News for hackers. Stuff that matters.

A comment on But why can't I send people their passwords?. Parent comment

Re:But why can't I send people their passwords? by Mithaldu on Wednesday June 25, 2014 @08:46AM (#7943546)
"Man In The Middle (MITM)" is the important bit. For example by sniffing the wireless traffic on an unencrypted wlan you can capture entire emails being sent or received, without ever compromising the account.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by slight on Wednesday June 25, 2014 @08:50AM (#7943557) 

  - Request password reset.
  - Sniff email with reset link.
  - Go to reset link before user does and change password.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by asuffield on Wednesday June 25, 2014 @09:18AM (#7943668)
The key difference is that capturing a plaintext password means the user and attacker both share a password without the user realising, while capturing a reset link means that one of them will win and the other will observe their password reset has failed.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by Mithaldu on Wednesday June 25, 2014 @08:52AM (#7943566)
That will work, however it will also leave the user with a clue that their account may have been compromised. It is also a noticable degree harder to pull off than simply sniffing a password being sent, due to needing to know the target's data necessary to request a reset.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by omervk on Wednesday June 25, 2014 @12:16PM (#7944888)
Hence our mentioning that the user must receive a mail notifying of the password change.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by u124556 on Wednesday June 25, 2014 @02:55PM (#7946039)
It would be better if the website allowed the user to set the new password first and then send an email to confirm the password change.
[ Parent | on HN ]
Re:But why can't I send people their passwords? by Rapzid on Wednesday June 25, 2014 @08:55AM (#7943578)
Entire clear text emails. Everyone SHOULD be using TLS wrapped email protocols. That doesn't mean they are, but gmail is https all the way and many providers now require TLS connections to the mail servers.

Still, one time use password reset links with explicit instructions and set expectations to reset the password immediately is the way to go if you're emailing anything IMO.

[ Parent | on HN ]