5 ms·

I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it

I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The email ended by stating that if I lost my password, they could "recover it" and send it back to me. I raised a thread about it in one of their off-topic sections, and got harassed - "How secure do you need your browsing to be?" (And hey, I mean, I was asking them to do more work) But it stands out that most of the public doesn't know, and doesn't care to know. Even a site that's populated by people with net worths and/or incomes that average in the six-to-seven figure range, that they probably signed up for with the same email address and password that they use for their bank and brokerage accounts. HTTP should come with a warning. Furthermore, it would be fan-fucking-tastic if there was some generalizable way to (automatically) audit a website's security practice. Like, a crawler that just runs standard OWASP-style attack-vector checks, and sends an email to the site's owners when one succeeds. And then put that data into a database and warn users (with a browser plugin) when they are creating credentials for sites with bad security.

brentonator 7y ago
I'd recommend using an OpenID Connect provider to authenticate if you're concerned about their practices but it's just as easy to improperly implement auth even with mainstream libraries to help you connect something like Auth.0 to your app. e.g. Don't assume the email address is owned by the person making the claim. You can sign up for an account with an email and if it's not verified or the verification is mis-clicked or phished into being clicked the original account owner would never know the difference. Still, at least with OpenID Connect you know your password isn't sitting in plain text.
- unilynx 7y ago
  Are there any sites that accept OpenID but that you still suspect of poor password/auth practices?
nathancahill 7y ago
There's Plain Text Offenders which covers part of that.. https://plaintextoffenders.com/tools https://plaintextoffenders.com/tools
kitteh 7y ago
That response is pretty typical from the GA community.
- MockObject 7y ago
  What is "GA"?
  - coryrc 7y ago
    General Aviation; the same people that lobby to keep using leaded fuels.
    - upofadown 7y ago
      That's a bit too harsh. The GA people are lobbying to continue to be able to fly their aircraft. The FAA has been sitting on the problem of non-leaded avgas for something like 30 years now. The GA people don't like being exposed to lead any more than anyone else.
      - coryrc 7y ago
        Yes, harsh on people literally choosing to spray a neurotoxic heavy metal compound over populated areas for their fun. Their advocacy is the roadblock to the adoption of safer fuels.
        mlyle 7y ago
        I think we'd all rather burn cheaper / more prevalent gas than a leaded fuel that is the output of specialty refining. We're not allowed to by regulation, though, and furthermore present solutions would also endanger safety in a big slice of aircraft. The fleet of general aviation aircraft is really old, after all.
        upofadown 7y ago
        It doesn't actually accumulate in any particular area. There was a study done at at an airport that showed no particular accumulation at the airport. Leaded gas ends up poisoning the whole world a bit. This "dilution is the solution to pollution" argument is the excuse the FAA uses for forcing everyone to use leaded avgas. This should be more of a scandal. The FAA is basically helping maintain a harmful oil company monopoly at the expense of the world. This is not just about recreational aircraft. For example, 45% of the Canadian commercial fleet is piston engine based. Incidentally, Canada was involved in a test program with the FAA for leaded fuel replacements. The FAA recently dropped out of that program.
unethical_ban 7y ago
I'll top that. I used TABCPermit.com to get licensed to serve alcohol in Texas. Their signup form says "no special characters in password". I used one anyway, putting in "password$1" for example. It accepted it, and I worked on the test. Next day, I can't login. I use the "forgot password" link. They send me and email, and it has my password in it! Bad, right? That isn't all. My password, they said, was "password1". They silently stripped out the special character. I just about flipped a table at how security-shallow people who build websites can be.
- mgerdts 7y ago
  Are you sure your password has a $ in it? What makes you think that they don't strip the $ when you set and enter your password? If it seemed like they were doing a hash then compare, I would wonder if they are using the legacy unix crypt that truncates passwords at 8 characters.
  - deleted 7y ago
    [deleted]
  - unethical_ban 7y ago
    I know when I registered and typed twice that my password had "$" in it. And they mailed me back my password without it. Finally, it wasn't just a truncate because there were characters after the position where "$" should be. And if they did strip it out, that is bad. That's the point.
D-Coder 7y ago
"How secure do you need your browsing to be?" Perhaps explain to them that many people (unwisely) reuse passwords for many sites... possibly including their banking.
- colejohnson66 7y ago
  To which they respond, in essence, “their fault”

brentonator 7y ago

I'd recommend using an OpenID Connect provider to authenticate if you're concerned about their practices but it's just as easy to improperly implement auth even with mainstream libraries to help you connect something like Auth.0 to your app. e.g. Don't assume the email address is owned by the person making the claim. You can sign up for an account with an email and if it's not verified or the verification is mis-clicked or phished into being clicked the original account owner would never know the difference. Still, at least with OpenID Connect you know your password isn't sitting in plain text.

unilynx 7y ago
Are there any sites that accept OpenID but that you still suspect of poor password/auth practices?

nathancahill 7y ago

There's Plain Text Offenders which covers part of that.. https://plaintextoffenders.com/tools https://plaintextoffenders.com/tools

kitteh 7y ago

That response is pretty typical from the GA community.

MockObject 7y ago
What is "GA"?
- coryrc 7y ago
  General Aviation; the same people that lobby to keep using leaded fuels.
  - upofadown 7y ago
    That's a bit too harsh. The GA people are lobbying to continue to be able to fly their aircraft. The FAA has been sitting on the problem of non-leaded avgas for something like 30 years now. The GA people don't like being exposed to lead any more than anyone else.
    - coryrc 7y ago
      Yes, harsh on people literally choosing to spray a neurotoxic heavy metal compound over populated areas for their fun. Their advocacy is the roadblock to the adoption of safer fuels.
      - mlyle 7y ago
        I think we'd all rather burn cheaper / more prevalent gas than a leaded fuel that is the output of specialty refining. We're not allowed to by regulation, though, and furthermore present solutions would also endanger safety in a big slice of aircraft. The fleet of general aviation aircraft is really old, after all.
      - upofadown 7y ago
        It doesn't actually accumulate in any particular area. There was a study done at at an airport that showed no particular accumulation at the airport. Leaded gas ends up poisoning the whole world a bit. This "dilution is the solution to pollution" argument is the excuse the FAA uses for forcing everyone to use leaded avgas. This should be more of a scandal. The FAA is basically helping maintain a harmful oil company monopoly at the expense of the world. This is not just about recreational aircraft. For example, 45% of the Canadian commercial fleet is piston engine based. Incidentally, Canada was involved in a test program with the FAA for leaded fuel replacements. The FAA recently dropped out of that program.

unethical_ban 7y ago

I'll top that. I used TABCPermit.com to get licensed to serve alcohol in Texas. Their signup form says "no special characters in password". I used one anyway, putting in "password$1" for example. It accepted it, and I worked on the test. Next day, I can't login. I use the "forgot password" link. They send me and email, and it has my password in it! Bad, right? That isn't all. My password, they said, was "password1". They silently stripped out the special character. I just about flipped a table at how security-shallow people who build websites can be.

mgerdts 7y ago
Are you sure your password has a $ in it? What makes you think that they don't strip the $ when you set and enter your password? If it seemed like they were doing a hash then compare, I would wonder if they are using the legacy unix crypt that truncates passwords at 8 characters.
- deleted 7y ago
  [deleted]
- unethical_ban 7y ago
  I know when I registered and typed twice that my password had "$" in it. And they mailed me back my password without it. Finally, it wasn't just a truncate because there were characters after the position where "$" should be. And if they did strip it out, that is bad. That's the point.

D-Coder 7y ago

"How secure do you need your browsing to be?" Perhaps explain to them that many people (unwisely) reuse passwords for many sites... possibly including their banking.

colejohnson66 7y ago
To which they respond, in essence, “their fault”