5 ms·
Full list of 5000+ websites that store their passwords in plain text: https://github.com/plaintextoffenders/plaintextoffenders/blob/master/offenders.csv https:/
by dorianm 8y ago
Full list of 5000+ websites that store their passwords in plain text: https://github.com/plaintextoffenders/plaintextoffenders/blob/master/offenders.csv https://github.com/plaintextoffenders/plaintextoffenders/blo...
- the_duke 8y agoSomeone should send a friendly email to each of those offenders, linking the ruling. It's also fair to say that the next few years will be a busy time for the government agencies tasked with GDRP enforcement. (Assuming they do it properly, which falls within the responsibility of the relevant country)
- tyingq 8y agoThey should, though assuming a bloated org structure and process, fixing it now is probably more expensive than the €20000 fine.
- lorenzhs 8y agoNote that the actual cost to Knuddels is much higher, because you also have to include the cost of implementing proper security measures. The Data Protection Officer's statement (https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wuerttemberg-verhaengt-sein-erstes-bussgeld-in-deutschland-nach-der-ds-gvo/ https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue..., in German) states that the total cost to Knuddels is a six figure sum.
- jtbayly 8y agoBut the fine would have been more if they had refused to fix it. So the calculus isn’t straightforward.
- the_duke 8y agoFor a larger company, should be considerably higher. Also, the ruling mentioned a reduced fine for cooperation and quick remediation. This probably wouldn't play out so well with a bloated structure and process, as you mentioned.
- hnaj 8y agoI've looked at many of those Tumblr posts; most of them show that the website sends you a welcome email with your password in plain text, which is bad practice, but doesn't prove that the password is stored in plain text in the database.
- heavenlyblue 8y agoBut which proves that access to the website codebase will grant you access to those passwords.
- johannes1234321 8y agoAccess to the code base, gives you access to the login form. And gives access to all data.
- heavenlyblue 8y agoI did not imply you can change the codebase, by the way.
- Arnt 8y agoNo. I've implemented precisely that and it doesn't prove what you think. What you do is have one single function create the user, pick a random password, set it in the database (which in my case uses a perfectly sensible hash) and send the user email. The cleartext password in the mail comes from the function's local string variable, not from the database. Whether doing this is a good idea is another question. IMO it usually isn't. But this kind of mail does not prove cleartext access.
- imtringued 8y agoWhat if the email with the plain text password is sent after a user pressed on the "I forgot my password button"? Because so far I only have encountered this type of email where the password is sent in plain text.
- 8y ago
- tyingq 8y agohttp://plaintextoffenders.com/post/4629405305/discovercardcom-a-credit-card-company http://plaintextoffenders.com/post/4629405305/discovercardco... Ugh. A credit card company...really?
- kurtisc 8y agoIME banks often have poor security. And why not? They managed to rebrand robbery as identity fraud.
- tyingq 8y agoIt's just infuriating, because credit card companies are the ones behind, for example, PCI. Which has guidance like: "8.4 Render all passwords unreadable during transmission and storage on all system components using strong cryptography"
- majewsky 8y agoThis requirement is technically fulfilled by encrypting transmissions with TLS and storage with disk encryption like LUKS or Veracrypt. It does not really say anything about password hashing.
- invisiblea 8y agoThat list is very out of date. One of my clients appears on there and when we took over in 2012 we encrypted all their user credentials.
- ygra 8y agoEncrypting passwords isn't really much better, though, is it? It's still reversible as there has to be a key somewhere.
- whyever 8y agoTheir FAQ [1, 2] suggests that using an encrypted password still warrants an entry. [1] http://plaintextoffenders.com/faq/devs http://plaintextoffenders.com/faq/devs [2] http://plaintextoffenders.com/faq/non-devs http://plaintextoffenders.com/faq/non-devs
- bausshf 8y agoWell you took over and did a terrible job. Hash passwords, not encrypt. An encryption is reversible, a hash result isn't.
- judge2020 8y agoironic how the linked website itself is a "plain text offender" by not using HTTPS, causing HTTP requests to be sent over plain text.