Larion Studios forum stores your passwords in unhashed plaintext. Don’t use a password there that you’ve used anywhere else.

  • hex@programming.dev
    link
    fedilink
    English
    arrow-up
    30
    arrow-down
    4
    ·
    1 year ago

    Yeah if they send the password in an email in plain text that’s not storing it. You can send the email before you store the password while it’s still in memory and then hash it and store it.

    • Cabrio@lemmy.worldOP
      link
      fedilink
      English
      arrow-up
      11
      arrow-down
      53
      ·
      edit-2
      1 year ago

      Stored in memory is still stored. It’s still unencrypted during data processing. Still bad practice and a security vulnerability at best. Email isn’t E2E encrypted.

      • beefcat@lemmy.world
        link
        fedilink
        English
        arrow-up
        32
        arrow-down
        4
        ·
        edit-2
        1 year ago

        there is no possible way to handle sensitive data without storing it in memory at some point

        it’s where you do all the salting, hashing, and encrypting

        emailing out credentials like this after sign up is certainly not best practice, but probably not a huge deal for a video game forum of all things. if you are re-using passwords then you already have a way bigger problem.

        • JackbyDev@programming.dev
          link
          fedilink
          English
          arrow-up
          13
          arrow-down
          1
          ·
          1 year ago

          emailing out credentials like this after sign up is certainly not best practice,

          Understatement of the year right here. Everyone in this thread is more interested in dunking on OP for the few wrong statements they make rather than focusing on the fact that a service is emailing their users their password (not an autogenerated “first time” one) in plaintext in an email.

        • RonSijm@programming.dev
          link
          fedilink
          English
          arrow-up
          3
          arrow-down
          1
          ·
          1 year ago

          there is no possible way to handle sensitive data without storing it in memory at some point

          Since we’re nitpicking here - technically you can. They could run hashing client side first, and instead of sending the password in plain-text, you’d send a hashed version

            • RonSijm@programming.dev
              link
              fedilink
              English
              arrow-up
              2
              ·
              1 year ago

              No, the client side hashing doesn’t substitutes anything server side, it just adds an extra step in the client

          • ilinamorato@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            This opens up the possibility of replay attacks in the case of data breaches, though, and those are much more common than http mitm attacks (made even less likely with the proliferation of https).

            I’m not entirely sure whether hashing twice (local and server) is wise, having not thought through that entire threat vector. Generally I try to offload auth as much as I can to some sort of oauth provider, and hopefully they’ll all switch over to webauthn soon anyway.

            • RonSijm@programming.dev
              link
              fedilink
              English
              arrow-up
              1
              ·
              1 year ago

              I’m not really sure how it opens up replay attacks, since it doesn’t really change anything to the default auth. There are already sites that do this.

              The only difference is that instead of sending an http request of { username = "MyUsername", Password = "MyPassword" } changes to { username = "MyUsername", Password = HashOf("MyPassword") } - and the HashOf(“MyPassword”) effectively becomes your password. - So I don’t know how that opens up a possibility for replay attack. There’s not really any difference between replaying a ClearText auth request vs an pre-hashed auth request. - Because everything else server side stays the same

              (Not entirely auth related), but another approach of client side decryption is to handle decryption completely client site - meaning all your data is stored encrypted on the server, and the server sends you an encrypted container with your data that you decrypt client side. That’s how Proton(Mail) works in a nutshell

              • ilinamorato@lemmy.world
                link
                fedilink
                English
                arrow-up
                1
                ·
                1 year ago

                I’m not really sure how it opens up replay attacks

                Put simply, jt allows an attacker with a leaked database to use the hashed password as a password. In your original comment, it seemed like you were suggesting hashing only before transmission, on the client; but hashing both before and after would indeed patch that particular vulnerability. I don’t know if there are potential problems with that strategy or not.

                another approach of client side decryption is to handle decryption completely client site

                Here’s potentially an opportunity for me to learn: how does such a service (like Proton Mail) perform this in a web browser without having access to the data necessary to decrypt all of the data it’s sending? Since you can’t count on a web browser to have the private key, do you send down an encrypted private key that can only be decrypted with the user’s password? Is there some other way to do this that I’m not aware of?

                • RonSijm@programming.dev
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  edit-2
                  1 year ago

                  In your original comment, it seemed like you were suggesting hashing only before transmission

                  Ok, that wasn’t what I was suggesting, no. That would effectively make your password hash the password itself - and it would kinda be stored in PlainText on the server, if you skip the client auth and send that value to the server directly through the api or something

                  how does such a service (like Proton Mail) perform this in a web browser without having access to the data necessary to decrypt all of the data it’s sending? […] do you send down an encrypted private key that can only be decrypted with the user’s password?

                  Yes, pretty much. I can’t really find a good, detailed explanation from Proton how it exactly works, but LastPass uses the same zero-knowledge encryption approach - which they explained with some diagram here - with a good overview of the client/server separation of it’s hashing.