{"id":943,"date":"2009-11-27T11:10:24","date_gmt":"2009-11-27T16:10:24","guid":{"rendered":"https:\/\/www.highedwebtech.com\/?p=943"},"modified":"2016-02-27T11:03:56","modified_gmt":"2016-02-27T16:03:56","slug":"never-store-your-passwords-in-clear-text","status":"publish","type":"post","link":"https:\/\/www.highedwebtech.com\/2009\/11\/27\/never-store-your-passwords-in-clear-text\/","title":{"rendered":"Never Store Your Passwords in Clear Text"},"content":{"rendered":"

\"Thick-Type-Brass-Padlock\"In 2008, I blogged about how to work with passwords<\/a> with any web app you may build. It’s been one of the more popular posts on this site, and the lessons learned in that have never been more relevant during the course of the last few days.<\/p>\n

Let’s flash back and get a bit of a primer on passwords and password storage:<\/p>\n

“…when storing passwords for your app, you have a many options. You could skip all security and store your users\u2019 passwords in plain text in MySQL. Bad idea.”<\/p><\/blockquote>\n

This site is hosted at MediaTemple, and for the last few months since I migrated from Dreamhost to MT, I’ve had no problems or issues. Then, last Wednesday night they sent me an email saying I should change my account manager password as my account had seen some strange activity. Never an email you want to get. It said:<\/p>\n

Dear Valued Customer,<\/p>\n

This is an automated notice informing you that our system has reset your Server Administrator FTP\/SSH password due to suspicious activity observed on your (gs) Grid-Service. Our systems have taken measures to protect your service from any possible future exploits.<\/p><\/blockquote>\n

Even though I was on my way to bed at the time, I logged back on and set off to figure it out.<\/p>\n

My fist step was to FTP into my machine and check all the WordPress blogs I run from my (gs) service. It looked ok, and I eventually did find an injection in a static site (not WordPress.) Kind of odd, but not out of the ordinary.<\/p>\n

Here’s where things get interesting.<\/p>\n

I checked Twitter’s search and I quickly found I wasn’t the only one getting security notices from MediaTemple. Many people were and were understandably upset.<\/p>\n

As the day wore on yesterday, news came out that MediaTemple was storing user passwords in plain, clear text<\/strong> in their databases. Seriously. Their database was compromised, which in turn compromised many, many customer accounts, including mine. MediaTemple had this to say:<\/p>\n

\u201cClear Text\u201d is a method of storing passwords in a database so that they are human readable. This preference was made to provide customers a convenient way of managing access to their services, e.g. connecting a PHP app to MySQL. The \u201cclear text\u201d method can be less-secure than methods involving \u201cencryption\u201d, where passwords are not human-readable. This is less convenient for customers, but adds a layer of security. Properly secured databases can store passwords using either method, with the information kept private. However, if a database gets compromised, the encryption method is the only way to keep the information secure. (mt) Media Temple has now changed to the encryption method for customers, which now breaks some AccountCenter functionality; however, it is more secure and ultimately what our customers now want.<\/p><\/blockquote>\n

The interesting phrase there is “what our customers now want.” Of course they want this after they’ve all been hacked. Securely storing passwords should have been happening from day number one. Always. No exceptions.<\/p>\n

So, MT is doing damage control<\/a> and to their credit have been on Twitter since this all started, but the damage is done and the customer relationships have been strained.<\/p>\n

There are lessons here to be learned, not just by web developers but by anyone that uses a website that stores a username and password, which is pretty much all of them.<\/p>\n

1. Don’t store passwords in clear text. Ever. There are a myriad of ways to encrypt and store passwords. Go and read this blog post<\/a> for specific methods.<\/p>\n

2. When a password needs reset, use email and a unique token to reset the password. Email the user and make them click on a link to verify its them.<\/p>\n

3. If you are a user, and you are using a site that will show you your password in a “my account” area or in their administrative control panel means they are not storing your password securely. If you have credit card information stored there, good luck.<\/p>\n

4. Use strong passwords. password<\/code> is not a strong password. This is a strong password:<\/p>\n

B;8(,4$n#<\/code><\/p>\n

That was generated by this online strong password generator<\/a>. I use it when creating any type of accounts, especially for my campus users. This could be antyhing ranging from MySQL to WordPress user accounts.<\/p>\n

Want to get even crazier? Use an ultra secure password. Check out this one I randomly generated:<\/p>\n

|[<;0Rw|t>Ir[Qh|?E|M]K#JPjz?`wIY_H1K=?fs}Cb@(5$PeP4h\"F)%4P9I?3i<\/code><\/p>\n

Passwords like that I prefer for servers and other very sensitive information. Want to generate one like that? Use this site<\/a>. I now have a 63 character login for my MediaTemple account, just to be safe.<\/p>\n

5. If you are a MediaTemple (gs) customer, and you haven’t yet checked out your sites, I’d highly recommend you do so now.<\/p>\n

Additional Reading about the MediaTemple events:<\/p>\n