Re: Status of Recent User Information Leak

[inman]

It looks as though the Gods have been getting some rough treatment by some monks. OK so storing the passwords as plaintext is embarrassing and it is fundamentally disappointing that this whole affair took place. However, I got an e-mail this morning informing me of the problem and then found that I had to reset the account password since it had been changed for me. This is a reasonably pro-active response and the gods should claw back some credit for that.

On a separate note - the job of changing passwords on other sites was easy because I use PasswordSafe. This allows me to create random passwords for each new site. The ones that had my old password in were really old accounts.

Ever noticed how difficult it is to delete an account?

[biohisham]

Everybody at Perl Monks make you feel not-alone or left-out in front of an angry boss, a lazy soul that whispers at pulling you offtrack from learning Perl consistently or any monstrous authority for that matter, a great win-win to everyone PM is. Instead of criticizing the admins and debating whether they have neglected a security aspect we should be glad that they could bear the hassle of running this free site and all the bedeviling shots that come along, without PM all of us would be punching in the dark sometime somewhere to get a certain code working or would be going through noncontiguous Google's results in order to extract some knowledge which is a frustration. Risk arises if the displayed passwords were shared for different user-accounts, but is this not against the very strict rule that says "each account somebody has should have it's own independent password" too?, so maybe all of us share the blame if we were among those who pooled their passwords. As you said, crediting the Admins, the monks and the users in here for this site is worth it,supporting them is worth it and looking up to them is worth it as well..

[Anonymous Monk]

each account somebody has should have it's own independent password

This is an ideal. Personally I juggle about 10 different passwords in my head. A unique one for EVERY site that needs access? Impossible. A password manager? Not on every access point I use.

I was using a password on this site I share with other non-critical systems so there was no risk of any commercial system being accessed using the exposed password. However I did have to go and change my generic password on the other websites on which I use it.

The problem with computer development is that it is a small part science and a large part art. A large part of it is managing risk. How much risk do you take using 1 password vs convenience? How about 5 passwords vs convenience. How about 250 (pretty inconvenient for me, I can't even name every bone in the body.. might work for surgeons though..)?

Now trade the effort required to salt and store passwords. Hmm, about 3 minutes using the crypt() function. How much risk is alleviated doing this? More than enough to mandate it for any web project.

[ysth]

Now trade the effort required to salt and store passwords. Hmm, about 3 minutes using the crypt() function.

A few additional minutes would be required to replace the password reminder system.

[ysth]

Are you saying you wouldn't have changed your reused passwords if the crackers had only gotten crypt()'d passwords?!

[Anonymous Monk]

Instead of criticizing the admins and debating whether they have neglected a security aspect we should be glad that they could bear the hassle of running this free site and all the bedeviling shots that come along, without PM all of us would be punching in the dark sometime somewhere to get a certain code working

There is no question that the site bears some useful purpose. But such a fundamental mistake as to directly expose plain-text passwords absolutely deserves strong criticism.

Only a few months ago I stood my ground (through a protracted potentially career-limiting argument) with a project manager about salting passwords used for a website I was involved with the creation of. He didn't get it because he wasn't technical. The Admins of this site, however, should have "got it".

I can no longer post to this site using my original user name as my e-mail address has been published and could well be used to infer projects I am involved with. However that's inconvenient, not unforgivable, as hacks happen. Having to change other sites' passwords as a result of plain text leaks, however, is intolerable.

[Your Mother]

I've said before that I agree it was a bush-league mistake and it would be nice to see the site practice what we all preach but I'm getting sick of critiques like yours because they're all fundamentally flawed. As every sign-in on this site is under http and not https your password is sent as clear text regardless of how it happens to be stored on the site. It's inherently insecure.

(update: noticed parv, and others, brought this up already.)

[Anonymous Monk]

directly expose plain-text passwords

What do you mean by directly expose?

[Polyglot]

Instead of criticizing the admins and debating whether they have neglected a security aspect we should be glad that they could bear the hassle of running this free site and all the bedeviling shots that come along, without PM all of us would be punching in the dark sometime somewhere to get a certain code working or would be going through noncontiguous Google's results in order to extract some knowledge which is a frustration.

How many users does it take to make the programmers of a "free software" bear some responsibility for its integrity?

Consider the following "free" things, and whether you would be a bit indisposed if any one of them had a similar leak of your email address, password, and real name due to a server that wasn't secure.

• linux
• Firefox
• Skype
• Gmail
• Hotmail
• Yahoo Mail
• MSN Messenger
• Facebook
Businesses have come to rely on these products. Should they not? Should everyone be content for the free service these products give, even if now and then their security is breached and passwords, emails, and IDs become public info?

[biohisham]

Yeah, you have a point there, when you talk about each one of the services you mentioned, Linux and down to Facebook, remember, these guys are companies, they are established as companies, they have many other sources of income and hence they could afford rendering a free service or more than one free service "or flavor", setting the standards for the industry.

That is one side, the other side is, the amount of huge businesses that advertise their contents through these sites is another source of income which is generous, here at PM, it is much of a community participation or cooperative work, the members themselves donate and share for the betterment of the site - more or less of course- You really have a point that it is frustrating when a leak takes place but considering the circumstances where this matter happened is worth noticing, first, the server that had these information was a retired one and second, it was a remote probability that it could be accessed. I am not vouching for PM and I am not sympathizing with those who got their passwords compromised and neither am I implying that a free service has downgrades simply because it is free, those who got other sources of stability can afford a top-of-the-bar standard easier than can others, it is sad, but the responsibility is mutual and so is the burden here at Perl Monks.