full-disclosure - SMC Router safe Login in plaintext

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: cchurch at alertlogic.net (C. Church)
Subject: SMC Router safe Login in plaintext

> Every ISP I've ever dealt with stores your password in plaintext.  If
> this were not true, they would not be able to tell you what it is.  Just
> call support, identify yourself and ask them to change your password for
> you.

*shaking head in disbelief*

I've worked for numerous ISPs and not once did _any_ of them ever do
anything as _stupid_ as storing a list of their customers' passwords in
plaintext. (Of course, I'm sure there are a few who lack the foresight to
see the eventual breech of security, but those tend to go out of business
pretty rapidly.)

Did you read what you just said?  How many ISPs have you called where they
would "Tell you what your password is"?  If your ISP can tell you what your
password is, let us know who it is, so we can all avoid them in the future.

Answer: they don't need to know your old password to change your password.
It's called permissions, and privileged access.  As root, or a priveleged
user, I can change anyone's password without having to know the old one.

Think about it.

!c