News for hackers. Stuff that matters.

A comment on Feds tell web firms to turn over user passwords. Parent comment

Re:Feds tell web firms to turn over user passwords by EnderMB on Friday July 26, 2013 @05:58AM (#6107388)
You're absolutely right. However, is it a crime that could be tracked, without an employee explicitly whistle-blowing to the feds? Even then, could the feds prove this? I'm no expert, and I'm probably wrong in saying this, but in my mind it'd be near impossible to prove that a provided hash had been tampered with, instead of a user just changing their password.

It's morally wrong, and obviously I'm not saying it's the way to go. It's just a theory that I had, and I wanted to know if it was feasible for a company to do this.

[ Parent | on HN ]
Re:Feds tell web firms to turn over user passwords by TomNomNom on Friday July 26, 2013 @07:08AM (#6107572)
FWIW if a fed has an account with the service (which is fairly likely for big services like Gmail et al), and knows the hashing algorithm (if they've successfully got the passwords this is pretty likely too) they could prove it easily by hashing their password themselves and comparing it to the stored version.
[ Parent | on HN ]