Tell HN: Namecheap stores unecrypted passwords + let's sales staff see them | Hacker News Reader

Tell HN: Namecheap stores unecrypted passwords + let's sales staff see them

14 pointsvaksel20 comments

Saw this on another forum, so I though you guys might want the heads up.

Looks like a namecheap representative previously addressed this rumor:

-------------------

Hello All,

Rest assured, passwords are encrypted. We do have one-way password hashes for certain combination to make it possible for CS to validate the authenticity of the customer. The support representative is not shown the full password.

To make it even more secure, we too have plans to implement an option to specify a 'Support Security Code' that can be provided for communication with CS instead.

Thanks, Mohan

Namecheap.com

http://www.webhostingtalk.com/archive/index.php/t-886490.htm...

http://www.webhostingtalk.com/showpost.php?p=6365902&pos...

That sounds pretty much like an admission that they do store the password in plaintext or at least some "close-to-plaintext" format.

Why do you think that?

Because having an oracle that can verify if a partial password guess is correct makes it trivially bruteforce-able.

Only if they store more than one combination of characters.

Do you have any proof of this other than seeing it on a forum?

It is like I heard from a friend who knows someone who's father works there kind of thing without evidence.

no proof, but with countless services that are doing this, I wouldn't be surprised.

+ the person who reported this wasn't some noob, so I trust him

   oh and i found out by talking to their support people. I 
   didn't believe the dude when he told me, so i asked him 
   for some random characters (i.e starts with, ends with 
   etc) and he had the right anwsers

I'd be very interested in knowing that this was the case. But I need more that second hand anecdote without a single specific reference.

That is annoying, and is a bad security practice, but not the end of the world as a customer. It's actually slightly less horrifying at Namecheap, because as your registrar you should be using crazy good passwords anyways, which means they're never re-used.

Three recommendations:

* head /dev/random | md5 # very annoying to type, though

* ruby -e 'puts rand(1<<128).to_s(32)' # less annoying to type

* Keychain Access password helper at "memorable, 31 long"

Note that FedEx has the same bad behavior.

The real risk here is to Namecheap, who is utterly exposed in the event of a database leak. If they're keeping online plaintext passwords, they'll have nothing to say to mitigate the catastrophic damage of giving up many of their customer's most sensitive credentials.

I'm probably missing something, but why md5 the output of /dev/random - won't it have the same entropy it started with?

/dev/random is random bytes, so in order to make it typable, it's useful to convert it into characters. md5 is good for that.

Alternatively, strings /dev/random|head gives some stuff that you can concatenate into a password.

For a single process bit of typeable entropy from our OpenBSD friends, try:

openssl -rand base64 12

On your favorite Unix.

You mean "openssl rand -base64 12".

While we're on the subject: What domain registrar would you recommend instead of Namecheap?

You cannot say for certain that they don't encrypt passwords. They could use a 2-way hash.

What's a "two-way hash"?

I recently learned Pandora does this as well. Got my password sent to me in an email

Hearing this, I changed my password and opened a ticket to have my account closed. About 15 minutes later, I got an email asking this:

May I have your username along with the first and third character of your password?

So they're storing a password hash, and a hash of combinations of the characters of the password to allow customer support to "verify" requests without hearing the whole password.

It would be funny if they had hashes of every combination of passwords. Hopefully, it's just one.

This is pretty goofy. Among other things, those customer services will themselves be trivial to break, and are probably password-equivalent (use them with support to reset your real password).

This looks like a case of a company going out of its way to be marginally less secure than a typical non-secure framework application.

On the topic of Namecheap, do any of you guys know of other registrars that offer API access to all of the domain functions? I'm working on a project where I'll need to purchase hundreds of domains so an API is crucial but the best I've found so far is Namecheap.

Now with this whole password security potential problem, just curious if there are comparable solutions out there for API access...

Reply on news.ycombinator.com