2

Recently I signed up for new account for a service provider's web site.

I entered the usual the name, email , password (strong) , repeat password and I was signed up. Great everything works well.

A few days later I had some trouble logging in, I did the 'forgot password' process and yet my new password (strong) did not work.

I contacted the system admin and during the conversation, he told me what my current password is. :o

I was shocked because he knows what my password is. Is it not best practice to hash passwords?

What if I am someone who uses the same password for all of my accounts? Now those accounts are compromised

I am wondering if there is a way to know when entering passwords in a sign up form , the database admin uses some form of hashing for any website and therefore cannot see the 'actual' password?

By knowing this I can refuse to sign up (possible phishing site to target amateurs) and/ or use a different password.

Regards

5
  • Although not completely reliable, a very simple thing to do is to try to send an incredibly long password to the request, like 2000 characters. I am yet to come across a database which would have reserved more than 512 bits for passwords, because common hash algorithms fit in it quite well. If website blocks you because your password is too long, it is probably going to be saved in plain-text. – Andy Jun 15 '16 at 11:27
  • @DavidPacker - I wonder if out of force of habit, some web developers limit text length based on the specs even though in the case of password it should apply only to the database. – JeffO Jun 15 '16 at 11:50
  • It should be noted that encryption and hashing are two different things. Encryption is reversible, but (in theory) difficult without the key. Hashing is not reversible and is subject to collisions. – 8bittree Jun 15 '16 at 17:24
  • @8bittree - Thank you for your comment, my question is about hashing – chineerat Jun 16 '16 at 20:13
  • I brought it up because your title mentioned encryption, but your question body used hashing. And the answers didn't seem to differentiate between the two. – 8bittree Jun 16 '16 at 20:20
3

Is it not best practice to hash passwords?

Absolutely, yes.

Doesn't mean that it always happens, though.

What if I am someone who uses the same password for all of my accounts? Now those accounts are compromised

Yes, they are and that's why you shouldn't use the same password for everything.

Sorry, but not doing so is also Best Practice.

I am wondering if there is a way to know ... uses some form of hashing for any website and therefore cannot see the 'actual' password?

Impossible.
Nobody is going to tell you that they hold your password in plain text (or some other, recoverable form) for precisely the reason you state. It would lose them business.

Bear in mind that there is a [small] chance that they do encrypt your password, just in a recoverable form, for cases like this or, perhaps, for "feeding" to some other, external system that won't integrate with theirs. Again, it's not exactly Best Practice, but it does happen.

1

Frankly, it doesn't matter and you shouldn't care. The simple reason is that even encrypted passwords can be decrypted given time, so the concern should be whether the user database containing passwords can be obtained by a hacker, through whatever means.

As I doubt anyone can say whether a random site is secure, the best practice you can do is to simply assume that your password is saved in plain text and is going to be obtained by a hacker. With this in mind, think what changes you would do regarding your passwords and logins.

Personally, I'd ensure that I use different emails (eg aliases that send to a common account), different usernames and a new, long gobbledigook password for each and every site I sign up to.

If you assume your password is secure, you may take shortcuts for convenience (such as reusing a password), and when a site gets hacked (I'd point to an example but there are so many you could almost pick a site at random and get a hit) you become vulnerable. You'd be surprised how quickly hackers can decrypt passwords. So assume the worst right from the start.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.