Hacker News Reader

Comment by mattmanser | Hacker News Reader

"In my entire life, I’ve never heard of a company storing passwords in plain text"

He needs to get out more. Happens all the time I reckon. Someone throws together a prototype with plaintext username/password column on the person or user table and 10 years later it's still there. I have personally seen this at two different companies.

View on HN

Also, hashed passwords aren't all that much better these days - I know of a vBulletin forum that got penetrated recently, and did a bit of digging about how it stored passwords - MD5(MD5(password).salt) or somthing similar - doesn't seem to stop prople with something called passwordpro from bruteforcing passwords from hash:salt combinations - even things that don't look particularly prone to dictionary attacks seem to be getting answers in 24hrs or so on various forums...

I'm wondering whether I trust myopenid or google's openid service enough to centralise as much of my online authentication there as I can...

Still, 24 hours is undoubtedly better than 0. It could mean that the attack is discovered in time to warn customers.

Or any of the numerous sites that email you your password when you sign up or do a password "reset".

Head -> Desk

I guess he's never heard of monster.com or 37 Signals.

Or Reddit.

http://blog.moertel.com/articles/2006/12/15/never-store-pass...

Indeed. Many ISP billing/CRM systems date back to the 1990s and store plaintext passwords as a "feature."

Non-technical users (say, customers of a dialup ISP) tend to like being able to "guess" at their password with the customer service rep instead of having to recite their exact password or pick a new one on the spot.

True, it is a "common" mistake. It is also amateurish.

I run a few sites on MT. We pay the ~$20/mo hosting fees with the expectation of well-configured apache servers, fair customer support, and the ability to handle an occasional Slashdot, Reddit, or Digg effect. While we keep our CMS' up-to-date, we are happy to pay for the overhead of having someone else deal with OS, network, and server issues.

Unfortunately, their "amateurish" mistake pretty severely attenuates our confidence in their competence -- for existing and future features alike. Worse, it equates to real lost time for us to recover, additional lost time as we implement new security measures (e.g. Tripwire IDS), and frustration with the fact that we found out about our sites being hacked back on Nov. 12th and yet they are just now notifying us of the larger issue!

I guess he has never called MT support before, the first thing they ask for after your domain is your account password.

A friend called Rackspace a little while back regarding one of his cloud servers and they asked for his account password as well.

If a company asks you for your password that doesn't mean they store it; they could be storing a hash.

Reply on news.ycombinator.com