full-disclosure - SMC Router safe Login in plaintext

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: dotslash at snosoft.com (KF)
Subject: SMC Router safe Login in plaintext

I know when I worked for an ISP it was certainly not 
like that... their system ran off some sort of unix 
box using pppd. All their passwords were in 
etc/passwd and shadow with the rest of em.

Can't say I remember telling anyone their password 
either. We would happily reset them for you if you 
forgot yours (after you gave something like a social 
sec number as identification and verified as much 
info as possible). This sort of thing was done 
through a front end that the admin had coded up....
no clear text passed just laying around though. heh.

oh yeah Paul do you wanna tell me some of your 
throwaway passwords. =]
-KF

C. Church wrote:
>>Every ISP I've ever dealt with stores your password in plaintext.  If
>>this were not true, they would not be able to tell you what it is.  Just
>>call support, identify yourself and ask them to change your password for
>>you.
> 
> 
> *shaking head in disbelief*
> 
> I've worked for numerous ISPs and not once did _any_ of them ever do
> anything as _stupid_ as storing a list of their customers' passwords in
> plaintext. (Of course, I'm sure there are a few who lack the foresight to
> see the eventual breech of security, but those tend to go out of business
> pretty rapidly.)
> 
> Did you read what you just said?  How many ISPs have you called where they
> would "Tell you what your password is"?  If your ISP can tell you what your
> password is, let us know who it is, so we can all avoid them in the future.
> 
> Answer: they don't need to know your old password to change your password.
> It's called permissions, and privileged access.  As root, or a priveleged
> user, I can change anyone's password without having to know the old one.
> 
> Think about it.
> 
> !c
> 
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>