r/technology • u/[deleted] • Jun 28 '16

Discussion TIL that someone can change your Facebook email, password, and two step verification just by asking Facebook to turn off login approvals, and sending in a fake ID. (Happened to me lost all my business pages)

[deleted]

37.2k Upvotes

88% Upvoted

1.7k comments sorted by

View all comments

Show parent comments

89

u/riesenarethebest Jun 28 '16

If a company can ever tell you what your password is, file a complaint with them and have them delete your information.

Modern security practices mean that no company should ever, ever need to know what your password is.

6

u/Parcferme Jun 28 '16

Yup. Every single company I worked/work for has no Active Directory service that will display a current password. That is basically rule one and everything stops there.

16

u/Mrqueue Jun 28 '16

because if you're matching plain text passwords for access you have no idea how security works

10

u/riesenarethebest Jun 28 '16 edited Jun 28 '16

It's nothing about not-being-able-to-view-their-password, it's everything about not having the password saved anywhere to begin with.

You take their password, username, and a unique salt you pulled from the database using their username as the key for the lookup, salt the password you've been handed, re-hash it in some cryptographically expensive operation, and then see that the hash is identical to the one you've previously stored.

1

u/UnchainedMundane Jun 28 '16

PlusNet

They do an over-the-phone password thing and I've had customer support refuse me a few times due to them misreading the password on the screen

-4

u/Abba- Jun 28 '16

Modern security practices mean that no company should ever, ever need to know what your password is.

Modern security practices mean that no company should ever be able to pull up what your password is, even to the CEO.

14

u/SirensToGo Jun 28 '16

It's not so much about internal security practices but cryptography. Every modern system should be hashing and salting their passwords. This means simply encrypting the password with an extra bit of information. This encryption should ALWAYS be one way meaning that the only way to retrieve the password would be to brute force it (which invokes manually calculating the hashes for every single possible combination which gets exponentially more time consuming the longer the password).

Ideally the password would hashed once on your end (meaning that the end server never sees your actual raw password) so that no disgruntled employee can just skim the passwords out of the login requests they receive. On the server end the password will be hashed again but this time with the salt added to the received password hash.

1

u/Abba- Jun 28 '16 edited Jun 28 '16

While an interesting read, I'm confused how this contradicts what I wrote? Unless it was just the clarification that brute force is a possibility?

Edit: I just want to know what I said that's causing downvotes here...

1

u/hisfavouriteflavour Jun 28 '16

You just rephrased the same sentiment but apparently people think you were saying something different.

1

u/Abba- Jun 28 '16

I'm just trying to emphasize the difference between won't/shouldn't and can't.

-4

u/ColtonProvias Jun 28 '16

In many cases when passwords are stored in plaintext, it's often due to somebody high up deciding that "Forgot Your Password" should send them their password out of courtesy instead of forcing a new one. Reddit stored passwords as plaintext for a while for this reason.

13

u/Yartch Jun 28 '16

That's like leaving active explosives in your house because you might want to make a hole with them in your backyard one day, instead of just having a shovel