20 replies to this topic

[n_K]

I ask because when I sign in using an account I give as a 'spam this email' with an inheritly rubbish password I am greeted with a page displaying;
"Your password is too easy to guess
Your current password is on a list of passwords that hackers frequently try to use. Create a new one to help keep your account secure."
So either it's stored unencrypted, or reverse-encrypted or it's a one-way hash and they've got a list of hashes that are easy to guess?
Anyone know which it is?

[+Heartripper]

maybe the password strenght level has been stored upon registration before the encryption. I hope they do not store passwords in plain text

[+Majesticmerc]

If I were to guess, I'd say it was a list of hashes, or list of plaintext passwords scrubbed from obvious attacks. I doubt Microsoft would store Hotmail passwords in plaintext or reversable encryption. If they did I'd expect to see "this is your password" emails instead of "reset your password" emails.

[Shane Nokes]

There are specific passwords that are simple to guess...that make an easy to decrypt hash. They are warning you on the basis of that fact.

Even if it's an account you don't use for anything other than spam it's still wise to protect it, just in case of any other links. You'd be surprised just how little information someone needs to make a link between things and go after master accounts and such.

[vcfan]

whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same.

[n_K]

It's a spam account in that it's got nothing on it at all, doesn't even have email access.
It wouldn't store the password security on registered, it's a pretty old account from before they had the strength indicator .

I wouldn't think they'd use plain text or reversible encryption but I am starting to worry that they do, even if they stored it in plain text, they wouldn't allow you to see the password and would still require you reset the password.

"whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same."
Do you work for microsoft, can you say you've seen the database scheme to comment like you know exactly how their database is setup ?

[Skin]

vcfan, on 12 November 2012 - 22:55, said:

whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same.

Probably this.

I wager it is a simple look up to see what matches to common hashed items that they gleaned from hacker attempts, and also just basic common passwords that everyone and their brother use).

Best method to confirm would contact the Hotmail team/devs and look into it.

[Shane Nokes]

n_K, on 12 November 2012 - 22:57, said:

It's a spam account in that it's got nothing on it at all, doesn't even have email access.
It wouldn't store the password security on registered, it's a pretty old account from before they had the strength indicator .

I wouldn't think they'd use plain text or reversible encryption but I am starting to worry that they do, even if they stored it in plain text, they wouldn't allow you to see the password and would still require you reset the password.

"whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same."
Do you work for microsoft, can you say you've seen the database scheme to comment like you know exactly how their database is setup ?

vcfan has not, unless I am mistaken. However I have...I worked on a team that was directly responsible for the monitoring and safety of Xbox LIVE so I have more than a little experience in this matter.

I cannot comment on specifics (of course for security reasons), but there's no need to worry about the level of security employed here. Just don't use an easy password...that's the point of that message. Easy passwords can be guessed without any sort of skill really required.

[n_K]

Alright okay Shane, thanks for the info.!

[Shane Nokes]

n_K, on 12 November 2012 - 23:06, said:

Alright okay Shane, thanks for the info.!

No problem.

[Xoligy]

They store them as a plain text file trust me ive seen it, i know your passwords! lol =P

Nah as said they will have a list of common passwords encrypted however they encrypt there passwords, they will then probably do a match up when you change your password and give you a warning if it matches one of the encrypted ones on there list. Shouldnt be anything to worry about, but if you are then just make it harder symbols and numbers are always nice.

[cybertimber2008]

vcfan, on 12 November 2012 - 22:55, said:

whats so hard to understand? if you password is hashed, then they've hashed common passwords and compare them to your hash,which ends up being the same.

But if you throw in salt, even the same password would not generate the same hash... because of the salt.
And I would hope they store salted passwords :-/

[+Xinok]

I would expect that they use salted hashes, which would mean you couldn't compare it against a pre-calculated list of encrypted hashes either. More likely, the server tries to *guess* your password from a list of common passwords, meaning it would have to generate a salted hash for each password and compare it to the salted hash of your password. But for a small list of common passwords (100-1000), this would only take a fraction of a second to test for each account registration / password change.

[primexx]

they could also do it client-side

[n_K]

primexx, on 13 November 2012 - 00:51, said:

they could also do it client-side

It's not client side, when logging in to msn over SSL, a 302 redirect takes you to the 'weak password' page.