21 posts in this topic

Posted

I ask because when I sign in using an account I give as a 'spam this email' with an inheritly rubbish password I am greeted with a page displaying;
"Your password is too easy to guess
Your current password is on a list of passwords that hackers frequently try to use. Create a new one to help keep your account secure."
So either it's stored unencrypted, or reverse-encrypted or it's a one-way hash and they've got a list of hashes that are easy to guess?
Anyone know which it is?

Share this post


Link to post
Share on other sites

Posted

maybe the password strenght level has been stored upon registration before the encryption. I hope they do not store passwords in plain text :/

Share this post


Link to post
Share on other sites

Posted

If I were to guess, I'd say it was a list of hashes, or list of plaintext passwords scrubbed from obvious attacks. I doubt Microsoft would store Hotmail passwords in plaintext or reversable encryption. If they did I'd expect to see "this is your password" emails instead of "reset your password" emails.

Share this post


Link to post
Share on other sites

Posted

There are specific passwords that are simple to guess...that make an easy to decrypt hash. They are warning you on the basis of that fact.

Even if it's an account you don't use for anything other than spam it's still wise to protect it, just in case of any other links. You'd be surprised just how little information someone needs to make a link between things and go after master accounts and such.

Share this post


Link to post
Share on other sites

Posted

whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same.
2 people like this

Share this post


Link to post
Share on other sites

Posted

It's a spam account in that it's got nothing on it at all, doesn't even have email access.
It wouldn't store the password security on registered, it's a pretty old account from before they had the strength indicator :p.

I wouldn't think they'd use plain text or reversible encryption but I am starting to worry that they do, even if they stored it in plain text, they wouldn't allow you to see the password and would still require you reset the password.

"whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same."
Do you work for microsoft, can you say you've seen the database scheme to comment like you know exactly how their database is setup ?

Share this post


Link to post
Share on other sites

Posted

[quote name='vcfan' timestamp='1352760919' post='595315182']
whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same.
[/quote]

Probably this.

I wager it is a simple look up to see what matches to common hashed items that they gleaned from hacker attempts, and also just basic common passwords that everyone and their brother use).

Best method to confirm would contact the Hotmail team/devs and look into it.

Share this post


Link to post
Share on other sites

Posted

[quote name='n_K' timestamp='1352761020' post='595315188']
It's a spam account in that it's got nothing on it at all, doesn't even have email access.
It wouldn't store the password security on registered, it's a pretty old account from before they had the strength indicator :p.

I wouldn't think they'd use plain text or reversible encryption but I am starting to worry that they do, even if they stored it in plain text, they wouldn't allow you to see the password and would still require you reset the password.

"whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same."
Do you work for microsoft, can you say you've seen the database scheme to comment like you know exactly how their database is setup ?
[/quote]

vcfan has not, unless I am mistaken. However I have...I worked on a team that was directly responsible for the monitoring and safety of Xbox LIVE so I have more than a little experience in this matter.

I cannot comment on specifics (of course for security reasons), but there's no need to worry about the level of security employed here. Just don't use an easy password...that's the point of that message. Easy passwords can be guessed without any sort of skill really required.

Share this post


Link to post
Share on other sites

Posted

Alright okay Shane, thanks for the info.! :)

Share this post


Link to post
Share on other sites

Posted

[quote name='n_K' timestamp='1352761609' post='595315220']
Alright okay Shane, thanks for the info.! :)
[/quote]

No problem. :)

Share this post


Link to post
Share on other sites

Posted

They store them as a plain text file trust me ive seen it, i know your passwords! lol =P

Nah as said they will have a list of common passwords encrypted however they encrypt there passwords, they will then probably do a match up when you change your password and give you a warning if it matches one of the encrypted ones on there list. Shouldnt be anything to worry about, but if you are then just make it harder symbols and numbers are always nice.

Share this post


Link to post
Share on other sites

Posted

[quote name='vcfan' timestamp='1352760919' post='595315182']
whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same.
[/quote]But if you throw in salt, even the same password would not generate the same hash... because of the salt.
And I would hope they store salted passwords :-/

Share this post


Link to post
Share on other sites

Posted

I would expect that they use salted hashes, which would mean you couldn't compare it against a pre-calculated list of encrypted hashes either. More likely, the server tries to *guess* your password from a list of common passwords, meaning it would have to generate a salted hash for each password and compare it to the salted hash of your password. But for a small list of common passwords (100-1000), this would only take a fraction of a second to test for each account registration / password change.

Share this post


Link to post
Share on other sites

Posted

they could also do it client-side

Share this post


Link to post
Share on other sites

Posted

[quote name='primexx' timestamp='1352767871' post='595315456']
they could also do it client-side
[/quote]
It's not client side, when logging in to msn over SSL, a 302 redirect takes you to the 'weak password' page.

Share this post


Link to post
Share on other sites

Posted

Bear in mind that as you said, you just logged in. As part of the logging in process, you provided an unencrypted version of your password. It would be easy as part of the login process for them to check that against a stored list of weak passwords, and forward you on to a page warning you of its weakness, no need to be able to decrypt the stored password to do that.

Share this post


Link to post
Share on other sites

Posted

Maybe i am just being dumb here but

when you type in a username it automatically check to see if thats available using ajax/jquery for example

whats stopping it doing the same for passwords before its encrypted?

Share this post


Link to post
Share on other sites

Posted

Another "maybe I am dumb" question here..

Isn't it the case that when you create a password, that it would be transmitted unhashed anyway? (plaintext - over SSL of course!) So the server receives it as plaintext and can easily do text comparison to a list of unsecure passwords?

Then when it saves it, it would salt+hash the password. When you login, it would do the same thing - transmit plaintext, then the server hashes it and compares it with the stored hash?

Share this post


Link to post
Share on other sites

Posted

Right you are, it does send the password unencrypted! I always assumed it uses client-side javascript to MD5 it which is why I assumed it sent the details to an 'md5crum' page but it doesn't! Learn something new every day :p

Share this post


Link to post
Share on other sites

Posted

[quote name='n_K' timestamp='1352819158' post='595316698']
Right you are, it does send the password unencrypted! I always assumed it uses client-side javascript to MD5 it which is why I assumed it sent the details to an 'md5crum' page but it doesn't! Learn something new every day :p
[/quote]

Well they're using HTTPS so it's technically still secure... Right?

Share this post


Link to post
Share on other sites

Posted

[quote name='Majesticmerc' timestamp='1352845717' post='595318018']
Well they're using HTTPS so it's technically still secure... Right?
[/quote]
Yep it's all secured over HTTPS but the password isn't MD5'd before it's sent so it can check if your password is weak or not.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.