Re: [Full-disclosure] password.incleartext.com

[Peter Osterberg <j@xxxxxx>]

Security is relative and the pwd might be handled in a secure enough fashion 
compared to the value of the information it is protecting, even though it is 
stored in a reversable fashion. But I wouldn't, generally speaking, hesitate to 
claim that it isn't stored securely if it is reversable.

Could you givd an example?

----- Ursprungsmeddelande -----
> This isn't necessarily true - without knowledge of how the data may be
> encrypted and what processes are involved in decrypting the data, one
> can't make the "it isn't secure" statement.
> 
> That being said, it is probably safe to argue that sites that do not
> require PCI, SOX, HIPPA, etc would be less inclined to engage in this
> level of security.   But that doesn't mean that it is not being done.
> 
> t
> 
> From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx
> [mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Mario
> Vilas Sent: Wednesday, April 06, 2011 9:05 AM To: Romain Bourdy
> Cc: full-disclosure; Inc leartext
> Subject: Re: [Full-disclosure] password.incleartext.com
> 
> Actually, if they can get the data back (be it because it's stored in
> plaintext or in obfuscated plaintext) then it's not secure. Obfuscation
> doesn't make it more secure, or any less plaintext. On Wed, Apr 6, 2011
> at 11:01 AM, Romain Bourdy
> <achileos@xxxxxxxxx<mailto:achileos@xxxxxxxxx>> wrote: Hi
> Full-Disclosure,
> 
> Just my two cents but ... the fact they can give your password back
> doesn't mean it's stored in cleartext, just that it's not hashed but
> encrypted with some way to get the original data back, this doesn't mean
> at all it's not secured, even though in most case it's not.
> 
>   -Romain
> 
> On Wed, Apr 6, 2011 at 1:36 PM,
> <Maksim.Filenko@xxxxxxxx<mailto:Maksim.Filenko@xxxxxxxx>> wrote: Kinda
> plaintextoffenders.com<http://plaintextoffenders.com>?
> 
> wbr,
>   - Max
> 
> full-disclosure-bounces@xxxxxxxxxxxxxxxxx<mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx>
> wrote on 01.04.2011 02:17:24:
> 
> > Inc leartext <staff@xxxxxxxxxxxxxxx<mailto:staff@xxxxxxxxxxxxxxx>>
> > Sent by:
> > full-disclosure-bounces@xxxxxxxxxxxxxxxxx<mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx>
> > 
> > 01.04.2011 13:14
> > 
> > To
> > 
> > full-disclosure@xxxxxxxxxxxxxxxxx<mailto:full-disclosure@xxxxxxxxxxxxxxxxx>
> > 
> > cc
> > 
> > Subject
> > 
> > [Full-disclosure]
> > password.incleartext.com<http://password.incleartext.com>
> > 
> > Hi FD,
> > 
> > Just launched a new website to keep a list of websites storing
> > passwords in clear text, so far the database is small but feel free
> > to add some:
> > http://password.incleartext.com/
> 
> > 
> > Cheers,
> > Inc Leartext_______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
> 
> 
> 
> --
> "My daughter was asked by a little old lady in a London hotel restaurant
> what her daddy did - she answered, 'He's a pirate.' I was very proud of
> that answer." - Johnny Depp

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/