Why A Great Amount Of Fish Stores Passwords in Plain Text

MODIFY: because of the Hacker Information community for voicing their critique and making some points that are great internet protection and password management. To participate the debate on Hacker News click the link.

A week ago a lot of Fish got hacked and a huge drama ensued after Markus Frind, its Founder and CEO, penned a long rambling article accusing a 23 yo Argentinean hacker, Chris Russo, of extortion and harassing him and their wife.

Markus post caused exactly what appears to be now the worst PR nightmare any business could imagine. Rather than getting compassion and support from their visitors, he had been greatly ridiculed making enjoyable of by a huge selection of commenters and internet magazines over the Web.

Why? apparently isn’t uncommon for hackers to reveal safety weaknesses as an interest or as a small business, but just what just isn’t normal or remotely appropriate is actually for just about any website that is self-respecting especially the size of lots of Fish to keep guyspy username an incredible number of passwords from the users in plain text format, that is, perhaps maybe maybe perhaps not encrypted.

Additionally a monumental not enough consideration for their user’s privacy however it is an unforgivable protection problem that no one who has had the standard internet protection training may have ever permitted to happen. You have to assume that each site will fundamentally get hacked and so must be sure that when the info is exposed the damage that is potential may be triggered is minimized whenever possible.

The principal interest should be users privacy sufficient reason for which comes their passwords. Regrettably, significant amounts of individuals make use of the exact same password for lots of their online reports. It’s not safe however it is practical with no matter simply how much we have been told not to ever achieve this, individuals will keep carrying it out.

Once you understand this, the least thing a designer can perform would be to at least encrypt all of the individual passwords therefore in case of a hacker gaining use of the database, the hacker will expose unusable information.

Therefore is Markus that big of the moron? I don’t think therefore, he might involve some psychological dilemmas as can be viewed from reading their post but he could be maybe maybe not really an idiot that is total. An individual that solitary handedly managed to produce the biggest online empire that is dating the world wide web can’t be that stupid.

I believe Markus is really a genius, a nerd, a geek, a hacker himself, perhaps not the most useful programmer but positively one of several hardly any individuals into the reputation for the world-wide-web to pull such feat simply by himself. As you can easily see from reading their weblog he could be maybe not timid to inform the entire world exactly how good he think he could be. right Back when you look at the time he went in terms of publishing a giant google advertisement cheque designed to his title from advertising income gained through their web site.

Nope, Markus is not any trick therefore if he stores passwords in simple text is actually for an explanation, and an one that is good. Most likely the explanation is merely among the multiple reasons that has made POF because successful as it’s today.

The reason that is main to enhance individual retention. This works two methods. From time to time, POF provides you with a contact along with your password and that means you don’t forget it.

This accomplishes a couple of things at a time. For starters, it acts such as a news page, it reminds you that POF exists, that you ought to get here. Although many make use of the password that is same each of their reports, there are many people that usage a few passwords while having trouble recalling them. Well, so that you will not log back in a website if you forget your password it is way more likely. Yes you can easily get ahead a chance through the recovering procedure, but that takes time and we also are sluggish. It really is way smarter to help keep reminding you of the password, which is precisely what Markus does.

In accordance with Markus himself many people signup for just two or even more online sites that are dating. What type are you considering more prone to go right back? well, the one that makes it super easy to remember your password and yes the one that is cheapest. POF is free!

Generally there you are going, what exactly is probably, that some guy which has had build the biggest free site that is dating globe is a moron? or that their aspiration overrules any concern for their user’s privacy? Occam informs us is much more probably be the second presumption.

Not only this, Markus has admitted that maintaining pictures aspect ratio all wonky is excellent to improve advertising income traffic as folks are forced to go through the photos to see them correctly. Or perhaps the reality it is extremely difficult to cancel your POF account so also years after finding your real love you retain getting those hot regular matches every Monday.

Maybe maybe perhaps perhaps Not siree, our very polemical as well as times seemingly derranged interweb lord associated with realm that is e-date no trick. Funny thing is the fact that i’m happy to bet this self imposed PR chaos may just assist their web site to be much more popular. Numerous would offer their heart to your devils that are mockery change of Markus’s 6 million love looking for uniques per month, without doubt.

Get Our Top Ten Vdeo Sales Marketing Recommendations

Enter your e-mail below to get the precise methods we have utilized to achieve over 20,000,000 people who have our videos without investing a solitary buck in adverts

Many Thanks! We shall give you directions soon.

24 ideas on ” Why a lot of Fish Stores Passwords in Plain Text ”

Yah, and you will enter and then leave an automobile much (. ) faster, you seatbelt if you don’t fasten. Imagine even getting rid for this children-seat that is stupid.

“Nope, Markus isn’t any trick so if he stores passwords in ordinary text is for an explanation, and good one certainly.”

Then he clearly doesn’t give a shit about security if he’s no fool.

I’d stick with fool, really.

Having need associated with the plaintext password merely means you’ll want to keep it encrypted rather of hashed. Simple text continues to be a no-no.

I’m having difficulty that is serious which can be more stupid, keeping passwords in simple text or your arguments supporting that training.

This can be nonsense. Additionally, you don’t ‘encrypt’ passwords — encryption is reversible. You always utilize a hashing algorithm (ideally bcrypt). Finally, proof-read.

Trivial fix: send out of the emails that are periodic describe, but just consist of a web link saying “Forgot your password? Follow this website website link!” This effortlessly makes every e-mail a Password data recovery e-mail. Exact exact Same impact, no passwords that are plaintext.

Great article, though simple text passwords no matter of this “usability” it offers is really a definite no.

In the event that you deliver your users their passwords in simple text, any hacker with usage of their e-mail (cookies) and on occasion even gets your hands on their iphone/andorod for 2 moments. Could have comfortable access towards the simple text password, for the date that is later.

If POF wants this usability: 1# Make a temporary token to login using click of a web link in their e-mail 2# part password that is encode 50% ordinary text, 50% hashed.

The users are to not blame in this, and require better password safety. Behind the back, any forum, any website owner can steel your password, without you once you understand.

P.S. Markus Frind is definitely an idiot for ridiculas aquisations at Chris Russo.

Here’s a much better treatment for emailing individuals their passwords, e-mail them an excellent big button that says “login now!”, the hyperlink which is why contains an authorisation token with a brief rack life and on occasion even merely an use that is single. It has its very own privacy issues, but i believe it is a trade that is good.