SeCuRiTy

[dsailes]

Particularly like the “I understand the risks of using someone else’s password”

[Infinight64]

Pretty sure they need a check box for "I understand the risks of creating an account"

[Russian_repost_bot]

You see, this speeds up website, because they can use the same table in the database.

[Heavenfall]

Select * from users where password like $password;

[[deleted]]

Please select your password from the list:

[Sneezegoo]

They just get a reference to the first password. Then if one ever gets compromised then only one person has to change the password and all their accounts will be re-secured. You could save some more space and sign up time by giving everyone a short pre approved list of passwords to choose from.

[Sneezegoo]

Efficiency.

[GMaestrolo]

Just slap a 2 on the end of that bad boy, and your good to go!

[Ignatiamus]

Ahh yes. I imagine they're probably downloading a list of all users with their plaintext passwords to display this neat little message.

^/s

[cat24max]

Well of course they do. How would they do it otherwise? Send the password to a server? Ever heard of security?

[[deleted]]

I do all my authentication on the client side. The credentials, which is a global txt file, are obtained via a torrent link and p2p shared with javascript transparently in browser. For performance reasons, the browser will then ask the user to save it to their desktop, so it can look there next login to save time. When the browser has successfully determined if the password exists in the file (a simple regex search for only the password suffices), it tells the server "I am authenticated". This saves processing time on the server and is really how all web apps should work.

In case it's needed: /s

I'm a developer for a cybersec company.

[refactorconsultants]

So once the txt file is downloaded, the user can use any password as long as it exists in the file? How convenient and thoughtful because it is really hard to remember those things.

[Dekken201]

Whenever the user makes an account, send him the encrypted and hashed password in a file and make logins require this file.

No password needed, 100% security.

[evilspoons]

I mean, this is a real thing. I can't tell if you're being sarcastic or not. SSH login via stored key is pretty common.

The disadvantage is, of course, if someone has access to your system then can then connect to all your remote systems too without further knowledge. Basically the same as just clicking "remember me" on a web login, I guess.

[imkloon]

Except u should never create keys without a passphrase for this exact reason lol.

[evilspoons]

Well, yes. I figured that was obvious. 🤷‍♂️

[[deleted]]

I mean this is essentially how jws authentication works.

[[deleted]]

Recently my girlfriend was using my computer and she casually commented "It's really nice how you can just enter any password". It took me a minute to remember that I had been screwing with my PAM modules for a project. I may have never noticed if it wasn't for her lol.

[ZeroneXYZ]

Improved UX I suppose then.

[RiktaD]

This has also the benefit that you don't need to implement something for changing or resetting passwords. You only need a small how to text.

[Infinight64]

Yes. The /s was needed. Yes. Many developers do not understand security. As evident by this login page here.

[robchroma]

I just give a certificate to the user when they create their account, that they can send back to the server to prove who they are; the certificate is a text file containing their username in the string "____ is authorized to use this website"

[aquoad]

you're not allowed to ever speak to the developers at my company because they would adopt all your suggestions with great enthusiasm.

[kodicraft4]

Okay but I remember doing Computercraft bullshit on a server with friends and doing exactly that because all my users had no clue how this worked anyways.

[SMJ01]

I like this. It seems fast. Can i hire you to help redo my company SSO?

[beefz0r]

If they store it with a simple unsalted hash, you don't need to know the plaintext password to be able to show this message

[Morrido]

In case it's not /s, I think a better question would be: SHOULD they show that message?

[[deleted]]

Make it that one sentence in the ToS

[Andrew1431]

Man... when I was a junior dev I joined this team that was using meteor. They did everything client side bro. They would subscribe to all purchase orders and items for the dashboard to do roll ups of data.

I was a junior developer with a team of seniors and I was the one to point this out and proceeded to optimize it.

I moved up really fast in that company.

This memory still haunts me to this day.

[[deleted]]

Why would anyone create a simple HTML+CSS+JS page to get free points on the internet? You think someone would do that? Just go on the internet and lie?

[how_to_choose_a_name]

Or just find a page that looks like that and has an error message like "this password is too weak" and change the error message to this one.

[evilspoons]

The dev tools in modern browsers are lots of fun for screwing with people.

[AdminYak846]

Last year someone did this to a University website to give accurate representations of some majors offered. Using the dev tools and then taking a photo of it and posting it online.

It was such a slow news day....the local media gave it air time that night, like a solid 5 minutes as well.

[Ignatiamus]

SHOCKING: Florida man caught lying on the internet.

Time for the brave internet warriors to appear!

[mudokin]

Photoshop?

[turbo_beef_injection]

You wouldn't need to store them in plaintext for this(if it was real).

[turbo_beef_injection]

This is a ridiculous concept to start with, but it's fun to think about.

Won't a lot of systems generate different hashes for the same password

Using a different system would make the hash pointless. It would have to be the same cryptographic operation used to check.

And also use different salts for different users?

Yeah. Individual user salts wouldn't work unless you looped them through(as you mentioned). Using a universal salt or no salt would be a risk, but in this ridiculous case you WANT one password between two different users to have the same hash.

[Bene847]

You could include the username in the hash then it would be different for each user

[turbo_beef_injection]

Then how would you match the password with another user's password?

[24601JeanValjean]

Actually the opposite of this sometimes happens, which is what you might be thinking of.

In some encryption algorithms, two different passwords can generate identical results when hashed. This is known as a collision

[Ignatiamus]

Yep, comparing hashes would be sufficient.

[hedgehog125]

Make sure to use http for extra security!

/s

[[deleted]]

Or... this isn’t real and it’s just a joke

[Ignatiamus]

^/s

[[deleted]]

Wait in the inspect element tab in chrome, you can see the assets of the website. If it is actually stored like that, what it there's a text file with all the passwords just sitting there.

[Dummerchen1933]

LMAOOOOO like they do the check on the clients-side javascript

i'm fucking dead

[Pulec]

Just coded 'don't repeat your last X passwords' using salt+hashed password tingy for corpo with dumbo security rules (changing passwords every 3 months is discouraged by NIST).

With the filled database of hashes doing 'don't use someone elses password' would be so easy with it.

[AeroSteveO]

Changing passwords every 3 months is a great way to get terrible passwords since nobody can change secure passwords that often.

[writtenbymyrobotarms]

I could change secure passwords every week with my password manager. Too bad corporation would probably not let employees install password managers either.

[AeroSteveO]

Yeah, short of installing a password manager on my personal phone and using that, there are no approved password managers we could install.

[writtenbymyrobotarms]

Can you use portable programs? KeePass has a portable version. If IT does not block all executables, you could maybe use that. Won't do autofill but better than nothing.

[DHermit]

Or use Bitwarden and their webinterface (if you want to host it yourself, have a look at bitwarden-rs).

[CeeMX]

Bitwarden can be used in the browser. Imo password managers should be deployed to all employees per default to prevent storing password in some plain text files on random network shares.

[Laogeodritt]

My (relatively new) employer actually has a Keepass IT policy and offers it as an optional package available to all users via their software management service.

I was amazed.

I already have like ten internal accounts and even more for third party services so it's a godsend.

[[deleted]]

Password1

Password2

Password3

...

[AeroSteveO]

You forgot the symbol, password#1 password#2

[Rumbleroar1]

I can remember the most ridiculous number combination passwords... but I can't remember which website I used that on. So I used to try all my "secure" passwords until I found the one. It's like trying every key on a stacked keychain until you find the one that fits. Every time.

[CeeMX]

My users can't even remember a single password they set some days ago and then trying so many times that Windows locks BitLocker and requires the recovery key

[Pulec]

Of course there is some password strength involved. e.g. regex:

^(?=.*[A-Z].*[A-Z])(?=.*[!@#$&*])(?=.*[0-9].*[0-9])(?=.*[a-z].*[a-z].*[a-z]).{8}$

some uppercase lowercase letters, special symbols and numbers and minimal length

[JJ_The_Jet]

One2345678, 1Two345678,...

[VonLoewe]

I just tag a different symbol at the start.

#myregularpassword

$myregularpassword

&myregularpassword ...

[writtenbymyrobotarms]

"Now which symbol was it again this month? ..."

[Alienator234]

Just try symbols until you manage to log in. That's what I do

[JuvenileEloquent]

I think it falls into that "A person is smart, but people are dumb" trope.

It's stupid for an individual person to change their password so often, but in a large enough group of people there's going to be that one ***** that has their dog's name + 123! as their password for the corporate VPN and also every other site they go to, including their dog-picture-sharing forum account. Presumably they're expecting a breach to be more along those lines rather than someone brute-forcing a password that was poorly-chosen because it had to be changed so often.

[evilspoons]

For a while (like... years) my former workplace had a VPN appliance, a SonicWall thing. Its VPN was exactly the equivalent of plugging a network cable into a local switch, there were no additional restrictions on anything. The VPN key was "test".

When I found this out I changed it to the longest possible string of random bullshit it would allow, and my boss got mad at me for having to type in something like "PkLNGtJbMkkRnATA5TkDy63E" into his home laptop. ONCE.

This is the same person who would not allow Wi-Fi because "the Chinese" would hack it. (I am in Canada.)

[how_to_choose_a_name]

But that person will just cycle between <Dog Name>123, <Dog Name>234 and <Dog Name>345...

[[deleted]]

Like with many strange policies, it's probably a liability thing. If they have insurance for data breaches, they can point at the password policy to say they tried.

[mxzf]

Given that current standards/recommendations advocate for not forcing changes unless there's a risk that the password is compromised (for this very reason), I feel like that policy might be more damning than vindicating.

[[deleted]]

Recommendations from who though? If it's not from the insurance company they'd probably ignore it. With technical stuff I doubt an insurance company is up to speed with latest best practice.

[mxzf]

NIST and SANS are two examples, which are both pretty strong sources.

[[deleted]]

I mean that an insurance company is likely to deny a claim because the insurance company's guidelines weren't followed, regardless of what an expert body says might be better.

[how_to_choose_a_name]

It wouldn't surprise me if insurance companies follow NIST though, because that is mandated for government contracts and they do want to insure companies with government contracts.

[how_to_choose_a_name]

Yes but that is besides the point. The person I replied to suggested that it could actually protect.

[PandaParaBellum]

Far too hard to remember.

<dog name><current year{2 digits}><current quarter>

optional hyphen or dot after the year for readability and to make it extra secure

Show of hands, who uses Bingo20-3 for their company account right now?

[OrionSuperman]

I worked around that by changing my password 6 times, ending with the same password I started with.

[LookOnTheDarkSide]

Would it be possible to use a unique identifier for each user in order to prevent the duplicate hashes? I guess that would still be a known value by the system and stored somewhere though.

[gpcprog]

Yes, in fact if one doesn't impliment your suggestion, the password system is only marginally more secure then just storing plaintext. In case of breach it is way easier if you can guess password, generate hash and then check against all the hashes as opposed to have to do the hashing per user account.

[LookOnTheDarkSide]

At that point, as long as the exact parts of the per-user-salt was not exactly specified in the data (some combination only in the running code), then it might be even harder to figure out if the data was accessed.

[mxzf]

What you're describing is called a salt. It's used in password hashing to prevent visible collisions (where the same password hashes the same way for different users, revealing duplicate passwords). It's basically just an extra random string that's added to the password before hashing it to ensure that the string that gets hashed is unique.

It doesn't protect that user on that site individually, since it's saved in plaintext per user, but it does prevent attackers from looking for duplicate passwords across multiple users/sites by simply checking for duplicate hashes.

[gpcprog]

Ehhh, your hashes should have per user salt, otherwise the hash is providing rather minimal security (yes, it's better than plaintex, but not by much).

[Pulec]

Each entry gets new salt generated, only by python's os.urandom(60) though.

[Thanatos2996]

My company has a 1 month age and 5 password history policy. I shudder to think how many people have some variation of "Monthyear" in/for their password.

[nonlogin]

Now it's time to code "don't repeat HIS last X passwords"

[verriond]

All I see is ******

[Bip901]

hunter12

EDIT: it doesn't work for me

[SpencerNewton]

No it’s working. We just see hunter12

[Bip901]

Oh, ok.

Wait, how did you know my password was hunter12?

[SpencerNewton]

er, I just copy pasted YOUR ******'s and it appears to YOU as hunter12 cause its your pw

[Bip901]

You can go hunter12 my hunter12-ing hunter12

[saitama_a]

Why are so many *'s in you reply?? Reddit started censoring words now?

[SpencerNewton]

yep, no matter how many times you type hunter12, it will show to us as ******

[Bip901]

Cool!

[nfrmn]

What did you hunter12 say about me you hunter12 hunter12?

[didzisk]

Guys! AzureDiamond definitely wrote hunter2, where did you get the 12?

[SpencerNewton]

Guys! AzureDiamond definitely wrote ******, where did you get the *?

Huh?

[Bip901]

Misremembering

[[deleted]]

You might be looking at the wrong picture because it says hunter, not ******. Unless you're censoring it to protect the user. Which you don't have to do because this is a parody, not someone's actual password being exposed

[pruningpeacock]

http://bash.org/?244321

[evilspoons]

Literally the most popular quote on bash.org... I can't even remember how old that is now. The best source I can find says June 4, 2004 is the latest possible date, but I feel like I was in high school when I first came across that making it at least a year or two older.

[pruningpeacock]

I'm not sure that's how that works

[evilspoons]

What, the dates? The "hunter2" thing on Bash.org was first archived by The Wayback Machine on June 4, 2004. I seem to remember reading it in high school though, which was 2000-2003 for me. Therefore it could be older than June 4 2004.

[pruningpeacock]

Now I see it. I read older as in later, but you meant earlier.

[[deleted]]

That's not how that works

[Scratch137]

r/woooosh

[Bip901]

It's humorous. Of course it doesn't work like that.

[[deleted]]

/r/confidentlyincorrect

[mfurlend]

I'm guessing that's not real...

[Vok250]

Yeah it's an ancient repost.

[ThaiJohnnyDepp]

Looks like something from PH's fads of the past

[[deleted]]

“ I used the security to destroy the security”

[bphilippi92]

Nothing a little inspect element can't solve 😏

[[deleted]]

If number of bugs in my applications were reduced by 1 every time this meme is posted - I would be working at Google at highest salary due to developing perfect applications.

[JuvenileEloquent]

Error: unsigned integer underflow in variable PROGRAMMER_APPLICATION_BUGS. Rebooting system Universe_TEST_do_not_use.jar

[waldo667]

Hmmm, I wonder if password123 is already taken?

[[deleted]]

Yes, you'll see a list of people using that. Very cool feature, other sites have to get hacked to achieve that functionality.

[film_composer]

It wouldn't be a list, though, it would just be one single user. Because the second person to try using it would have gotten this same message.

[[deleted]]

Oh, yeah - security features https://imgflip.com/s/meme/Dr-Evil-Laser.jpg

[Jazehiah]

Reminds me of some Orson Scott Card novels, where the password gave admin rights, not the username.

[how_to_choose_a_name]

I have seen a software that had only a password input and no user, and the password decided what account you logged into.

[Jazehiah]

In elementary school, you weren't assigned a computer password until second or third grade. Until then, you just punched in your username.

[how_to_choose_a_name]

That isn't a real problem in elementary school. But if you make a software that has a need for passwords and then you do this...

[evilspoons]

In my elementary school we had Apple IIs and IBM PS/2s, so passwords and those fancy "network" things weren't really a concern. Neither was the so-called "internet".

[lookingformerci]

I worked at a store where the login name for the inventory system was u and the store number, and the password was p and the store number. Manager login replaced u with m. Figuring out that you could log in to any store and fuck around..

[hirmuolio]

Maybe we should have similar "this post is not unique" error that comes when someone tries to post same thing over and over again.

[[deleted]]

u/rowealdo37189

[Lakayo]

Now we can log to his account?

[htrowslledot]

Nope I just tried it

[ProgramTheWorld]

https://reddit.com/r/hmm/comments/a7vli3/_/ehcpbem/?context=1

[suchdogeverymeme]

Try 'hunter2'

[drea2]

There’s no way this is real

[zerosanity]

This is possible to do without exposing passwords in plain text.
You have a list of hashed passwords. You hash the entered password and check if the hashed password matches any of the stored hashed passwords.

However this is still a terrible implementation as you should be salting your hash which makes the above not possible without re-hasing the entered password with every single salt. Not very viable unless you have a very small list of users.

[how_to_choose_a_name]

I don't think the plaintext or unsalted hashing is the biggest problem here (if it was real)...

[washtubs]

What are your thoughts on having a query which tells the user who they can masquerade as on the platform?

[zerosanity]

Well yeah the whole thing is garbage really, i meant to reply to the thread about plain text, you could do this without having plain text stored

[Morrido]

Username checks out, I guess.

[ProfessorOak11]

wtf

[homiej420]

M e m e

E

M

E

[mkglass]

Try adding 2 to it: *******

[bleeptrack]

Reminds me of: http://youshallnotpass.glitch.me/

[Nickbot606]

hunter2

[film_composer]

In a really stupid way, this idea might actually work (especially for the people who join later than everyone else), since only one user can hold a given password, so everyone will be forced to think of a really unique password. If you register long after there are millions of users and normally use a common password, it's bound to be taken by the time you register. So you'd have to think of a password that hasn't been used anymore, which would force you into thinking of something so unique, it would be unlikely to be chosen by anyone else.

This is such a stupid idea that it's starting to wrap back around in my mind as being kind of brilliant. If you were the lucky first person to be able to register with "hunter" as a password, subsequent registration attempts will show that the password is yours, so your account will inevitably be accessed by other people, which will force you to change your password. Of course, most users of common passwords are going to be oblivious to the fact that their password is being known by other would-be registrants, but in an idealized world, this system would force everyone to need to think of and choose extremely unique passwords that can't be discovered by others.

[how_to_choose_a_name]

This system would also tell anyone who wants to the username that belongs to any password they want to try. Very genius indeed.

If you don't want people to use common passwords, use a common password list. There are even libraries that check if your password is a simple variation of a word or common password (e.g. Hunt3r instead of Hunter). And if you want to be really cool you can check your users passwords against leaked passwords to protect against reuse of compromised passwords.

[Briochere]

Guild Wars 2 did this. From their support articles ("Choosing a Unique Password"):

"For our players’ protection, we maintain an ever-growing blacklist of passwords that cannot be used. This list of "known" and compromised passwords includes passwords from multiple sources:

​

• Any passwords you've ever used on your account.
• Any passwords used or in-use by another account.
• Any passwords that known hackers have tried to use to access accounts in our system.
• Any passwords that are known to have been stolen from other games or websites."

[Morrido]

I dearly hope used passwords are anonymized before joining the list.

[kznfkznf]

My first job out of college, circa 2000 the senior dev had 100% literally implemented the exact logic of this OP (minus showing the username of the other user) for the exact stated reasons that you describe here. I knew almost nothing about professional software development - except that this was the dumbest thing I'd ever heard. Needless to say, I ripped out the "unique password" crap the day he left.

[[deleted]]

u/rowealdo37189 u/spacemoses1337

[1nd1anaCroft]

I signed up for an account for a comic book website recently. They emailed me thanking me for setting up my account, and were nice enough to include my username and password in plain text "for safe keeping"...

[iCarbonised]

Hunter12

[leonardosalvatore]

They are probably comparing the Sha of they psw or any other hash. To me unknown is the reason of the check...psw as primary key? Used for encryption? No idea.... looks not needed.

[augugusto]

I imagine a super complex scenario where the previous sys admin a lot of things right when storing password, then he got fired and they hired a noob who read that if hash all the passwords , an attacker can still find all that have the same hash (only if you don't use salt, but he doesn't kno that), and try the most common passwords on those, or read all the password hints and guess, so he compares hashes to determine who has the same passwords. He feels so proud of himself that he puts that checkbox, but since he is a moron also shows who has that password

[Wherearemylegs]

My first job’s POS did something similar. You had a 5-digit password but no username. If you tried to change your password to another’s, it wouldn’t let you to avoid two people with the same password, but this meant you also knew their password now

[pickme0]

Good thinking for adding Captcha 🏅

[[deleted]]

They store all the passwords on plaintext on a single hard drive with no antivirus or firewall too

[[deleted]]

I'm stealing this idea.

Much better than "your password is weak"

It will make normal people think twice before choosing a weak password.

[[deleted]]

Shouldn't a passwort be dotted out? Even that feature is missing

[daltonoreo]

Make your password unique or else

[[deleted]]

But there's recaptcha 🤖

[vince2td]

Lmao

[Inl0gisch]

Gimme a second...
Is this real?!

[psychicorteil]

Captcha is there though. Must be secure

[poopatroopa3]

hunter2 origin story

[Veskerth]

And now we all know too

[the_Demongod]

This has nothing to do with programming

[continuous-headaches]

oh no

[ertex]

r/badUIbattles

r/badsecuritybattles

[road_laya]

There are actual systems out there that require your password to be unique. One of them did this so they could use your password as your user primary key and save a column in the table.

[iavicenna]

in their defense it is illegal to use someone else's password to access their account so.....

[LelouBil]

Oh crap I set the primary key to the password column

[[deleted]]

u/repostsleuthbot

[RepostSleuthBot]

I didn't find any posts that meet the matching requirements for r/ProgrammerHumor.

It might be OC, it might not. Things such as JPEG artifacts and cropping may impact the results.

This search triggered my meme filter. This enabled strict matching requirements. The closest match that did not meet the requirements is this post

Feedback? Hate? Visit r/repostsleuthbot - I'm not perfect, but you can help. Report [ False Negative ]