1

I just found out that an e-commerce platform (similar to Shopify) I was planning on using allows me to see my password. I know I can't assume anything and I should (probably) just run away from it, but it got me curious: is there a way to do it securely?

I mean, what if they use the password's hash as an encryption key to encrypt the password itself? If done properly, could something like this be a reasonable solution?

Moreover, does anyone have any idea why on earth an e-commerce platform would choose to do it?

And no, I don't plan to implement anything like this.

Improve this question
2
  • 3
    Is the assumption that you have to provide your password to see your password? Isn't that like a solar-powered flashlight? Or your password is somehow cached on the server to unlock the password to show it to you? Isn't that incredibly insecure to keep the plaintext password hanging around in server memory "just in case"?
    – schroeder ♦
    Sep 24, 2020 at 18:33
  • Pretty much, LOL. I found this on the password change page. Instead of actually displaying the password, they use a disabled password input box (from which I was able to recover the password itself). Maybe they did that in order to display the previous password's length. Tbh, that's the very reason I doubt they do it securely (as it's a quite stupid solution).
    – Luca Carvalho
    Sep 24, 2020 at 18:41

2 Answers 2

Reset to default
2

If I understand correctly, it sounds like you logged in, then you navigated to the change-password page, then the site populated the disabled password input box with your existing password, then you were able to recover your existing password from this disabled password input box. If that's the case, then the site is storing your plain-text password - either from the time when you logged in, or permanently in their user database. Either way, it's bad.

With regard to using a hash of the password as the key to encrypt the password - see https://crypto.stackexchange.com/questions/51820/is-it-safe-to-use-the-hash-of-the-data-as-the-key-to-encrypt-them for some interesting thoughts around this method. Notwithstanding, I don't think this is what is at play here, because it just becomes a cyclical problem - the site would not be able to populate the disabled password input box with the password encrypted in this manner, without knowing the password.

Improve this answer
2
  • it's possible they only store the password client-side and don't retain it on the server.
    – dandavis
    Sep 25, 2020 at 19:56
  • @dandavis Thanks for your comment. I thought about that too, after I posted this answer. But, I'm hardpressed to think of a good reason why the developers would have done this. Regardless of whether the password is being stored on the server or on the client, it smells like a bad design to me.
    – mti2935
    Sep 25, 2020 at 20:20
0

Is it this feature requested (and added) here?

Add "Show password" checkbox to password field

That's for letting users to see the password they have just typed in to make sure there's no typos in it. That's just an alternative of making them type it twice. Once confirmed, it's hashed (or at least it should be, but I don't really know the platform).

Improve this answer
1
  • Not at all. On the password changing page, there's a disabled password input box, from which I was able to recover the actual password. Maybe they did it in order to display the old password's length or something (as you have to confirm it in order to register a new one). And that's the very reason I highly doubt they did it securely.
    – Luca Carvalho
    Sep 24, 2020 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .