Monolith Development

How many online accounts do you have? How many of those accounts have the exact same password? Now how many of those accounts are associated with the same email address?

I have well over 100 accounts which is excessive for the average user. For a developer its just part of my daily life. I do not have a unique random password for each online account. I would guess the average user has at least 10 different accounts including, online banking, social websites, email and other services. I guarantee the average user does not have a unique password for each account. Its an unreasonable inconvenience to come up withe a unique login/password combination for every single account.

I work with all sorts of user management systems. Open source, commercial, and even built my own. Its scary to see how some of these systems are put together. There are always security holes but a common point of weakness is the user password. I use to be astonished but anymore I expect to see the same flaw.

When you enter your user name and password to login to a website the form submits that information and looks for a match on the database. If there is a match the system verifies your identity. The problem is there is a high probability that your password is stored on the database in plain text.

What’s the big deal?

System administrators, and in some cases company employees have access to your user information including that password. There is still a common myth that the little black dots on the password box are hiding your password. Those dots are not hiding your password. Preventing the dots from obscuring your password is trivial.

Not only is your information available to the site administrators its subject to being disclosed by a hacker if the site isn’t properly protected. There are always holes and given enough motivation a hacker will find a way in.

What’s the solution?

Minimal protection involves storing the password as a hash. This means your password is saved as group of sudo random letters and numbers. Hashing is often confused with encryption. The big difference between the two is encrypted data can be read, hashed data can not. When a password is stored as a hash it can not be reconstructed. The system can only check if the hashed value matches the plain text value. A hacker or system administrator does not have access to your password.

The bad news is even hash’s can be cracked given enough time and resources. But why make it easy? Storing passwords in plain text is like leaving the keys in the ignition.

So what’s the big deal?

An article on tech crunch lays out a little different twist on how weak password security allowed a hacker access to twitter’s company documents. In this example the hacker exploited the “lost password” feature across multiple accounts to gain access.

If the web application is not secure and your passwords are in plain text it makes it much easier. Take this scenario for example. You register for an account on some random website. You use your email address as the user name, which is common and enter your re-usable password. Is this the same email account you use for your online banking? Is it the same password? You can see where I’m going with this. For every entry vector I can think of I promise someone else has 10. How about the secret questions, “What city were you married in?” How hard would it be to find this information online?

How do I know if my password is stored correctly?

The short answer, you don’t. There are couple tell tail hints that will confirm your password is in plain text. The most obvious is password retrieval. When you click on “forgot my password” does it send you back a password you entered or a random generated password? If it sends you something that you recognize as your password its a guarantee that the password is stored in plain text. If you receive a random password you need to go in and change it. The password could be exposed at any point between creation and mail delivery.

How can I protect myself?

Almost nobody will use a strong unique password for each web service. The best way to implement safeguards in a manner that you will actually use is to tier your passwords. All financial accounts need to have a unique strong password. No exception. For other services I scale my passwords on how much information the website has. A forum might have the weakest password. I might use the same password for all the forums I visit. The same could be true for rarely used backend administration tools. For services that I don’t need critical updates I never use my primary email address. Use gmail or hotmail for these services.