Hacker News Reader

Comment by mellowfish | Hacker News Reader

Being able to send passwords back over email and/or view them as an admin does not mean they are stored in the DB in the clear. It is a fairly common practice to strongly encrypt passwords in the DB and decrypt them when it is necessary for admin personnel to be able to use them.

View on HN

For practical purposes, that counts as "in the clear". Password should not be encrypted, they should be irreversibly hashed. (Preferably with bcrypt or scrypt or something meant for this use case; in this case I mean "hash" just in the technical sense of "irreversible", not that any ol' hash function is fine.)

For login purposes, it is indeed good to use hashes, this prevents timing attacks and the like. But I fail to see the harm in keeping encrypted passwords for admin purposes. It is very helpful in certain situations.

Where do you keep the decryption key?

If it's stored in the same place as the encrypted password, then you have gained no security over storing it in plain text.

If it's stored in a separate system, then you have substantially increased the complexity of the system, and in general, a more complex system is harder to implement securely.

If the server is hacked, the attacker can decrypt everything. Your users are going to have a lot of problems, and you'll have lost (rightfully) their faith in your service.

Even if only the database is compromised it is still worth trying to find the key to decrypt all passwords whereas cracking a salted 10000 rounds of scypt or bcrypt hash is just not feasible unless you're the NSA on the hunt for Edward Snowden

Even stipulating perfectly correct use of encryption libraries to encrypt passwords (which is, in practice, an enormous stipulation on its own), there is a significant correlation between having enough access to obtain encrypted passwords, and having enough access to obtain the decryption keys and routines. Yes, there are breaks where the hacker can only get one or the other, but that's such a tenuous "security measure" that it's hardly worthy of the term.

I think it should never be possible for admin personnel to access a users' plain password, much less necessary.

Given that you're an admin anyway, you don't need the extra privileges, and there are already established methods for dealing with resetting and recovering accounts without having to decrypt a password.

If it's ever "necessary" for an employee to decrypt and use my password, something very wrong is happening. That is not acceptable practice.

Yeah, most companies worth their salt (so to speak) make a point of saying their employees will never ask for your password. That not only frees them up to do the right thing with password hashing, but gives users a clear red flag when scammers call.

No, no, a thousand times no. Passwords should never be stored in a reversible format. Your users get shafted if you get hacked (more like 'when', these days). Here's a guide to handling passwords properly: https://crackstation.net/hashing-security.htm

Reply on news.ycombinator.com