Re: [Full-disclosure] password.incleartext.com

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

This isn't necessarily true - without knowledge of how the data may be 
encrypted and what processes are involved in decrypting the data, one can't 
make the "it isn't secure" statement.

That being said, it is probably safe to argue that sites that do not require 
PCI, SOX, HIPPA, etc would be less inclined to engage in this level of 
security.  But that doesn't mean that it is not being done.

t

From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx 
[mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Mario Vilas
Sent: Wednesday, April 06, 2011 9:05 AM
To: Romain Bourdy
Cc: full-disclosure; Inc leartext
Subject: Re: [Full-disclosure] password.incleartext.com

Actually, if they can get the data back (be it because it's stored in plaintext 
or in obfuscated plaintext) then it's not secure. Obfuscation doesn't make it 
more secure, or any less plaintext.
On Wed, Apr 6, 2011 at 11:01 AM, Romain Bourdy 
<achileos@xxxxxxxxx<mailto:achileos@xxxxxxxxx>> wrote:
Hi Full-Disclosure,

Just my two cents but ... the fact they can give your password back doesn't 
mean it's stored in cleartext, just that it's not hashed but encrypted with 
some way to get the original data back, this doesn't mean at all it's not 
secured, even though in most case it's not.

 -Romain

On Wed, Apr 6, 2011 at 1:36 PM, 
<Maksim.Filenko@xxxxxxxx<mailto:Maksim.Filenko@xxxxxxxx>> wrote:
Kinda plaintextoffenders.com<http://plaintextoffenders.com>?

wbr,
 - Max

full-disclosure-bounces@xxxxxxxxxxxxxxxxx<mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx>
 wrote on 01.04.2011 02:17:24:

> Inc leartext <staff@xxxxxxxxxxxxxxx<mailto:staff@xxxxxxxxxxxxxxx>>
> Sent by: 
> full-disclosure-bounces@xxxxxxxxxxxxxxxxx<mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx>
>
> 01.04.2011 13:14
>
> To
>
> full-disclosure@xxxxxxxxxxxxxxxxx<mailto:full-disclosure@xxxxxxxxxxxxxxxxx>
>
> cc
>
> Subject
>
> [Full-disclosure] password.incleartext.com<http://password.incleartext.com>
>
> Hi FD,
>
> Just launched a new website to keep a list of websites storing
> passwords in clear text, so far the database is small but feel free
> to add some:
>     http://password.incleartext.com/

>
> Cheers,
> Inc Leartext_______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



--
"My daughter was asked by a little old lady in a London hotel restaurant what 
her daddy did - she answered, 'He's a pirate.' I was very proud of that answer."
- Johnny Depp

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/