News for hackers. Stuff that matters.

A comment on Newegg stores your password in plaintext. Parent comment

Re:Newegg stores your password in plaintext by shizcakes on Tuesday May 24, 2011 @08:17PM (#2582309)
Yes. That person would then have access to your account on that service, but would not have the password that you used. Since people often use the same passwords across multiple services, that password being exposed would mean that their accounts on multiple services is theoretically exposed.

While I don't condone anyone using the same password on multiple services, it happens. Given that hashing a password and providing a reset link is "novice" level easy, it should be a standard practice.

[ Parent | on HN ]
Re:Newegg stores your password in plaintext by jwhitney on Tuesday May 24, 2011 @08:26PM (#2582342)
More importantly, they can only gain access to the service by changing the password, thus giving away the fact that something has happened.
[ Parent | on HN ]
Re:Newegg stores your password in plaintext by Retric on Tuesday May 24, 2011 @09:01PM (#2582434)
You can always save a hash, change the password, and then restore the hash. Basically, if you have direct access the the DB you can loin to someones account without them knowing or permanently changing the password. Granted, there are some minor issues with salting passwords etc, but protecting an account from someone with long term RW access to a DB and reasonable understanding of the system is next to impossible.
[ Parent | on HN ]
Re:Newegg stores your password in plaintext by jerhinesmith on Tuesday May 24, 2011 @08:19PM (#2582318)
Ah, yes, that makes sense. I was considering the case where the attacker simply wants access to your account on 'compromised system x' -- not where they're simply using 'compromised system x' as a conduit for obtaining your password (in the hopes that it's used elsewhere across the web).

Thanks!

[ Parent | on HN ]
Re:Newegg stores your password in plaintext by Johngibb on Wednesday May 25, 2011 @12:12AM (#2582824)
The other issue is that the former can be done without the affected user knowing it. If a attacker resets your password, you're going to know right away when you can't log in.
[ Parent | on HN ]