Re: [Full-disclosure] password.incleartext.com

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

One way to handle this would be to take the password on signup and both hash it 
and encrypt it with the recovery key's public key in 2 separate fields (a hash 
field and an encrypted field).  That way you've always got a hash of it for 
validation even if you lose the keys.   Of course, you could still always 
re-encrypt it to see if the two values matched, but I would probably continue 
to use the hash for logon validation.

The private key would be stored on a completely separate machine/instance which 
was only used for recovery purposes.   There could be any number of ways to 
validate the actual recovery request, but that way you separate out the 
encrypted data from any on-machine ability to decrypt it.   I wouldn't have the 
private key in memory on the same box because that makes it trivial to decrypt, 
but of course it all depends on what problem we are trying to solve.

t

From: Cal Leeming [mailto:cal@xxxxxxxxxxxxxxxx]
Sent: Wednesday, April 06, 2011 11:58 AM
To: Peter Osterberg
Cc: Thor (Hammer of God); Mario Vilas; Romain Bourdy; full-disclosure; Inc 
leartext
Subject: Re: [Full-disclosure] password.incleartext.com

Tbh, I'd be unhappy about any company storing a password in anything other than 
a hash of itself. But, like many things in life, we have absolutely no control 
over it, so best to just use a new pass for every external service :)

On Wed, Apr 6, 2011 at 7:48 PM, Peter Osterberg <j@xxxxxx<mailto:j@xxxxxx>> 
wrote:

Security is relative and the pwd might be handled in a secure enough fashion 
compared to the value of the information it is protecting, even though it is 
stored in a reversable fashion. But I wouldn't, generally speaking, hesitate to 
claim that it isn't stored securely if it is reversable.

Could you givd an example?

----- Ursprungsmeddelande -----
> This isn't necessarily true - without knowledge of how the data may be
> encrypted and what processes are involved in decrypting the data, one
> can't make the "it isn't secure" statement.
>
> That being said, it is probably safe to argue that sites that do not
> require PCI, SOX, HIPPA, etc would be less inclined to engage in this
> level of security.  But that doesn't mean that it is not being done.
>
> t
>
> From: 
> full-disclosure-bounces@xxxxxxxxxxxxxxxxx<mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx>
> [mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Mario
> Vilas Sent: Wednesday, April 06, 2011 9:05 AM To: Romain Bourdy
> Cc: full-disclosure; Inc leartext
> Subject: Re: [Full-disclosure] 
> password.incleartext.com<http://password.incleartext.com>
>
> Actually, if they can get the data back (be it because it's stored in
> plaintext or in obfuscated plaintext) then it's not secure. Obfuscation
> doesn't make it more secure, or any less plaintext. On Wed, Apr 6, 2011
> at 11:01 AM, Romain Bourdy
> <achileos@xxxxxxxxx<mailto:achileos@xxxxxxxxx><mailto:achileos@xxxxxxxxx>> 
> wrote: Hi
> Full-Disclosure,
>
> Just my two cents but ... the fact they can give your password back
> doesn't mean it's stored in cleartext, just that it's not hashed but
> encrypted with some way to get the original data back, this doesn't mean
> at all it's not secured, even though in most case it's not.
>
>  -Romain
>
> On Wed, Apr 6, 2011 at 1:36 PM,
> <Maksim.Filenko@xxxxxxxx<mailto:Maksim.Filenko@xxxxxxxx><mailto:Maksim.Filenko@xxxxxxxx>>
>  wrote: Kinda
> plaintextoffenders.com<http://plaintextoffenders.com><http://plaintextoffenders.com>?<http://plaintextoffenders.com%3E?>
>
> wbr,
>  - Max
>
> full-disclosure-bounces@xxxxxxxxxxxxxxxxx<mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx><mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx>
> wrote on 01.04.2011 02:17:24:
>
> > Inc leartext 
> > <staff@xxxxxxxxxxxxxxx<mailto:staff@xxxxxxxxxxxxxxx><mailto:staff@xxxxxxxxxxxxxxx>>
> > Sent by:
> > full-disclosure-bounces@xxxxxxxxxxxxxxxxx<mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx><mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx>
> >
> > 01.04.2011 13:14
> >
> > To
> >
> > full-disclosure@xxxxxxxxxxxxxxxxx<mailto:full-disclosure@xxxxxxxxxxxxxxxxx><mailto:full-disclosure@xxxxxxxxxxxxxxxxx>
> >
> > cc
> >
> > Subject
> >
> > [Full-disclosure]
> > password.incleartext.com<http://password.incleartext.com><http://password.incleartext.com&gt;
> >
> > Hi FD,
> >
> > Just launched a new website to keep a list of websites storing
> > passwords in clear text, so far the database is small but feel free
> > to add some:
> > http://password.incleartext.com/
>
> >
> > Cheers,
> > Inc Leartext_______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
> --
> "My daughter was asked by a little old lady in a London hotel restaurant
> what her daddy did - she answered, 'He's a pirate.' I was very proud of
> that answer." - Johnny Depp

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/