156
OP finds vulnerability where a forum sends you your password in plaintext over email and everyone misses the forest for the trees (lemmy.world)
submitted 3 years ago by to c/programming@programming.dev
85 comments fedilink hide all child comments
 

This thread is frustrating. Everyone seems more interested in nitpicking the specifics of what OP is saying and are ignoring that a forum sends you your password (not an automatically generated one) in an email on registration.

you are viewing a single comment's thread
view the rest of the comments
[–] 20 points 3 years ago (4 children)

They have said it is being hashed for storage: https://forums.larian.com/ubbthreads.php?ubb=showflat&Number=669268#Post669268

I can’t fault the OP though, if I received such an email I would assume it is stored in plain text and be similarly upset.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 4 points 3 years ago (2 children)

    Reversible hashed password storage isn't meaningfully better than clear text.

    • The key to reverse the hash is typically (necessarily) stored in the same infrastructure as the password. Bad actors with access to one have access to the combination.
    • Even if an attacker fails to exfiltrate the key to the reversible hash, it's typically only a matter of days at the most before they can reverse engineer it, and produce plain text copies of every password they obtained the hash of.

    A reversible hash provides a paper thin layer of protection against accidental disclosure. A one way hash is widely considered the bare minimum for password storage.

    Anyone claiming a password has been protected, and then being able to produce the original password, is justly subject to ridicule in security communities.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 3 years ago* (1 child)

    The one they were sending at registration was prior to hashing. It would not be reversible afterwards.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 3 years ago*

    That's technically less terrible, then.

    Good for them. /s

    Edited to add the /s for clarity, because the NIST recommended remediation in 2023 for emailing a password is "burn everything down and pretend the organization never existed". /s

    Again, adding that /s since that's not actually what NIST says to do, and I am, at best, paraphrasing.

  • permalink
  • fedilink
  • source
  • parent