Liberty SMS - Unauthorized access to IT infrastructure

garp said:
Yes, but supposedly no in the clear passwords were breached?
Click to expand...

If they need to log into the banking on someone's behalf, they need to be able to decrypt those passwords. You would be surprised how many people store the encryption keys and salt in the same database.
 
whatwhat said:
If they need to log into the banking on someone's behalf, they need to be able to decrypt those passwords. You would be surprised how many people store the encryption keys and salt in the same database.
Click to expand...

Do you store passwords in your databases?
 
whatwhat said:
Yes, and securely. Which includes doing risk assessments and penetration testing as part of the system.

We're software professionals, not stack overflow developers.
Click to expand...

Then why do you store passwords? Who does that?
 
whatwhat said:
Cool story. I'm going to put you on my ignore list so good luck with your Liberty investigations!
Click to expand...

Ah yes, the age old solution to a debate that exhausts your resources. At least dispute what I said if you are up to it.
 
phaktza said:
So we authenticate with our...
Click to expand...

You supply your password, but the service provider should NEVER store it ANYWHERE on their server... there's loads of info on how this stuff works on Google.
 
Last edited:
Sinbad said:
He's talking about two way encrypted passwords, used to log into other systems. Not one way hashes used to authenticate a user.
Click to expand...
"encrypting the password instead of hashing it is a bad idea and is borderline storing plain text passwords. The whole idea of slow hash functions is to thwart the exfiltration of the user database. Typically, an attacker that already has access to the database can be expected to also have access to the encryption key if the web application has access to it."

Let's see what he says.
 
phaktza said:
OK, so we store it on a...
Click to expand...

What is 'it' in your question and who is 'we'?

*EDIT* let me put you out of your misery lol. Speedreading ftl. I see the debate was about storing third party passwords. Yeah, that's just a bad idea and should just not be done, ever. There are way better solutions including certificate based systems.
 
Last edited:
phaktza said:
"encrypting the password instead of hashing it is a bad idea and is borderline storing plain text passwords. The whole idea of slow hash functions is to thwart the exfiltration of the user database. Typically, an attacker that already has access to the database can be expected to also have access to the encryption key if the web application has access to it."

Let's see what he says.
Click to expand...
You store a one way hash. Not an encrypted password.
 
Sinbad said:
You store a one way hash. Not an encrypted password.
Click to expand...

I assume they were talking about a service that accesses your bank account on your behalf - you supply your credentials. Really stupid idea - it's just bad practice. They should be negotiating with banks for certificate based R/O API access or other similar secure method.
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X