Hacker News Reader

Comment by engtech | Hacker News Reader

I think it's time for web browsers to step up and start showing a visual indication for websites that store passwords in plaintext.

View on HN

How would a browser ever know this?

Probably the same way they know which sites are likely to contain malware or be involved in phishing scams: user reports.

Yep. http://news.ycombinator.com/item?id=4555083

I.E. is actually the best at stopping social engineering attacks on your average consumer because of their SmartScreen technology, which relies completely on feedback from the community, both automatic and manual. No reason to downvote this or the original comment IMO.

Of course the browser can't know this. But one clue for the user is if there is a strict length limit.

If you're going to hash my password to 16 characters anyway, why can't I type in 20? But if you're going to store it as plaintext, you need to limit what I input.

Browsers can't reliably know this. Although they could probably at least figure out if the form submission is going to be a freaking GET request!

And... how could they know exactly?

web browsers are doing this for malware / fraud sites.

see other comments on parent for citations.

That's reactive, for passwords in cleartext it's not very useful: by the time you get the news, the damage has been done already.

At best it tells you to change you passwords before the site itself tells you.

That's a fair point. The only way it would work is if an anonymous insider reported the company before the general public knew about it. Either that or it would serve as a blacklist for companies who already made one mistake, though it's very unlikely to see them make 2 (and in Sony's case, people are still using PlayStation Network anyway).

Reply on news.ycombinator.com