Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes, there is.

In most companies, the database is significantly more accessible than any encryption keys. For goodness sake, marketers typically have query access to the DB.

And the issue of emailing a password is different. The problem there is that if I gain access to your email account, I can quickly search "password" to discover your private passwords that a company, not you, chose to drop into your email account.

But to be clear, user-created passwords should be stored one-way hashed and never emailed.



> For goodness sake, marketers typically have query access to the DB.

That's a bit of a straw man, don't you think? Even if marketers have access to the database, they shouldn't have read access to the passwords table in a properly configured system. If they do, it's time to fire your DBA.

> The problem there is that if I gain access to your email account, I can quickly search "password" to discover your private passwords

Sometimes it's worse than that. I recently had to do a password recovery on a site, and they sent the password not only in plain text but also as the very beginning of the email. As such, gmail helpfully showed "example.com" as the sender, with "Password: P@ssword1" right in the body preview snippet. You could see it without even having to open the email.

It may not be a common exploit, but if I was checking my gmail at work, a coworker that knew I had an account on this website could just send a recovery request and glance over my shoulder at just the right time and grab my password without my knowledge. Not good.

I wish Google would implement some sort of algorithm that could determine password-looking text and a) not show it in the preview, and b) require user interaction to display it when viewing the actual email body.


The odds of having a properly configured database in a company that stores password in the clear don't seem very high.


> they shouldn't have read access to the passwords table in a properly configured system. If they do, it's time to fire your DBA.

I can guarantee that it happens. A lot. And firing the DBA is a poor solution.


Password are not usually stored in a separate table, they are usually just a column in the users table.

What you do is make a view that does not include the password column, and give them access to the view, but not the table.


This is something I admit I don't quite understand. How are encryption keys stored in a way that makes them significantly less accessible than the database? I'm interested in the nitty-gritty details of this.


It should be possible to have the key only on production machines, which only a subset of devs have access to - and no marketers.

(Still shitty, though)


Store them in a hardware security module (http://en.wikipedia.org/wiki/Hardware_security_module) which never, ever lets them leave. The HSM does the encryption/decryption work for the application.


You can't access the source code of an app by just using a SQL injection if the database account is set up correctly.


Trying not to be pedantic, but this is something everyone should know.

If I can pull a list of two-way encrypted passwords, breaking that is way faster than extracting passwords from a properly crypted list. Essentially it's a huge list of short (almost known plaintext) messages. If you know a cryptosystem that will resist attack in that circumstance, please share.

Properly crypted, passwords admit to local brute forcing, which is bad for any particular account.

"Recoverable" passwords, the whole list admits to statistical attacks that break the whole list.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: