Hi FD, thanks Thor for the secure version of the recovery process... we will make sure we include a time component during our testing process to ensure no human interaction is involved.
We are now on twitter to add some lulz and media whoring: https://twitter.com/#!/incleartext. Cheers, Inc Leartext. On Thu, Apr 7, 2011 at 4:38 PM, Peter Osterberg <[email protected]> wrote: > I can see how it can be stored securely, but how would distribution after > recovery be accomplished? > > In an envelope? Or by sending me a one-time random https-link where I can > retrieve it myself? Sounds like more trouble compared to what can be gained > from it. Wouldn't it be just as easy to send a one time password that needs > to be changed... Too impracitcal to be implemented in a real-world > situation... > > This is probably why I still wouldn't hesitate to say that it is insecure > if it is in clear text. Even though I must give you credit for having shown > a way to do it. ;-) > > I am sure someone will come and beat me with saying that they already did > this. :-p Ppl do all sorts of crazy stuff just because they can... > > Thor (Hammer of God) skrev 2011-04-07 06:27: > > One way to handle this would be to take the password on signup and both > hash it and encrypt it with the recovery key’s public key in 2 separate > fields (a hash field and an encrypted field). That way you’ve always got a > hash of it for validation even if you lose the keys. Of course, you could > still always re-encrypt it to see if the two values matched, but I would > probably continue to use the hash for logon validation. > > > > The private key would be stored on a completely separate machine/instance > which was only used for recovery purposes. There could be any number of > ways to validate the actual recovery request, but that way you separate out > the encrypted data from any on-machine ability to decrypt it. I wouldn’t > have the private key in memory on the same box because that makes it trivial > to decrypt, but of course it all depends on what problem we are trying to > solve. > > > > t > > > > *From:* Cal Leeming [mailto:[email protected] <[email protected]>] > *Sent:* Wednesday, April 06, 2011 11:58 AM > *To:* Peter Osterberg > *Cc:* Thor (Hammer of God); Mario Vilas; Romain Bourdy; full-disclosure; > Inc leartext > *Subject:* Re: [Full-disclosure] password.incleartext.com > > > > Tbh, I'd be unhappy about any company storing a password in anything other > than a hash of itself. But, like many things in life, we have absolutely no > control over it, so best to just use a new pass for every external service > :) > > > > On Wed, Apr 6, 2011 at 7:48 PM, Peter Osterberg <[email protected]> wrote: > > Security is relative and the pwd might be handled in a secure enough > fashion compared to the value of the information it is protecting, even > though it is stored in a reversable fashion. But I wouldn't, generally > speaking, hesitate to claim that it isn't stored securely if it is > reversable. > > Could you givd an example? > > ----- Ursprungsmeddelande ----- > > > This isn't necessarily true - without knowledge of how the data may be > > encrypted and what processes are involved in decrypting the data, one > > can't make the "it isn't secure" statement. > > > > That being said, it is probably safe to argue that sites that do not > > require PCI, SOX, HIPPA, etc would be less inclined to engage in this > > level of security. But that doesn't mean that it is not being done. > > > > t > > > > From: [email protected] > > [mailto:[email protected]<[email protected]>] > On Behalf Of Mario > > Vilas Sent: Wednesday, April 06, 2011 9:05 AM To: Romain Bourdy > > Cc: full-disclosure; Inc leartext > > Subject: Re: [Full-disclosure] password.incleartext.com > > > > Actually, if they can get the data back (be it because it's stored in > > plaintext or in obfuscated plaintext) then it's not secure. Obfuscation > > doesn't make it more secure, or any less plaintext. On Wed, Apr 6, 2011 > > at 11:01 AM, Romain Bourdy > > > <[email protected]<mailto:[email protected] <[email protected]>>> > wrote: Hi > > > Full-Disclosure, > > > > Just my two cents but ... the fact they can give your password back > > doesn't mean it's stored in cleartext, just that it's not hashed but > > encrypted with some way to get the original data back, this doesn't mean > > at all it's not secured, even though in most case it's not. > > > > -Romain > > > > On Wed, Apr 6, 2011 at 1:36 PM, > > > <[email protected]<mailto:[email protected]<[email protected]>>> > wrote: Kinda > > plaintextoffenders.com<http://plaintextoffenders.com>? > > > > wbr, > > - Max > > > > [email protected]< > mailto:[email protected]<[email protected]>> > > > > wrote on 01.04.2011 02:17:24: > > > > > > Inc leartext > > > <[email protected]<mailto:[email protected]<[email protected]>>> > > > > Sent by: > > > [email protected]< > mailto:[email protected]<[email protected]>> > > > > > > > > 01.04.2011 13:14 > > > > > > To > > > > > > > [email protected]< > mailto:[email protected]<[email protected]>> > > > > > > > cc > > > > > > Subject > > > > > > [Full-disclosure] > > > password.incleartext.com<http://password.incleartext.com> > > > > > > > Hi FD, > > > > > > Just launched a new website to keep a list of websites storing > > > passwords in clear text, so far the database is small but feel free > > > to add some: > > > http://password.incleartext.com/ > > > > > > > > Cheers, > > > Inc Leartext_______________________________________________ > > > Full-Disclosure - We believe in it. > > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > > Hosted and sponsored by Secunia - http://secunia.com/ > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > > > _______________________________________________ > > Full-Disclosure - We believe in it. > > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > > Hosted and sponsored by Secunia - http://secunia.com/ > > > > > > > > -- > > "My daughter was asked by a little old lady in a London hotel restaurant > > what her daddy did - she answered, 'He's a pirate.' I was very proud of > > that answer." - Johnny Depp > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > > > >
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
