2

A bit of context:

I used the password recovery of a website I am using (the website of a big corporation). My password was immediately sent back to me via text message. I did not receive a reinitialization link or a temporary password but my real password in plain text. After contacting the webpage owner to ask him if he was stocking passwords without encrypting them, he answered that there was a number of ways to keeps password encrypted on their servers while still being able to send the password back. In my understanding a good encryption cannot be reversed by the server and a password cannot be “safe” if there is a request allowing it to be decrypted.

My question:

Is there a way to do that? If there is a way to do that, what is it? What are its strengths and drawbacks?

Thank you.

5
  • Sharing your research helps everyone. Tell us what you've tried and why it didn't meet your needs. This demonstrates that you've taken the time to try to help yourself, it saves us from reiterating obvious answers, and most of all it helps you get a more specific and relevant answer. Also see How to Ask – gnat Nov 29 '19 at 13:05
  • Which corporation? i want any login removed from there! No, storing a password should not be a thing. Usually when a user enters a password a Hashing algorithm would be used to generate a hash which is stored. a hash is one way, it is not something with which you would be able to recover the original password . – Dbuggy Nov 29 '19 at 13:44
  • @Dbuggy That was my understanding as well. It's a French mobile network operator's website. I Intend to report this security issues to the "National Cybersecurity Agency of France" but I wanted to make sure that I was not mistaken as I am not an expert but merely an enthusiast :D – Claustre Nov 29 '19 at 13:50
  • I am confused by your question. "In my understanding a good encryption cannot be reversed by the server" – Why would you think that? The whole point of encryption is that it can be reversed. (But only if you have the key.) If you couldn't reverse it, it would be pointless. In the same vein, what do you mean by "revertible encryption"? Encryption is always revertible, again, that is the point. – Jörg W Mittag Nov 29 '19 at 17:06
  • @JörgWMittag You're correct that encryption is revertible. I believe this is being contrasted against one way hashing which never reconstructs the password. The real issue here then is WHO can decrypt the password. It looks like the server owner can. That aint good. You're only defense at this point is if the server owner has no idea what you're using the password for. Which is extremely weak security. – candied_orange Nov 29 '19 at 18:02
4

Your instincts are correct, this is a terrible practice.

I see a couple of possibilities:

  1. The web server encrypts the password using keys stored in the web server, and sends the data encrypted to the database. The web server uses its keys to decrypt the data from the database prior to sending it to you via text.
    • Strengths: The web site owner can truthfully claim their data is "encrypted at rest"
    • Weaknesses: If the web server is hacked and the keys are stolen, the data may as well have been stored without encryption. Also, since they sent your password to you in plain text, there's no way of knowing how many computers it went through unencrypted between their server and whatever machine sent the text.
  2. The database itself stores keys and encrypts the data before writing it to the disk, but when asked returns plain text to the web server.
    • Strengths: You don't have to store the keys in the web server.
    • Weaknesses: Same problem as above (what if the database is hacked?), plus the plain text password is sent over the network between the database and the web server.
  3. The guy lied and they're storing plain text passwords in the database.
    • Strengths: It is cheap and easy to do and was (sadly) common practice several decades ago. It is possible that their code is a giant ball of mud and they either don't want to spend the money to fix it or they don't know how.
    • Weaknesses: Obvious - they're ripe for a security breach.

TL;DR You don't know how they're handling your data. However, you have indisputable evidence that they're willing to send sensitive data over insecure channels.

2
  • Thank you for your answer. I will then refer to the "National Cybersecurity Agency of France" to see if they can force this website to increase their security. In the meantime I have removed my password from their website. – Claustre Nov 29 '19 at 15:38
  • 4
    @Claustre: it is naive to believe that closing your account is enough: (1) nothing proves that your password was actually removed, and (2) the website may have been compromised for a long time, constantly leaking passwords to hackers. Your next step is to ensure you never used the same password on any other website; if you did, consider changing it on every website where you reused it. – Arseni Mourzenko Nov 29 '19 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.