How can a site know about insecure password?

Question

I received an email from my web host recently that informed me I had an "insecure" password on one of my email accounts and that I had to change it.

Their definition of what a secure password is as password that contains:

Mixed case - Always use a combination of uppercase and lowercase characters
Numbers - Always use a mixture of numbers and letters
Special Characters - At least one of the following special characters !"£$%^&*()-_=+{}#\@':;.>,<\|?
Length - Your password must be at least 8 characters long
Unique Characters - Your password must contain at least 4 unique characters

Whereas I follow the http://xkcd.com/936/ policy of a very long password (over 40 characters and 166bit of entropy (according to KeePass).

I am trying to think how they know what my password is (in order to tell me the digits it does not contain) without storing it in plain text.

The only "good" idea I have is that they have stored it encrypted and have decrypted it, analysed the plain text for "security", then deleted the plain text. But then I don't like that idea much given how easy it would be to decrypt if the site was compromised and the encryption key presumably also taken.

My other idea was that when I entered my password and before salting and hashing it, they gathered some statistics of the type of characters it contained. This seems unlikely and also a Bad Thing.

Any other ideas how they can do it?

Answer 1

Your provider sees your password regularly -- every time you connect. Details depend on technology:

• In a Webmail, there is a Web site and a browser, and the browser sends the password to the server (under the cover of SSL, hopefully). The server may arrange for some cookie-based session management which allows a given browser to come back without showing the password per se. However, if you typed the password, then it was sent. Moreover, modern browser can remember passwords and enter them automatically for you.

• With non-Web emailing protocols, such as POP and IMAP, authentication can also be of the "show the password" kind. In particular, when you configure the email application on a smartphone, you enter the password, and the application remembers it -- and sends it to the server for every subsequent connection.

• There are authentication protocols in which the password is not sent as is; in particular APOP, used by some server for authentication of POP connection. However, such protocols use a challenge-response strategy, which implies that the server stores the password itself (not only a hashed version thereof).

Therefore, it is possible that the server did not actually store your password (as cleartext or in a reversible format), but merely inspect it as it flows during normal operation. It is also equally possible that they do store your password -- symptoms are not sufficient to rule out either possibility.

In any case:

• The enforced password rules are misguided. Your actual password is much stronger than the average, and they are wrong in trying to discourage your using it. The strength of a password relies exactly in how much it is unknown to attackers (that's what is called "entropy"); there are no characters such as digits or punctuation signs which are inherently stronger than any others. Apparently, the sysadmin on the server does not know that.

• Enforcing password rules is, in general, misguided. "Password rules" antagonize users. Security can be achieved only with strong user cooperation, which relies on education and good will. Password rules are the very opposite of what should be done.

• Sending password details over email is a shooting offence.

Answer 2

John the ripper is a password brute force and dictionary cracking utility that has been used for many years to determine user passwords. Some companies and organizations use it to validate employees are using passwords that meet complexity requirements.

http://www.openwall.com/john/

They may well have used John and cracked your password.

They may also store it with reversible encryption, and have analyzed the plaintext of your password. This is bad practice and one I would caution you about; if they do this, they are not adhering to industry accepted practice in this area. Where else are they not following the preferred way of doing things?

They may indeed have gathered statistics when you entered it, and have now gone back and analyzed that data. This is rather unwieldy. More likely they would use a function or module or dictionary (e.g. pam_cracklib.so) when you first tried to create the passwd; the system would tell you it was insecure right then and there in most cases.

Hard to say exactly, but if they are coming back after the fact, it sounds suspicious.

Make sure it isn't a phishing email... don't click the links, go to the site directly by hand.

Answer 3

I strongly suspect that this is a scam. It's unlikely that anyone as this web host has cracked your password, especially if it is 40 characters. It's much more likely someone is trying to get you to log into a fake site in order to gain access to your account, or infect you with malware.