2

I'm trying to understand how a service Snaplytics trusted by some high brand companies is able to collect their clients password for snapchat and store them in their db while being able to log in to their Snapchat account periodically. My understanding for storing passwords is to use a safe method like bcrypt. To never store plain text passwords. But if Snaplytics is periodically logging into accounts, they need the plaintext password to log into Snapchat. But I'm pretty sure bcrypt is a one-way hash function so how does snaplytics manage to "secure" clients password along with logging into their account.

Below is an image of requesting passwords where they state that "your password will be encrypted and stored securely"

enter image description here

Improve this question
4
  • 1
    They're promising something they can't keep: "neither Snaplytics nor anybody else will have direct access to your information" is of course wrong. Snaplytics will have full access to your information. What they mean is that they promise not to look at parts not relevant to their business, even though they could. OAuth was designed to solve such issues, but unfortunately snapchat doesn't seem to have an OAuth API, so there really is no other way for Snaplytics to provide their service.
    – Out of Band
    Commented Jun 3, 2017 at 19:11
  • This looks line a bad webservice. They don't seem to understand how to use OAuth and they don't seem to be able to handle user passwords correctly. Do not trust this website. If you have already given them your snapchat password them change it as soon as possible.
    – BlueWizard
    Commented Jun 4, 2017 at 21:52
  • 1
    Even if you trust snaplytics: don't. Theese people are clearly doing it wrong. When snaplytics get's breached then the intruders have access to your plain text user password (because "encrypted" isn't hashed)
    – BlueWizard
    Commented Jun 4, 2017 at 21:53
  • 1
    @BlueWizard Pascal noted in his comment that Snapchat doesn't provide an OAuth service, so Snaplytics appears to be using the best option available to it. Not to endorse this service specifically, but it isn't unreasonable for someone to find the benefits of analytics worth the tradeoff of increased risk.
    – IllusiveBrian
    Commented Jun 5, 2017 at 13:57

1 Answer 1

Reset to default
3

Snaplytics says that they encrypt the password, not hash it. When data is encrypted, it can be decrypted back to the original plaintext with the use of a key, which Snaplytics hopefully keeps secure internally. In this way, the passwords are not stored in plaintext and are difficult to retrieve if Snaplytics' database is compromised, but when Snaplytics needs to log in to a user's account they can retrieve the plaintext password just long enough to authenticate with Snapchat. I took a cursory look over their site and don't see any information about what specific encryption they are using.

You are correct that when you are running a service which uses password authentication, you should hash passwords before storing them in the database because you do not need the actual plaintext password. However, Snaplytics has to transmit the password to Snapchat in plain text so Snapchat can (hopefully) hash it on their end and use it for authentication, so Snaplytics does not have the option of storing it via a one-way hash.

Improve this answer
3
  • Nice answer. I'd like to underline a detail: There's no guarantee that a hacker will only be able to steal the encrypted database, and not the decryption key, or the decrypted content. IllusiveBrian's use of "difficult to retrieve" is exactly right - it's just more difficult, but not necessarily too hard or even impossible to do.
    – Out of Band
    Commented Jun 3, 2017 at 19:18
  • when someone is able to copy your database then this someone is also able to steal your memdump or passwords.txt or wherever you keep the password.
    – BlueWizard
    Commented Jun 4, 2017 at 21:56
  • @BlueWizard Not necessarily, the database could be leaked with, say, a query injection without exposing the actual key. I don't know whether Snaplytics does this, but they could also retrieve the keys from a HSM and wipe them from memory immediately after use.
    – IllusiveBrian
    Commented Jun 5, 2017 at 13:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .