Verifying Secure Password Storage Externally
Many websites (including big ones like Adobe, Yahoo, LinkedIn, Gawker, etc.) store user passwords insecurely. Either in plain text, or encrypted (reversible), or using a broken or brute-forceable hash function. Many websites continue to be built with poor password storage mechanism.
So what? Well, if the database leaks somehow (and it obviously happens, see the link above), then users are in trouble – not only their accounts on the problematic site is compromised – many of their accounts around the web may be compromised, because of the natural tendency of users to reuse passwords. So if your site is broken, it’s not only about you – it’s about your users’ other accounts, and that alone means the matter is very serious.
We know how to implement it, yes – use bcrypt/PBKDF2/scrypt. We know, but many people don’t. So I thought it may be good to give good websites a way to prove to their users that they take the password issue seriously.
So I created SaltedHashed.com (as a weekend project). It requires website owners to expose their password-storing mechanism as a REST-like API endpoint, which my service invokes periodically to check if everything is ok. The invocation consists of a random-generated password, and the website must respond with the algorithm it uses, together with the final form of the password that is stored in the database.
After the process is successful, the site gets a badge (like those “Valid XHTML”, “Valid CSS”, “Secured by VeriSign”, etc. badges that we (used to) have) which says “We store passwords securely” and links to a page that gets the up-to-date status of the site and explains the user why this is important. It’s not much, I know, but it has the tiny chance of raising awareness of the issue, and that’s important.
The only algorithms that are recognized as secure are Bcrypt, PBKDF2 and Scrypt. SHA-512 isn’t. No simple hashing function is. Encryption is not allowed (because it is reversible, and if the attacker gets ahold of your key, all the passwords are revealed).
The solution is not bullet-proof – someone might expose a dummy Bcrypt endpoint, while still using plain-text passwords, but as noted in the docs – why would you not use functionality that you’ve already implemented for the sake of being “compliant”? In general, I think the effort on the side of developers, in order to expose the endpoint, is minimal.
The project is on GitHub. It’s written in Java, with Spring MVC. MongoDB is used as a database. It is currently deployed on OpenShift (RedHat’s PaaS) mainly because it’s easy to setup and is free. (Note: I obviously need a better designer to at least fix the badge and make the site less ugly, even though Bootstrap minimizes the change for a developer like me to make a really ugly thing). Authentication on saltedhashed.com is done only via Mozilla Persona – 3rd party authentication which doesn’t require storing passwords on my end (something I’d actually recommend to all websites).
I’m trying to address a small, but important problem. I hope I’m helping improve the situation at least a little.
Many websites (including big ones like Adobe, Yahoo, LinkedIn, Gawker, etc.) store user passwords insecurely. Either in plain text, or encrypted (reversible), or using a broken or brute-forceable hash function. Many websites continue to be built with poor password storage mechanism.
So what? Well, if the database leaks somehow (and it obviously happens, see the link above), then users are in trouble – not only their accounts on the problematic site is compromised – many of their accounts around the web may be compromised, because of the natural tendency of users to reuse passwords. So if your site is broken, it’s not only about you – it’s about your users’ other accounts, and that alone means the matter is very serious.
We know how to implement it, yes – use bcrypt/PBKDF2/scrypt. We know, but many people don’t. So I thought it may be good to give good websites a way to prove to their users that they take the password issue seriously.
So I created SaltedHashed.com (as a weekend project). It requires website owners to expose their password-storing mechanism as a REST-like API endpoint, which my service invokes periodically to check if everything is ok. The invocation consists of a random-generated password, and the website must respond with the algorithm it uses, together with the final form of the password that is stored in the database.
After the process is successful, the site gets a badge (like those “Valid XHTML”, “Valid CSS”, “Secured by VeriSign”, etc. badges that we (used to) have) which says “We store passwords securely” and links to a page that gets the up-to-date status of the site and explains the user why this is important. It’s not much, I know, but it has the tiny chance of raising awareness of the issue, and that’s important.
The only algorithms that are recognized as secure are Bcrypt, PBKDF2 and Scrypt. SHA-512 isn’t. No simple hashing function is. Encryption is not allowed (because it is reversible, and if the attacker gets ahold of your key, all the passwords are revealed).
The solution is not bullet-proof – someone might expose a dummy Bcrypt endpoint, while still using plain-text passwords, but as noted in the docs – why would you not use functionality that you’ve already implemented for the sake of being “compliant”? In general, I think the effort on the side of developers, in order to expose the endpoint, is minimal.
The project is on GitHub. It’s written in Java, with Spring MVC. MongoDB is used as a database. It is currently deployed on OpenShift (RedHat’s PaaS) mainly because it’s easy to setup and is free. (Note: I obviously need a better designer to at least fix the badge and make the site less ugly, even though Bootstrap minimizes the change for a developer like me to make a really ugly thing). Authentication on saltedhashed.com is done only via Mozilla Persona – 3rd party authentication which doesn’t require storing passwords on my end (something I’d actually recommend to all websites).
I’m trying to address a small, but important problem. I hope I’m helping improve the situation at least a little.
I enjoy the method that you put thijs together, thanks a lot.
If you are going for most excellent contents like
me, simply visit this web page every day as it gives quality contents, thanks
Georgia practiced the most undiluted and common kind
of convict leasing ciągników rolniczych of any of the southern states.
In recent years, the game has gained increasing popularity in America as well.
If obvious coaching is given, a foul will be called and the shot will be turned over with
a free spot behind the break line. Also, observing a team leader is a great way to preview an employee’s leadership style
before they are assigned larger and more complex responsibilities.
com has a great selection, along with gear for athletes who play baseball,
softball, football, cross country, lacrosse and more. ll bet
these hockey costumes would scare the hell out of anyone trying to make a penalty shot, whether
you. Fans can choose to instantly use their SHi – FT Codes to gain better equipment which they
can use to help them tackle the new Ultimate Vault Hunter Mode or they can opt to wait and use their golden key after reaching the
new level-cap of 61 so that they can be assured to get a max level
piece of gear.
Can I simply say what a relief to discover somebody that actually understands what
they’re discussing on the internet. You certainly know how to
bring an issue to light and make it important. A lot more people
should check this out and understand this side of the story.
I was surprised you aren’t more popular since you certainly possess the gift.