full-disclosure - Re: password.incleartext.com

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <BANLkTimUxx2h-GtNkaKqGyBSPG8LJvsd5Q@mail.gmail.com>
Date: Wed, 6 Apr 2011 18:10:29 +0100
From: Cal Leeming <cal@...whisper.co.uk>
To: "Thor (Hammer of God)" <thor@...merofgod.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>,
	Inc leartext <staff@...leartext.com>
Subject: Re: password.incleartext.com

People should be using a different password for every external service
anyway, so technically this shouldn't even matter ;)

On Wed, Apr 6, 2011 at 5:42 PM, Thor (Hammer of God)
<thor@...merofgod.com>wrote:

>  This isn’t necessarily true – without knowledge of how the data may be
> encrypted and what processes are involved in decrypting the data, one can’t
> make the “it isn’t secure” statement.
>
>
>
> That being said, it is probably safe to argue that sites that do not
> require PCI, SOX, HIPPA, etc would be less inclined to engage in this level
> of security.  But that doesn’t mean that it is not being done.
>
>
>
> t
>
>
>
> *From:* full-disclosure-bounces@...ts.grok.org.uk [mailto:
> full-disclosure-bounces@...ts.grok.org.uk] *On Behalf Of *Mario Vilas
> *Sent:* Wednesday, April 06, 2011 9:05 AM
> *To:* Romain Bourdy
> *Cc:* full-disclosure; Inc leartext
> *Subject:* Re: [Full-disclosure] password.incleartext.com
>
>
>
> Actually, if they can get the data back (be it because it's stored in
> plaintext or in obfuscated plaintext) then it's not secure. Obfuscation
> doesn't make it more secure, or any less plaintext.
>
> On Wed, Apr 6, 2011 at 11:01 AM, Romain Bourdy <achileos@...il.com> wrote:
>
> Hi Full-Disclosure,
>
> Just my two cents but ... the fact they can give your password back doesn't
> mean it's stored in cleartext, just that it's not hashed but encrypted with
> some way to get the original data back, this doesn't mean at all it's not
> secured, even though in most case it's not.
>
>  -Romain
>
>
>
> On Wed, Apr 6, 2011 at 1:36 PM, <Maksim.Filenko@...b.com> wrote:
>
> Kinda plaintextoffenders.com?
>
> wbr,
>  - Max
>
> full-disclosure-bounces@...ts.grok.org.uk wrote on 01.04.2011 02:17:24:
>
> > Inc leartext <staff@...leartext.com>
> > Sent by: full-disclosure-bounces@...ts.grok.org.uk
> >
> > 01.04.2011 13:14
> >
> > To
> >
> > full-disclosure@...ts.grok.org.uk
> >
> > cc
> >
> > Subject
> >
> > [Full-disclosure] password.incleartext.com
>
> >
> > Hi FD,
> >
> > Just launched a new website to keep a list of websites storing
> > passwords in clear text, so far the database is small but feel free
> > to add some:
> >     http://password.incleartext.com/
>
>
> >
> > Cheers,
> > Inc Leartext_______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
>
>
> --
> “My daughter was asked by a little old lady in a London hotel restaurant
> what her daddy did - she answered, ‘He’s a pirate.’ I was very proud of that
> answer.”
> - *Johnny Depp*
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/