7 ms·

Dropmyemail's security

8 points by laurenceputra 14y ago

notthetup 14y ago
Why does this still happen? Aren't security best practices still not wide spread enough to dissuade people form doing this?
- phpnode 14y ago
  because there's no way their service could ever work without storing passwords, a fact that this article completely ignores.
callmebison 14y ago
Wow, either the author has a serious grudge against them, or isn't willing to at least fact-check their response. - The app checks your email on your behalf. - You need the actual password to log into an IMAP server (android also stores your email passwords in clear text if you aren't using gmail http://code.google.com/p/android/issues/detail?id=10809 http://code.google.com/p/android/issues/detail?id=10809). - They clearly state this in their response, which the article completely ignores. They try to use OAuth where possible. - They store the passwords encrypted via S3. Personally, I'd prefer that to MySQL on a VPS somewhere. - See also: https://developer.pidgin.im/wiki/PlainTextPasswords https://developer.pidgin.im/wiki/PlainTextPasswords
- laurenceputra 14y ago
  I'm the author. 1) The app downloads your emails into their server. 2) Yes, they store that actual password. Which is ridiculous. 3) Yes, good for them for that, but still there are others where they store passwords. And that is not acceptable. 4) But that also means that they outsource the security part of things. Which doesn't lend faith to the idea that they know about security. And if someone realises how to control their application, all the passwords will be hacked. 5) Pidgin is stored locally. There's a difference. Not that I support it, but it's still better than someone storing my passwords.
  - thaumaturgy 14y ago
    How do you recommend that they regularly backup a user's email messages without storing that user's login credentials for that email service?
    - laurenceputra 14y ago
      they can't, unless the email service gives them oauth. and even then allowing a 3rd party to backup your emails is a very dangerous thing to do. they say that credit card is more dangerous, i say no. for credit cards you can claim fraud. when your email gets hacked, potentially your whole digital life is gone
      - thaumaturgy 14y ago
        Then what you need to write is, "I think that unproven email backup services are a bad idea", not, "these guys are idiots because they store a retrievable copy of your email credentials" which is necessary for the service that they are providing.
      - laurenceputra 14y ago
        what they could have done is to allow users to autoforward their emails over to their servers or something. not impossible, but i'm not their employee and i'm not responsible for thinking up business strategies for them. so yea. not necessary
        thaumaturgy 14y ago
        So what you're saying is that they should limit their market to those users that can successfully set up email forwarding, solely because storing passwords is bad. Part of the service they're offering is that they'll restore the contents of your mailbox in case of accidental or malicious deletion. I have mail:/var/mail/associatedtechs.com/rob@associatedtechs.com# find . | wc -l 24846 ...almost 25,000 messages in my mailbox. How do you recommend that they restore 25,000 messages to my mailbox without my account credentials?
- laurenceputra 14y ago
  in fact, seeing how your account was created to post that comment and seeing how it doesn't make sense, i would suspect that you actually work for them.
  - thaumaturgy 14y ago
    Everything he said makes perfect sense and I agree with it. A brief look at my HN profile should tell you I don't work for them. (Never heard of them before in fact.) I think that you are practicing cargo cult security -- you're doing a cargo dance here over password storage mechanisms in a case where it doesn't apply.
    - laurenceputra 14y ago
      how does it not apply?
      - thaumaturgy 14y ago
        http://news.ycombinator.com/item?id=4580204 http://news.ycombinator.com/item?id=4580204
  - callmebison 14y ago
    I don't post on HN often, and forgot the username I used last time I posted. I don't work for them. Personally, I don't see a strong use-case for the product and it wouldn't be something I'd be interested in. If I did work for them, I would happily mention it in a post.
thaumaturgy 14y ago
This article is nonsense. The author isn't saying anything substantive about the "security" of this particular company. It should go without saying that email backup services will currently, in most cases, need to store your email login information in a retrievable way. A slightly better post might have been, "Beware unproven email backup services. Don't forget that if they make a mistake, potentially all of your email messages can be exposed to someone else. Since you probably have account credentials for other services stored in your email box, that situation can get ugly really fast."
- laurenceputra 14y ago
  so you do concede that it can get ugly really fast.
  - thaumaturgy 14y ago
    I "concede" that they are doing nothing wrong and you are way out of your depth here. I strongly suggest that you drop this before digging yourself an even deeper hole in front of the people following this from Twitter.
  - callmebison 14y ago
    That's a value judgement you have to make, similarly to using any service hosted by someone else. 1) Is the potential loss of privacy worth the advantages of the service? 2) Do you trust the company providing the service? 3) Could you do a more secure job of it than the company? It's not a service I would personally use, but I have no reason to think the company providing the service doesn't know what they are doing.
nubis 14y ago
I do believe that all this kurfuffle originates from a 'false package deal' composed by: factual data (we store passwords), your assumptions about our incompetence (we're bound to lose them), and your subjective valuation of risk vs. convenience. You should not feel bad about other people breaking down the argument in the different topics. I am a Dropmyemail employee who works hands on with the security of the site, although I'm replying on my personal capacity. We don't practice security through obscurity so we can discuss the technicalities of our security measures here. I would appreciate not being treated as an incompetent goon though, to keep things friendlier. I see on this thread you accuse someone of being sent by the company I work for to discredit you personally: They did not, furthermore, I personally see your article as a valuable service, you will see in our site that we try to be as transparent as possible, and there's nothing that I could want more than for people to actually know and understand what Dropmyemail is about. Thanks for your article.
- laurenceputra 14y ago
  i'm not assuming you are incompetent. what i'm saying is that no system is fully secure, and by saving the users' passwords, you are risking them. one of the first rules i learnt in web development is this, you do not store passwords. (http://www.codinghorror.com/blog/2010/12/the-dirty-truth-about-web-passwords.html http://www.codinghorror.com/blog/2010/12/the-dirty-truth-abo...) you never assume that your system will be so secure that no one can hack it.
  - nubis 14y ago
    Indeed, no system is fully secure, and we don't try to hide that fact, that's one of the reasons Dropmyemail exists in the first place. We offer people an off-site backup at the cost of trusting a third party with their password. This is a risk assessment discussion, and I believe although good for raising awareness about what dropmyemail offers, the original articles fails to make a distinction between the objective information it provides and what are your personal valuations on the risk involved (for example, it assumes one of the worst possible scenarios regarding our competence). Things get a bit confusing when non security related topics like storage capacity are mixed in though. I believe you are trying to help people to be safe and choose the better tool to solve their problem, I do think you are underestimating them a bit, but in case I'm wrong I repeat how valuable your article is in raising this issues.
indiangeek 14y ago
One thing I fail to understand is the experience of the author in making such a statement. As per his profile, he is an undergraduate student at NUS. I did check NUS's courses offered and there is hardly any course in hacking or teaching much about security. They just have a basic module on security which is not even mandatory. ANd the author is questioning the security practises of a company whose CTO has a 25+ years of work experience (Team page). He fails to understand the fact that it is not possible to do regular backups without the password. Something the user totally skippd in his article.

8 points by laurenceputra 14y ago

Why does this still happen? Aren't security best practices still not wide spread enough to dissuade people form doing this?

phpnode 14y ago
because there's no way their service could ever work without storing passwords, a fact that this article completely ignores.

callmebison 14y ago

Wow, either the author has a serious grudge against them, or isn't willing to at least fact-check their response. - The app checks your email on your behalf. - You need the actual password to log into an IMAP server (android also stores your email passwords in clear text if you aren't using gmail http://code.google.com/p/android/issues/detail?id=10809 http://code.google.com/p/android/issues/detail?id=10809). - They clearly state this in their response, which the article completely ignores. They try to use OAuth where possible. - They store the passwords encrypted via S3. Personally, I'd prefer that to MySQL on a VPS somewhere. - See also: https://developer.pidgin.im/wiki/PlainTextPasswords https://developer.pidgin.im/wiki/PlainTextPasswords

laurenceputra 14y ago
I'm the author. 1) The app downloads your emails into their server. 2) Yes, they store that actual password. Which is ridiculous. 3) Yes, good for them for that, but still there are others where they store passwords. And that is not acceptable. 4) But that also means that they outsource the security part of things. Which doesn't lend faith to the idea that they know about security. And if someone realises how to control their application, all the passwords will be hacked. 5) Pidgin is stored locally. There's a difference. Not that I support it, but it's still better than someone storing my passwords.
- thaumaturgy 14y ago
  How do you recommend that they regularly backup a user's email messages without storing that user's login credentials for that email service?
  - laurenceputra 14y ago
    they can't, unless the email service gives them oauth. and even then allowing a 3rd party to backup your emails is a very dangerous thing to do. they say that credit card is more dangerous, i say no. for credit cards you can claim fraud. when your email gets hacked, potentially your whole digital life is gone
    - thaumaturgy 14y ago
      Then what you need to write is, "I think that unproven email backup services are a bad idea", not, "these guys are idiots because they store a retrievable copy of your email credentials" which is necessary for the service that they are providing.
    - laurenceputra 14y ago
      what they could have done is to allow users to autoforward their emails over to their servers or something. not impossible, but i'm not their employee and i'm not responsible for thinking up business strategies for them. so yea. not necessary
      - thaumaturgy 14y ago
        So what you're saying is that they should limit their market to those users that can successfully set up email forwarding, solely because storing passwords is bad. Part of the service they're offering is that they'll restore the contents of your mailbox in case of accidental or malicious deletion. I have mail:/var/mail/associatedtechs.com/rob@associatedtechs.com# find . | wc -l 24846 ...almost 25,000 messages in my mailbox. How do you recommend that they restore 25,000 messages to my mailbox without my account credentials?
laurenceputra 14y ago
in fact, seeing how your account was created to post that comment and seeing how it doesn't make sense, i would suspect that you actually work for them.
- thaumaturgy 14y ago
  Everything he said makes perfect sense and I agree with it. A brief look at my HN profile should tell you I don't work for them. (Never heard of them before in fact.) I think that you are practicing cargo cult security -- you're doing a cargo dance here over password storage mechanisms in a case where it doesn't apply.
  - laurenceputra 14y ago
    how does it not apply?
    - thaumaturgy 14y ago
      http://news.ycombinator.com/item?id=4580204 http://news.ycombinator.com/item?id=4580204
- callmebison 14y ago
  I don't post on HN often, and forgot the username I used last time I posted. I don't work for them. Personally, I don't see a strong use-case for the product and it wouldn't be something I'd be interested in. If I did work for them, I would happily mention it in a post.

thaumaturgy 14y ago

This article is nonsense. The author isn't saying anything substantive about the "security" of this particular company. It should go without saying that email backup services will currently, in most cases, need to store your email login information in a retrievable way. A slightly better post might have been, "Beware unproven email backup services. Don't forget that if they make a mistake, potentially all of your email messages can be exposed to someone else. Since you probably have account credentials for other services stored in your email box, that situation can get ugly really fast."

laurenceputra 14y ago
so you do concede that it can get ugly really fast.
- thaumaturgy 14y ago
  I "concede" that they are doing nothing wrong and you are way out of your depth here. I strongly suggest that you drop this before digging yourself an even deeper hole in front of the people following this from Twitter.
- callmebison 14y ago
  That's a value judgement you have to make, similarly to using any service hosted by someone else. 1) Is the potential loss of privacy worth the advantages of the service? 2) Do you trust the company providing the service? 3) Could you do a more secure job of it than the company? It's not a service I would personally use, but I have no reason to think the company providing the service doesn't know what they are doing.

nubis 14y ago

I do believe that all this kurfuffle originates from a 'false package deal' composed by: factual data (we store passwords), your assumptions about our incompetence (we're bound to lose them), and your subjective valuation of risk vs. convenience. You should not feel bad about other people breaking down the argument in the different topics. I am a Dropmyemail employee who works hands on with the security of the site, although I'm replying on my personal capacity. We don't practice security through obscurity so we can discuss the technicalities of our security measures here. I would appreciate not being treated as an incompetent goon though, to keep things friendlier. I see on this thread you accuse someone of being sent by the company I work for to discredit you personally: They did not, furthermore, I personally see your article as a valuable service, you will see in our site that we try to be as transparent as possible, and there's nothing that I could want more than for people to actually know and understand what Dropmyemail is about. Thanks for your article.

laurenceputra 14y ago
i'm not assuming you are incompetent. what i'm saying is that no system is fully secure, and by saving the users' passwords, you are risking them. one of the first rules i learnt in web development is this, you do not store passwords. (http://www.codinghorror.com/blog/2010/12/the-dirty-truth-about-web-passwords.html http://www.codinghorror.com/blog/2010/12/the-dirty-truth-abo...) you never assume that your system will be so secure that no one can hack it.
- nubis 14y ago
  Indeed, no system is fully secure, and we don't try to hide that fact, that's one of the reasons Dropmyemail exists in the first place. We offer people an off-site backup at the cost of trusting a third party with their password. This is a risk assessment discussion, and I believe although good for raising awareness about what dropmyemail offers, the original articles fails to make a distinction between the objective information it provides and what are your personal valuations on the risk involved (for example, it assumes one of the worst possible scenarios regarding our competence). Things get a bit confusing when non security related topics like storage capacity are mixed in though. I believe you are trying to help people to be safe and choose the better tool to solve their problem, I do think you are underestimating them a bit, but in case I'm wrong I repeat how valuable your article is in raising this issues.

indiangeek 14y ago

One thing I fail to understand is the experience of the author in making such a statement. As per his profile, he is an undergraduate student at NUS. I did check NUS's courses offered and there is hardly any course in hacking or teaching much about security. They just have a basic module on security which is not even mandatory. ANd the author is questioning the security practises of a company whose CTO has a 25+ years of work experience (Team page). He fails to understand the fact that it is not possible to do regular backups without the password. Something the user totally skippd in his article.