Slashdot Mirror
Australian Tax Office Stores Passwords In Clear Text
mask.of.sanity writes "The passwords of thousands of Australian businesses are being stored in clear readable text by the country's tax office. Storing passwords in readable text is a bad idea for a lot of reasons: they could be read by staff with ill intent, or, in the event of a data breach, could be tested against other web service accounts to further compromise users. In the case of the tax office, the clear text passwords accessed a subsection of the site. But many users would have reused them to access the main tax submission services. If attackers gained access to those areas, they would have access to the personal, financial and taxpayer information of almost every working Australian. Admins should use a strong hash like bcrypt to minimize or prevent password exposure. Users should never reuse passwords for important accounts."
The slashvertisments are getting less and less subtle these days.
Storing passwords in readable text is a bad idea for a lot of reasons
It needs to be more than a bad idea: it needs to be illegal, and people or organizations that betray their users' trust, need to pay a price for their negligence.
But we need to go further than that. When forms are submitted, browsers should not allow "hidden" fields to be transmitted directly, and instead should have a default action of encrypting them with Bcrypt or SHA-256. When building a website, many people will use defaults and follow the easiest path. The default should be transmission of encrypted passwords, not plaintext.
not a excuse to not pay your taxes so suck it up and pay
emasculating my password, and book-ending my brain. Please make them stop.
Sent from my ENIAC
That kind of brain-dead security fail should be illegal, and I mean pay "a fine and go to jail" felony-type illegal. It is clear understatement to say that there is simply no excuse for this to have happened.
If you're dumb enough to use the same password all over, you deserve to get your identity stolen with all the implicated trouble. Call it evolution.
No one looks down there.
I swear they give me mod points to shut me up.
Most of us have very busy lives and not enough time to remember long passwords especially long paswords with CAPS and numbers. It is quicker to sign up for a new gmail account than figure out that password you never used in a month. Now why don't people think of the poor abandoned email accounts tying up that username you really wanted? Now my bank and credit card pins came in the mail in plain text. Its not usually a problem. Why you ask? Because it is very illegal and you will spend a lot of time in jail. This attitude the the internet is a toy and the rules don't apply "cause yer l33t if you can break into someones computer or steal personal info" has to change. If you unlawfully access my computer or personal info you should go to jail just as if you were caught with your hand in my mailbox.
Why is it still the case that we live in terror that someone can get our secret financial information and ruin our lives? Secret information that is frequently scattered around in the public domain anyway. At this point it should be possible to lock down financials and identities so that this problem is in the past.
If nothing else, someone should see a business opportunity in offering that kind of security. Move your money to this bank/credit because we offer real financial protection for you. You will never be inconvenienced by the old poorly secured way of doing things again.
Unfortunately, as has been demonstrated recently, hashed passwords don't protect very well against attacks either if the intruder gets access to the stored passwords themselves. Faster and cheaper hardware combined with cheap storage have allowed attacks on hashed passwords that would've been infeasible only a few years ago. And hashed passwords on the back-end mean that cleartext passwords almost have to be passed over the wire where they're vulnerable to interception not just by things snooping network traffic but by malware that's inserted itself into the network stack on either end.
And most importantly, storing passwords in the clear makes it perfectly clear that they are vulnerable to any compromise that gives an intruder access to the stored passwords. Having them hashed gives a false sense of security and the opening to argue that compromises don't have to be disclosed because the passwords are hashed and thus haven't really been compromised, even though the hash isn't going to really keep the passwords from being compromised.
I much prefer a system that segregates passwords onto a dedicated authentication service that runs on a machine that's walled off and isolated from even the production machines except for the small hole needed for access to the authentication service (which should be written, at least the input and input-parsing portions, by professional paranoids). Then store passwords on it in the clear if needed so you can use challenge-response authentication methods that avoid needing to transmit the password itself between the client and your systems. That way your efforts to protect the passwords can be concentrated on that authentication server with it's relatively small exposed area, rather than on your entire system with it's large exposure to attacks.
It is not only illegal, but dangerous. About 10 years ago a disgruntled Taxation employee used unencrypted taxation information to mail letter bombs to people he felt had "done him wrong". My mother was meant to receive one of these bombs!
This information should be encrypted by default.
Or they did as of not very long ago at all - I had to recover my password on their site, and just about fell out of my chair when, instead of sending me a recovery link, they emailed me my current password.
Nowadays that password is a KeePass-generated random one.
I guess that it wasn't quite as bad as the network service provider that had 'password' as the password through their firewall.. I mean, why even have the thing, to begin with?
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
If you use Google's enterprise tools for synchronizing account credentials, your best option is to send them SHA1 hashes. Not salted SHA1 hashes, just SHA1. For a company with the computational resources Google has, that's almost the same as handing over plain text, unless the passwords are exceptionally strong.
LOL no who even codes this shit.
The information in your tax account is probably far more damaging than just your password and that is stored in plain text. If you don't trust them with your password, why the hell do you trust them with all that other information?
Tax offices usually have to deal with a wide variety of enquiries, some of which may not be done over the phone. Passwords/secret phrases can be a nightmare over the phone, especially for someone non-technical, having plain text passwords allows you to verify that a granny who says "21 primrose hill" is their password when it's stored as "21 Primrose-hill".
My bank (Barclays) doesn't use encrypted passwords, they use the "say the 8th and 6th letters of your password" system plus chip + pin to verify you. As they're a high priority target for phising, key logging and MITM, it is actually far safer to do this then force the entire password the whole time.
TLDR: password hashing is an (easy) additional layer of security but it comes with its own drawbacks, isn't the be-all and end-all to security and isn't needed if security measures are strong enough.
The OP is right that there's no point in using a high speed naked hash algorithm, but BCrypt isn't the only good alternative.
There's also SHACrypt-256 and SHACrypt-512, which have been supported in GNU LibC since October 2007.
Wikipedia has a pretty thorough discussion of the various password hash routines that are in use on Unix/Linux systems, for that matter.
- jon
Ganymede, a GPL'ed metadirectory for UNIX
You don't want to use SHA-256 by itself, because that's a high speed unsalted hash algorithm.
Ulrich Drepper created a good password crypt algorithm which incorporates SHA-256 or SHA-512, but the features that make it resistant to dictionary attack are the salt and the massive iterations over SHA to slow down the algorithm.
BCrypt uses the same techniques to slow down dictionary attacks.
- jon
Ganymede, a GPL'ed metadirectory for UNIX
That's not a password.... This is a password!
I've fallen off your lawn, and I can't get up.
The Secure Remote Password protocol has been out for more than a decade now. Sites shouldn't even be storing hashed/salted passwords by this point. They should never even have possession of the actual password on the server side.
A separate company that is managing a Publication Ordering Service for the Tax Office is storing passwords in plain text. I had to help set up access to the ATO portal at my last job and it requires installing company specific certificates per user or to be running a specific security application which, requires installing company specific certificates, the for the login screen to even show up
A game has objectives and is competitive, anything else is just play
Gotta post anon here...
I'm a programmer who maintains a website which stores plaintext passwords, though that'll be changing later today. We recently discovered that, surprise surprise, that database has been read. Yet another list of email addresses associated with plaintext passwords is out there now, and it's our fault.
We have known about the risk for years, and it's not like I lack the expertise to do anything about it. But there's a problem: one of our use cases is that sometimes we have to tell users their forgotten password. (And you can't fix the problem and also preserve that use case.) I know, it's just as easy give people an email password reset. But that's not what we had. I don't decide the use cases or tell people, "no, you may not do that anymore. I am unilaterally taking away one of the things you wanted to sometimes do, boss."
So the horse had to escape the barn, before fixing the barn door could be greenlit.
I'm conflicted about whether or not there should be a law, but I have to admit something. In prior years' discussions about the topic, if I had a law to point to, and could have said, "we have to do this to comply with the law, or else if anyone ever finds out, we'll be in legal trouble (rather than merely hated)," then our own breach would have been prevented before it ever happened.
Honestly, when you get down to it, that's really just saying I wish I could make my argument with a gun, so that I could win it. And I know that's usually a sign that you have a bad argument. "There ought to be a law" usually means the person who said it needs to be removed from lawmaking. But in this case...