topic Re: Plusnet Password Security Vulnerability in Plusnet Feedback

Plusnet Password Security Vulnerability

sdhuk — Sun, 14 Aug 2022 14:40:50 GMT

I was just asked by customer services to give two digits of my password, which means that it must be stored as (or retrievable as) plain text.

There is no excuse these days for not salting / hashing passwords.

The falls well short of the Information Comissioners Office Guidance on storing passwords now that GPDR is in force:

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/passwords-in-online-services/

Re: Plusnet Password Security Vulnerability

Townman — Mon, 15 Aug 2022 07:51:27 GMT

Must it? You sure about that?

It is not impossible for specific two letter combinations to be stored as a hash in isolation from a hash of the whole password.

Re: Plusnet Password Security Vulnerability

sdhuk — Mon, 15 Aug 2022 08:33:48 GMT

That's true, I hadn't considered that possibility. Is that what Plusnet claim to do?

It seems like an odd way of doing things though when there are lots of other security questions that could be asked.

Re: Plusnet Password Security Vulnerability

Townman — Mon, 15 Aug 2022 22:39:15 GMT

I do not know what Plusnet does (or does not do) - this issue has been raised before and there have been assurances that full password decryption does not happen.