Jump to content



Photo

Does hotmail store passwords in plain text?

hotmail plain text password

  • Please log in to reply
20 replies to this topic

#1 n_K

n_K

    Neowinian Senior

  • 5,366 posts
  • Joined: 19-March 06
  • Location: here.
  • OS: FreeDOS
  • Phone: Nokia 3315

Posted 12 November 2012 - 22:39

I ask because when I sign in using an account I give as a 'spam this email' with an inheritly rubbish password I am greeted with a page displaying;
"Your password is too easy to guess
Your current password is on a list of passwords that hackers frequently try to use. Create a new one to help keep your account secure."
So either it's stored unencrypted, or reverse-encrypted or it's a one-way hash and they've got a list of hashes that are easy to guess?
Anyone know which it is?


#2 +Heartripper

Heartripper

    Neowinian

  • 1,142 posts
  • Joined: 10-December 09
  • Location: Italy
  • OS: Windows 8.1
  • Phone: Nokia Lumia 925

Posted 12 November 2012 - 22:45

maybe the password strenght level has been stored upon registration before the encryption. I hope they do not store passwords in plain text :/

#3 +Majesticmerc

Majesticmerc

    Resident Idealist

  • 6,073 posts
  • Joined: 24-August 05
  • Location: United Kingdom
  • OS: Arch Linux / Win 7
  • Phone: HTC One X

Posted 12 November 2012 - 22:45

If I were to guess, I'd say it was a list of hashes, or list of plaintext passwords scrubbed from obvious attacks. I doubt Microsoft would store Hotmail passwords in plaintext or reversable encryption. If they did I'd expect to see "this is your password" emails instead of "reset your password" emails.

#4 Shane Nokes

Shane Nokes

    Neowinian Senior

  • 2,243 posts
  • Joined: 29-July 12

Posted 12 November 2012 - 22:51

There are specific passwords that are simple to guess...that make an easy to decrypt hash. They are warning you on the basis of that fact.

Even if it's an account you don't use for anything other than spam it's still wise to protect it, just in case of any other links. You'd be surprised just how little information someone needs to make a link between things and go after master accounts and such.

#5 vcfan

vcfan

    Doing the Humpty Dance

  • 4,863 posts
  • Joined: 12-June 11

Posted 12 November 2012 - 22:55

whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same.

#6 OP n_K

n_K

    Neowinian Senior

  • 5,366 posts
  • Joined: 19-March 06
  • Location: here.
  • OS: FreeDOS
  • Phone: Nokia 3315

Posted 12 November 2012 - 22:57

It's a spam account in that it's got nothing on it at all, doesn't even have email access.
It wouldn't store the password security on registered, it's a pretty old account from before they had the strength indicator :p.

I wouldn't think they'd use plain text or reversible encryption but I am starting to worry that they do, even if they stored it in plain text, they wouldn't allow you to see the password and would still require you reset the password.

"whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same."
Do you work for microsoft, can you say you've seen the database scheme to comment like you know exactly how their database is setup ?

#7 Skin

Skin

    Neowinian

  • 1,130 posts
  • Joined: 11-April 07

Posted 12 November 2012 - 22:59

whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same.


Probably this.

I wager it is a simple look up to see what matches to common hashed items that they gleaned from hacker attempts, and also just basic common passwords that everyone and their brother use).

Best method to confirm would contact the Hotmail team/devs and look into it.

#8 Shane Nokes

Shane Nokes

    Neowinian Senior

  • 2,243 posts
  • Joined: 29-July 12

Posted 12 November 2012 - 23:00

It's a spam account in that it's got nothing on it at all, doesn't even have email access.
It wouldn't store the password security on registered, it's a pretty old account from before they had the strength indicator :p.

I wouldn't think they'd use plain text or reversible encryption but I am starting to worry that they do, even if they stored it in plain text, they wouldn't allow you to see the password and would still require you reset the password.

"whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same."
Do you work for microsoft, can you say you've seen the database scheme to comment like you know exactly how their database is setup ?


vcfan has not, unless I am mistaken. However I have...I worked on a team that was directly responsible for the monitoring and safety of Xbox LIVE so I have more than a little experience in this matter.

I cannot comment on specifics (of course for security reasons), but there's no need to worry about the level of security employed here. Just don't use an easy password...that's the point of that message. Easy passwords can be guessed without any sort of skill really required.

#9 OP n_K

n_K

    Neowinian Senior

  • 5,366 posts
  • Joined: 19-March 06
  • Location: here.
  • OS: FreeDOS
  • Phone: Nokia 3315

Posted 12 November 2012 - 23:06

Alright okay Shane, thanks for the info.! :)

#10 Shane Nokes

Shane Nokes

    Neowinian Senior

  • 2,243 posts
  • Joined: 29-July 12

Posted 12 November 2012 - 23:07

Alright okay Shane, thanks for the info.! :)


No problem. :)

#11 Xoligy

Xoligy

    Neowinian

  • 999 posts
  • Joined: 09-May 10

Posted 12 November 2012 - 23:09

They store them as a plain text file trust me ive seen it, i know your passwords! lol =P

Nah as said they will have a list of common passwords encrypted however they encrypt there passwords, they will then probably do a match up when you change your password and give you a warning if it matches one of the encrypted ones on there list. Shouldnt be anything to worry about, but if you are then just make it harder symbols and numbers are always nice.

#12 cybertimber2008

cybertimber2008

    Neowinian Senior

  • 1,737 posts
  • Joined: 02-December 08

Posted 13 November 2012 - 00:39

whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same.

But if you throw in salt, even the same password would not generate the same hash... because of the salt.
And I would hope they store salted passwords :-/

#13 +Xinok

Xinok

    Resident Reresident

  • 3,492 posts
  • Joined: 28-May 04
  • Location: Shikaka
  • OS: Windows 7 x64
  • Phone: Galaxy S3 (Wicked)

Posted 13 November 2012 - 00:47

I would expect that they use salted hashes, which would mean you couldn't compare it against a pre-calculated list of encrypted hashes either. More likely, the server tries to *guess* your password from a list of common passwords, meaning it would have to generate a salted hash for each password and compare it to the salted hash of your password. But for a small list of common passwords (100-1000), this would only take a fraction of a second to test for each account registration / password change.

#14 primexx

primexx

    Neowinian Senior

  • 12,737 posts
  • Joined: 24-April 05

Posted 13 November 2012 - 00:51

they could also do it client-side

#15 OP n_K

n_K

    Neowinian Senior

  • 5,366 posts
  • Joined: 19-March 06
  • Location: here.
  • OS: FreeDOS
  • Phone: Nokia 3315

Posted 13 November 2012 - 08:41

they could also do it client-side

It's not client side, when logging in to msn over SSL, a 302 redirect takes you to the 'weak password' page.