Heatware probably stores your password in plaintext

L

LightningCrash

2[H]4U
Joined
Dec 29, 2000
Messages
2,470
I generated a long password for HW, when I got back around to it today it did not work, so I did password recovery.

The recovery email sent to me contained a truncated version of the long password I had used.

Just make sure you're not using a password here that is used anywhere else.
 
In case anyone is curious, it cuts it down to 15 characters. It fails to tell you this anywhere, and your login will fail until you enter just the first 15 characters.
 
therefore it is stored in plaintext or a reversible encryption.
Neither are acceptable.
 
I've passed this thread along to them. Hopefully this is something they will fix and take seriously.
 
Zangmonkey said:
therefore it is stored in plaintext or a reversible encryption.
Neither are acceptable.
Click to expand...

It simply means the code that encrypts and stores your password only accepts the first 15 characters it receives and the code that compares your password to the stored one apparently does not truncate your input. So the comparison fails.

Implementing a method to recover passwords means reversible encryption has to be used.
 
After all this bs I decided to make a txt file and fill it with all new passwords, each unique to each site. I just hammered in letters and numbers for each. Now I just need to keep this list on a couple USB keys and I am good to go.
 
ryan_975 said:
It simply means the code that encrypts and stores your password only accepts the first 15 characters it receives and the code that compares your password to the stored one apparently does not truncate your input. So the comparison fails.

Implementing a method to recover passwords means reversible encryption has to be used.
Click to expand...

Still not very secure.

Educate:
http://codahale.com/how-to-safely-store-a-password/
 
Crucible1001 said:
After all this bs I decided to make a txt file and fill it with all new passwords, each unique to each site. I just hammered in letters and numbers for each. Now I just need to keep this list on a couple USB keys and I am good to go.
Click to expand...

I'd recommend using KeePass or FF/Chrome's built-in password manager (the latter two you can sync to FF/Google's servers, respectively). They all allow you to encrypt the password DB with a master password, so if someone else gets hold of your USB key, you're not hosed.

You can also stick the file in an 7z or RAR archive and use 7z or RAR encryption.
 
You must log in or register to reply here.
Back
Top