3

I tried to update my Pokerstars' account password today and I was presented with the following error:

Pokerstars error message

My question is, what security vulnerabilities might be behind the "Your password must start with a letter" and "may not start with the letters 'tmp'".

I assume this is due to some sort of hacky way to check for temporary (not yet activated) accounts on their side? If so, does it mean they're storing it in plain-text? Am I missing something here?

  • There are no general vulnerabilities that would be indicated by these specific restrictions. There are no reasons specifically to believe there are any vulnerabilities at all here. If there are, one would need specific knowledge of this system to be able to determine it. As such, this question is not a good fit for the site. – Xander Sep 25 '16 at 0:55
  • 1
    Hi Xander, It is my understanding that any login system should use a secure hashing mechanism before storing the passwords. That been said, I don't see any reason to constraint the password format to start with a letter and the first 3 letters be different from a specific string. That alone would facilitate the job in case of a brute-force attack. My question here is to simply check if there are any technical reasons that can explain these rules. – hugomarisco Sep 25 '16 at 1:40
  • 2
    HI Hugo, yes, general wisdom is that passwords should be hashed. These constraints have very little impact on the brute force search space. No one can tell you if there are technical reasons for these constraints without knowing how the specific technical details of this specific system. – Xander Sep 25 '16 at 1:47
  • It does imply that their use of passwords contains structural information (i.e. data other than just a password) and such information can only be recovered from the cleartext. This does not necessarily mean the password is stored as cleartext, nor that the cleartext is recoverable from the stored password but does raise concerns about the quality of programming. – symcbean Sep 25 '16 at 1:51
  • They may have/had an issue with some awful code that crashed when the password started with tmp and this is a (hopefully) temporary fix until the actual bug is fixed. – André Borie Oct 26 '16 at 20:59
1

While a definitive answer can only come from the origin of the message and the restrictions, there are some points to make.

The general idea of restricting passwords in such a way (especially with the tmp-part) suggests something is not as it is supposed to be and hinting at plain text passwords. Yet for the benefit of the doubt, they might use a special hashing scheme that hashes the first three characters of the password separately, allowing them to check for temporary assigned passwords.

This might pose a threat, depending on what comes after the tmp part: if thats just 5 numbers, the search space for enumeration on such passwords is tiny, for example.

In any case, this restriction hints at them using passwords to store information that does not belong there (but in a separate field in the database) - and while it doesn't have to pose a threat by itself, deploying such techniques is generally a sign for bad software engineering.

This by itself can pose a threat: Bad software developers are more likely to make mistakes on many levels that only wait to be found and exploited.

Whatever might be the reason for them to deploy this restriction, it is a sign of bad programming and/or bad software or database engineering and thus a sign of danger; you should use a disposable, strong password and basically consider the account compromised to be on the safe side.

  • My only nitpick is that they aren't necessarily doing anything with the first three letters of the password, although that is certainly a possibility. They might generate passwords that start with tmp themselves, and for whatever reason don't want people also using such passwords. That doesn't mean though that they are actively looking for such data in the actual passwords though. For sure, these password restrictions (except perhaps #2) imply that they don't really understand secure passwords, so I definitely agree with your answer. – Conor Mancone Dec 1 '17 at 15:23
  • @ConorMancone if they don’t do anything with the first three letters, there is no point in singling them out. Yet, who knows what they might had in mind. – Tobi Nary Dec 1 '17 at 15:26
  • Yeah, that's true too. When it comes to security though, I've noticed that when people don't really understand what they are doing, they tend to throw more stuff at it in an attempt to make it "more" secure. It wouldn't surprise me if the tmp has absolutely no meaning in their system, and they put that rule in because it seemed like a good idea to someone. However, we'll never know, and it is best to do what you say: assume the worst and use a unique and strong password for that site. – Conor Mancone Dec 1 '17 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.