1

I have a third party app that records the password from every login attempt (regardless of success or failure). Is this a standard operation and does it really serve any meaningful security purpose? Not in a special honeypot scenario, but a standard business application.

Also, this implementation seems like a totally insecure obfuscation... is there a standard approach that would produce this output?

552A26043B56E619 - computer
752A26043B56E619 - Computer
5E2A3E072B - house
7E2A3E072B - House
  • Using this application is a security risk because you are effectively storing passwords insecurely. Also, if anyone logs in with the wrong password that is a valid password on another system, you are risking your users' security by enabling this. – SilverlightFox May 24 '16 at 9:11
  • @SilverlightFox Thanks... I'll add to the long list of complaints but this goes on the top. We cannot disable but we should be able to flush the table frequently. – Dave May 24 '16 at 15:27
2

The only time I've ever seen anything similar to this is in Dovecot (IMAP email server) where you can optionally configure it to log a hash of the password attempted for troubleshooting/debugging purposes.

However, even with Dovecot (which is an implementation I would trust more than what yours appears to be), it is only something I would enable temporarily for troubleshooting/debugging.

The reason is that a plain hash of a password is equally bad because you can perform brute-force attacks to guess the password.

There's a reason people use secure mechanisms such as PBKDF2 to hash passwords, and doing the sort of thing your software does (or leaving the Dovecot feature permanently enabled) essentially eradicates the whole point of the stronger hashing algorithms such as PBKDF2.

Therefore I would suggest you strongly ask the developers of your third party app to either remove the password logging function completely or introduce an option to disable it.

2

I can't see any security claims to the application to store the clients inputs. Also, the "ciphertext" seems to be reversible (instead of a hash). It's a bad practice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.