Comment by LeftHandPath | Hacker News Reader

Comment by LeftHandPath | Hacker News Reader

Parent Full thread

I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand).

When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The email ended by stating that if I lost my password, they could "recover it" and send it back to me.

I raised a thread about it in one of their off-topic sections, and got harassed - "How secure do you need your browsing to be?" (And hey, I mean, I was asking them to do more work)

But it stands out that most of the public doesn't know, and doesn't care to know. Even a site that's populated by people with net worths and/or incomes that average in the six-to-seven figure range, that they probably signed up for with the same email address and password that they use for their bank and brokerage accounts.

HTTP should come with a warning. Furthermore, it would be fan-fucking-tastic if there was some generalizable way to (automatically) audit a website's security practice. Like, a crawler that just runs standard OWASP-style attack-vector checks, and sends an email to the site's owners when one succeeds. And then put that data into a database and warn users (with a browser plugin) when they are creating credentials for sites with bad security.

I'll top that. I used TABCPermit.com to get licensed to serve alcohol in Texas. Their signup form says "no special characters in password". I used one anyway, putting in "password$1" for example. It accepted it, and I worked on the test.

Next day, I can't login. I use the "forgot password" link. They send me and email, and it has my password in it! Bad, right?

That isn't all. My password, they said, was "password1". They silently stripped out the special character.

I just about flipped a table at how security-shallow people who build websites can be.

Are you sure your password has a $ in it? What makes you think that they don't strip the $ when you set and enter your password?

If it seemed like they were doing a hash then compare, I would wonder if they are using the legacy unix crypt that truncates passwords at 8 characters.

I know when I registered and typed twice that my password had "$" in it. And they mailed me back my password without it. Finally, it wasn't just a truncate because there were characters after the position where "$" should be.

And if they did strip it out, that is bad. That's the point.

There's Plain Text Offenders which covers part of that.. https://plaintextoffenders.com/tools

I'd recommend using an OpenID Connect provider to authenticate if you're concerned about their practices but it's just as easy to improperly implement auth even with mainstream libraries to help you connect something like Auth.0 to your app.

e.g. Don't assume the email address is owned by the person making the claim. You can sign up for an account with an email and if it's not verified or the verification is mis-clicked or phished into being clicked the original account owner would never know the difference.

Still, at least with OpenID Connect you know your password isn't sitting in plain text.

Are there any sites that accept OpenID but that you still suspect of poor password/auth practices?

"How secure do you need your browsing to be?"

Perhaps explain to them that many people (unwisely) reuse passwords for many sites... possibly including their banking.

To which they respond, in essence, “their fault”

That response is pretty typical from the GA community.

What is "GA"?

General Aviation; the same people that lobby to keep using leaded fuels.

That's a bit too harsh. The GA people are lobbying to continue to be able to fly their aircraft. The FAA has been sitting on the problem of non-leaded avgas for something like 30 years now. The GA people don't like being exposed to lead any more than anyone else.

Yes, harsh on people literally choosing to spray a neurotoxic heavy metal compound over populated areas for their fun. Their advocacy is the roadblock to the adoption of safer fuels.

I think we'd all rather burn cheaper / more prevalent gas than a leaded fuel that is the output of specialty refining. We're not allowed to by regulation, though, and furthermore present solutions would also endanger safety in a big slice of aircraft. The fleet of general aviation aircraft is really old, after all.

It doesn't actually accumulate in any particular area. There was a study done at at an airport that showed no particular accumulation at the airport. Leaded gas ends up poisoning the whole world a bit.

This "dilution is the solution to pollution" argument is the excuse the FAA uses for forcing everyone to use leaded avgas. This should be more of a scandal. The FAA is basically helping maintain a harmful oil company monopoly at the expense of the world.

This is not just about recreational aircraft. For example, 45% of the Canadian commercial fleet is piston engine based. Incidentally, Canada was involved in a test program with the FAA for leaded fuel replacements. The FAA recently dropped out of that program.

General aviation.

Reply on news.ycombinator.com