3

I want to easily recover user passwords if required. I hash them using bcrypt but I tried to backup non-hashed passwords into a plain text file (*txt) not accessible over the internet. Is that correct and secure?

I'm using a secure password for VPS remote desktop. I don't think there's any way it could be grabbed, but just wondering this is even a correct approach?

9
  • 3
    You should not know user passwords. That's the core principle here. On top of that, you should not be sending live plaintext passwords to users. So everything about this is not OK. Please look up design patterns for "secure password reset". This is the top hit: cheatsheetseries.owasp.org/cheatsheets/… and this is the 2nd: troyhunt.com/everything-you-ever-wanted-to-know – schroeder Jun 23 at 12:14
  • 5
    No, this is absolutely NOT okay!! – MechMK1 Jun 23 at 12:20
  • Why do you need to know the passwords? – reed Jun 23 at 12:21
  • send them back to user if they forgot them, they email me i copy paste them – user260338 Jun 23 at 12:31
  • 2
    That's literally "accessible over the internet". – schroeder Jun 23 at 12:43
11

No, it is not OK.

  • It's the 21st century. Devices which are truly "not accessible over internet" are a rarity. How are you going to keep that file up-to-date? Are you seriously storing it on a closed shell system without a network connection and transcribe passwords manually by hand while physically sitting at the system? If you update it via network, then the file is accessible over the internet. Perhaps not directly, but in a way a skilled attacker could exploit nevertheless.
  • The file is vulnerable to an internal attacker. Anyone with access to the file has access to all the user accounts. They could potentially leak those passwords or abuse them themselves.
  • If the main purpose of the file is to provide account recovery, then the file is vulnerable to you falling victim to a social engineering attacks ("I really am Bob from accounting. Can you tell me my password?").
  • It's a violation of your users privacy. A lot of people use the same password for everything. We keep telling them that they shouldn't do that. But they don't listen. This means that this password list might allow you and anyone else with access to it to take over your users email accounts, social media accounts, confidential correspondence via chat apps and perhaps even financial or medical information. And there is no easy way to find out that your list was the leak.

If you want to recover passwords, then follow the standard procedure.

  1. Send a one-time reset code to the user via email
  2. Have them enter that reset code on a web portal
  3. Have them enter a new password of their choice, which you promptly run through an irreversible hash function and then scrub from memory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.