privacy statement, if i remember it correctly that they will collect what are you browsing. I think system that use two encryption is the systems way back early to mid 2000's
    – zer09
    Apr 26, 2016 at 8:16
  • @Yuriko I mean, they don't know how to encrypt user credentials or they just don't want it.
    – zer09
    Apr 26, 2016 at 8:19

1 Answer 1

Reset to default
1

Yes, they need your plaintext password to make the VPN work, simply because their service is badly configured. They shouldn't need your password in plaintext.

The problem is that they use your plaintext password in their authentication procedure. When a new user creates an account, the VPN provider should properly hash their password and use that hash to authenticate them. From what I see, their service is badly configured.

Note that, when you changed the password the first time and they sent you your new password in plaintext, it doesn't mean that they stored your password in that format. They could have sent you that email before hashing it and storing it in their database. (Although sending any credential by email is a bad idea.) However, getting your password in plaintext when using the lost password feature proves it.

Improve this answer
2
  • So you mean that it doesn't need to store the user credential in plane text for there service to work?
    – zer09
    Apr 26, 2016 at 8:01
  • 1
    What I mean is that they shouldn't need it. If the authentication procedure was correctly implemented, they wouldn't need it. In your case, it's badly implemented, so they need it. If they make that mistake, they can make others, you should find another VPN provider.
    – Yuriko
    Apr 26, 2016 at 8:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .