EVE Search - [Issue] CCP Does NOT Need to Keep Track of Our Old Passwords

All Channels

Assembly Hall

[Issue] CCP Does NOT Need to Keep Track of Our Old Passwords

» Click here to find additional results for this topic using Google

Monitor this thread via RSS [?]

Pages: [1] 2 :: one page
Author	Thread Statistics \| Show CCP posts - 0 post(s)
Gus Gallente Dark Star Cartel	Posted - 2008.09.26 20:35:00 - [1] CSM Members- What business is it of CCP's if we've used a given password in the past and have decided we want to do so again? Why do they need to keep a list of all the passwords we've used for our accounts? Why shouldn't we be able to rotate a set of three or four passwords that we commonly use? Most importantly, is their current policy a good one? In short, I think this is a nearly useless "feature" which keeps track of personal information that is not CCP's concern in the first place. I'd like to ask the CSM to address the elimination of the message and preventative measures keeping us from reusing an old password. Keeping track of passwords formerly associated with a given account is a pretty big security risk anyway, as those passwords may be associated with other non-eve personal accounts (such as e-mail) maintained by the account holders. Thanks for your support. It's never just a game when you're winning. - George Carlin
LaVista Vista Conservative Shenanigans Party	Posted - 2008.09.26 20:43:00 - [2] I'm not sure I quite get it. Could you please refer to where you read that CCP keeps a log you have used in the past? Thanks.
Darth Gus	Posted - 2008.09.26 20:57:00 - [3] This is easy for anybody to test. Just try to change your password in account management to any password you've used previously, and you'll see the issue. Not only does CCP tell you that you can't, which is troublesome in and of itself, but that means they're keeping track of all the passwords you've used before.
Drake Draconis	Posted - 2008.09.26 23:14:00 - [4] Edited by: Drake Draconis on 26/09/2008 23:16:22 Google password hashing and password storage before you start complaining. Security 101.... this is industry standard... don't like it? Go somewhere else. They just choose a higher standard than usual... they sure as hell don't know your passwords. T.T;; /me thumbs down
TimMc The Motley Crew	Posted - 2008.09.27 02:00:00 - [5] I hate this feature. Hacking the server could give the passwords to most of my internet accounts because of how often I have cycled through passwords.
asiofjioaewf	Posted - 2008.09.27 10:06:00 - [6] Edited by: asiofjioaewf on 27/09/2008 10:12:03 fyi they don't have to keep your actual password itself. They can just run the password through some fancy algorithm to turn it into gobbledy**. Then when you put your password in it runs it through the same gobbledy generator and compares the garbled passwords without even looking at the original password. If that's the case then there's no privacy problems so long as the gobbledy** can't be converted back into the original password. It seems goo-k is censored... I didn't even know it was offensive.
Tmarte Caldari Explora Empire	Posted - 2008.09.27 13:34:00 - [7] Originally by: LaVista Vista I'm not sure I quite get it. Could you please refer to where you read that CCP keeps a log you have used in the past? Thanks. Logs? Well we don't see any anomalies in the logs. Sorry we are unable to reimburse yo...oh wait. Wrong thread.
SysFin	Posted - 2008.09.27 19:31:00 - [8] I know they don't keep the password around, only the hash, but I hate this security "feature" everywhere I find it.
NanDe YaNen The Funkalistic	Posted - 2008.09.27 19:38:00 - [9] Originally by: Drake Draconis Edited by: Drake Draconis on 26/09/2008 23:16:22 Google password hashing and password storage before you start complaining. Security 101.... this is industry standard... don't like it? Go somewhere else. They just choose a higher standard than usual... they sure as hell don't know your passwords. T.T;; /me thumbs down Google John the Ripper. CCP needs only one hash in order for login authentication. Everything else amounts to storing a set of hashes for passwords users likely cycle across multiple accounts at multiple sites. One hash lets a cracker have a decent chance at getting access to any account I have. He still has to find the account and has to get lucky. Holding a list of those hashes gives the cracker an entire database of passwords I like and more chances to get lucky on any accounts of mine he can find. There is no reason to store old hashes. It unnecessarily streamlines the process of gaining access to large numbers of accounts. A good practice in security is always to limit the availability of sensitive data by having no redundant copies. CCP storing hashes would amount to redundant copies of credentials to other accounts where the user has used one of their common passwords. I expect a CCP reply on this. It's obvious from the behavior described that CCP is keeping old hashes in the database. It's a non-standard process that isn't necessary and increases user exposure. It needs to stop.
DEATHsyphon Gallente IDLE GUNS IDLE EMPIRE	Posted - 2008.09.27 21:59:00 - [10] My guess is they keep track of them just in case of an account being stolen. -------------------- I'm not not going to pod you!
Gus Gallente Dark Star Cartel Molotov Coalition	Posted - 2008.09.27 23:36:00 - [11] Originally by: DEATHsyphon My guess is they keep track of them just in case of an account being stolen. If this is true, then there's still no reason to prevent users from reusing the old passwords. It's never just a game when you're winning. - George Carlin
Grim Maetror	Posted - 2008.09.28 04:45:00 - [12] I agree. There are limits to imposing security. The least CCP can do is allow us, the players, who pay their payrolls, to rotate passwords of our own choosing. Thumbs Up
Syrina Daemonis	Posted - 2008.09.28 05:19:00 - [13] Ok honestly till this was brought up I was unaware of the fact and find it quite disconcerting. Just mere fact of the possibility existing that my passwords may be logged whether via goobly yada or actual log is discomforting to say the least. All I really have to say about that.
Syrina Daemonis	Posted - 2008.09.28 05:20:00 - [14] Thanx for informing me of this as I truly have been blindsided by it.
Leuscreuntos	Posted - 2008.09.28 05:43:00 - [15] even wrose is the fact that when you forget your password, they dont send you it, they give you a password reset process instead..... what point is there in keeping track of all these passwords? ive gone thru several, for the sake of security, some lead to one thing, others lead to others, but i need to come up with NEW ones just for eve? because they are keeping track and storing them? no, this is a security list, and its not something they should be doing, unless they were to turn around and say "hey. heres your old password" then its completly useless! take this feature away, its anoying and unnescary
Lord Fitz Project Amargosa	Posted - 2008.09.28 05:49:00 - [16] Good security would actually make you change it every 30 days and not allow people to use simple passwords without non-alphanumeric characters etc. Password hashing on the other hand means they are NOT storing your password, they are simply storing a non-reversible hash of your password, which you can get from your password, but you can not get your actual password from the hash. This is just an extra layer of security which shouldn't be needed anyway, but the more the better. It is good policy to NEVER use the same password for two separate sites unless the security of none of those passwords is important to you. Don't use your eve password for other sites, don't use important passwords like banking passwords for eve. The fact that they store your past password should be of little concern considering they are storing your current password (albeit hashed) which is all anyone needs, your past passwords are of little use unless you personally are employing much much worse security than CCP are attempting to.
Lord Fitz Project Amargosa	Posted - 2008.09.28 06:01:00 - [17] Originally by: Leuscreuntos even wrose is the fact that when you forget your password, they dont send you it, they give you a password reset process instead..... This is because they DON'T STORE YOUR PASSWORD. Thus are unable to send it to you !!! This is GOOD security. What good is your old password to you if you can't remember it anyway ! Quote: but i need to come up with NEW ones just for eve? because they are keeping track and storing them? YES !!! You do ! That is good security! A hash is one way encryption, the process is the same and non-reversible, when you change your password they hash it, and store the hash. When you enter your password, they hash it an then compare the hash you entered to the hash that is stored. To be overly simplistic, say your password is 'AG' a hash may in the simplest form add those two chars together and store your has has 1+7 = 8. When you go to type your password in, it hashes it, and gets 8, which matches the hash stored, and lets you in. If someone gets hold of the hash, all they have is the number 8. If they know the hash algorithm in addition, they can 'guess' that your password is AG, BF, CE or DD, but they still don't have your password. With a more complex hash, and a good password this becomes incredibly difficult to even come up with a list of potential passwords. The longer and more difficult your password, the harder it would be to even guess a list for if someone was to get a hold of the database and the hash function it used.
Mara Devortex	Posted - 2008.09.28 11:30:00 - [18] Rule Number 1 .Never listen to someone who wants to take away a security feature..ever..massive troll thread...bad idea.
Herschel Yamamoto Bloodmoney Incorporated	Posted - 2008.09.28 14:58:00 - [19] Originally by: Lord Fitz Good security would actually make you change it every 30 days Lies. If I had to change it every 30 days, I'd be writing it down at my computer desk, either in .txt or in hardcopy. I trust that less than I trust my long-term security provisions at present. Also, I'm not supporting this thread because I'm worried about CCP storing old password hashes(because until quantum computing becomes functional, I'm not), I'm supporting it because banning you from using previous passwords is stupid - it only makes sense in the context of forced password changes. ------------------ Fix the forums!
Gus Gallente Dark Star Cartel Molotov Coalition	Posted - 2008.09.28 18:46:00 - [20] Originally by: Mara Devortex Rule Number 1 .Never listen to someone who wants to take away a security feature..ever..massive troll thread...bad idea. Believe what you will, this is a legitimate concern, not an attempt at trolling. Negative response has been minimal, and nobody's slinging any personal insults (thankfully). This is not a security feature, anyway. It's a mere inconvenience. I've learned that changing passwords 6 or more times will likely free up the original password, as the server only retains a certain number of old hashes. So if circumventing this "feature" is so easy, why have it in place in the first place? It's never just a game when you're winning. - George Carlin
Athanasios Anastasiou The Illuminati. Pandemic Legion	Posted - 2008.09.28 23:45:00 - [21] Edited by: Athanasios Anastasiou on 28/09/2008 23:49:35 The practice of keeping old password hashes is a pretty standardized practice across many industries. So please, explain why this is a security risk?
NanDe YaNen The Funkalistic	Posted - 2008.09.29 00:47:00 - [22] Correcting some nasty misinformation going on. People with limited experience in security please QFT. To anyone who has ever ripped thousands of passwords from a shadow file, the idea of having multiple hashes for every user is a f&!^%(ng gold mine of access credentials. Hashes are not secure. Hashes are not secure. Hashes are not secure. This is not a security feature in any way and merely creates a database of sensitive information that is serving no purpose. A smart hacker who gets that database can go through and check for duplicate usernames or link a user to another account somewhere and try all of their passwords until one works. Keeping multiple hashes makes a bad security break into a catastrophic one.
Hugh Ruka Exploratio et Industria Morispatia	Posted - 2008.09.29 06:56:00 - [23] Originally by: NanDe YaNen Correcting some nasty misinformation going on. People with limited experience in security please QFT. To anyone who has ever ripped thousands of passwords from a shadow file, the idea of having multiple hashes for every user is a f&!^%(ng gold mine of access credentials. Hashes are not secure. Hashes are not secure. Hashes are not secure. This is not a security feature in any way and merely creates a database of sensitive information that is serving no purpose. A smart hacker who gets that database can go through and check for duplicate usernames or link a user to another account somewhere and try all of their passwords until one works. Keeping multiple hashes makes a bad security break into a catastrophic one. you'd need to know what hash they used to start with. or your cracking time explodes exponentialy to every hash you try to crack. going through shadow files is easy, because people are usualy stupid and use only the bog standard unix crypt call that fails any security test (8-bit hash iirc). good luck going through MD5 hashes or even better encryption methods. --- SIG --- CSM: your support is needed !
Falkrich Swifthand Caldari eNinjas Incorporated	Posted - 2008.09.29 13:02:00 - [24] It is standard security practice to store X of your old passwords to stop you using the same one again, as presumably you changed it for a reason (e.g. someone else got it). The longer you use the same password for, and the more places you use it, the more likely it is to be cracked. It is also standard practice to store one-way hashes of the password(s) instead of the password itself, so that a hacker who gets into your database can't just read out everyone's passwords. The idea is that the hashes are useless for someone trying to hack in, as the server is expecting the unhashed password and they are (in theory) irreversible. As the hashes to certain common passwords are already known, it is standard practice to salt the password before hashing it so that the password hashes in your database are different to the password hashes for the same password in someone else's database. This means that it is not a security risk to store the hashes either. I would be shocked if EVE doesn't do this. Off on a tangent: Note that hashing the password in the client and sending the hash over the wire is exactly as insecure as sending the raw password over the wire from a security against tapping pov. Either way they have exactly what they'd need to send to log in as you. To verify that the client is really there and it isn't a snooper just replaying the packets from someone's earlier login, you need to use a double-hash mechanism: Person signs up with password "A". Server salts it ("saltA") and hashes that ("hashA"), and stores that. Client wants to log in, server sends them a random salt: "pepper". Client salts and hashes the password like the server did originally ("hashA"), then salts THAT with the time-unique salt from the server ("pepperhashA") and hashes THAT again: "hashhashA". Client sends that to the server. Server salts it's stored hash of the password with the time-unique salt and hashes that the same as the client has to. It gets "hashhashA" as well, and allows the login because it matches what the client sent. Note that this way means that the server doesn't store your password, that you don't send your password or the server's hash of your password over the internet, and most importantly the code sent by the client to login is different every time so that capturing the packets wouldn't let you log in just by replaying them. This still doesn't protect against a keylogger or other spyware on the client pc, or someone hacking the server to change your password or install a backdoor into the login process. It does make the security of the wires between the server and client irrelevant though, making it safe for internet use. I'd hope that eve also uses something like this, but it's not necessary as keyloggers are still by far the biggest weakpoint in any password system. Some people just can't keep their pc secure, and others will log into the eve forums (uses the same user/pass as the game) from an insecure public pc. Just assume that CCP know what they're doing, EVE is pretty big now and they haven't had a major security problem, so they must be doing something right. nullnull My sig is not my sig.
NanDe YaNen The Funkalistic	Posted - 2008.09.29 20:51:00 - [25] Originally by: Hugh Ruka Originally by: NanDe YaNen Correcting some nasty misinformation going on. People with limited experience in security please QFT. To anyone who has ever ripped thousands of passwords from a shadow file, the idea of having multiple hashes for every user is a f&!^%(ng gold mine of access credentials. Hashes are not secure. Hashes are not secure. Hashes are not secure. This is not a security feature in any way and merely creates a database of sensitive information that is serving no purpose. A smart hacker who gets that database can go through and check for duplicate usernames or link a user to another account somewhere and try all of their passwords until one works. Keeping multiple hashes makes a bad security break into a catastrophic one. you'd need to know what hash they used to start with. or your cracking time explodes exponentialy to every hash you try to crack. going through shadow files is easy, because people are usualy stupid and use only the bog standard unix crypt call that fails any security test (8-bit hash iirc). good luck going through MD5 hashes or even better encryption methods. Need to know the hash? I can tell most of them by inspection and can find 100% of them with a little bit of searching on random forums. The availability of decryption tools is endless. Unless CCP uses a proprietary hash that's not a derivative of a major encryption scheme, they face the same exposure as every other system. This "feature" is fundamentally wrong. You need the current password to change back to the old password, so preventing a user from going back to an old password doesn't do anything except prevent a hacker from being able to randomly regain access as the user randomly decides to switch back to an old password that they already cracked...yeah right. The real reason it's fundamentally wrong is very simple. The procedure creates an aggregated database of access credentials. It's bigger than eve. Having a list of likely passwords for a user is a huge asset if one wants to access other accounts of that user. Please CCP, tell me you aren't using lanman. Can't tell you how many systems have handed me over a list of lanman hashes generated for windows file-sharing with an at-least-slightly-difficult-and-somewhat-reasonable hashing system in a shadow right next to it. Anyway, guessing the hash system isn't hard. Salting can be defeated. A program can probably do it for you if you're lazy. Insert massive word list. Add mangling rules. Add semantic acronym generator (still better than random) with more mangling rules. Pipe through someone's stolen cluster. Viola. You can now shaft 1857 people with weak to moderate passwords. How to avoid an attack like this? Run your password through an MD5 generator and copy some characters out of the result. You won't remember them, so write them down, thus undermining the utility of passwords. For however "standard" this practice is, I've never pulled any kind of shadow with duplicate user entries. In the end, it doesn't matter if CCP has the most l33test cryptographic system in the world. Keeping more access credentials than necessary increases exposure of sensitive information while gaining no utility. That's a fundamentally bad security practice.
Mara Devortex	Posted - 2008.09.29 20:54:00 - [26] well another way at looking at this is..if you were a hacker looking for passwords..which would you rather sort through..a huge database of which a very large portion is outdated or a smaller database with mostly current passwords..
NanDe YaNen The Funkalistic	Posted - 2008.09.29 20:54:00 - [27] Originally by: Falkrich Swifthand Also a smart post Yes, yes, there are many mechanisms in place to protect the information. It's not alarmist thought to ask for a system that doesn't carry more sensitive information than it's actually using.
NanDe YaNen The Funkalistic	Posted - 2008.09.29 21:01:00 - [28] Originally by: Mara Devortex well another way at looking at this is..if you were a hacker looking for passwords..which would you rather sort through..a huge database of which a very large portion is outdated or a smaller database with mostly current passwords.. Cracking through hash generation is all about scale. The more passwords in the database, the more likely you are to get matches, which you can potentially link through those users to other accounts to hack their other accounts. Most people re-use access credentials across multiple accounts and only vary which one they're using on a particular system. When it comes time to change passwords, they likely pick an old one that they already have memorized. Keeping multiple hashes is completely unnecessary and only increases the severity of any potential security breach. Not to mention a CCP employee could easily rip the information using an obscured program running on Eve cluster nodes themselves for a going away present. Sell info. Quit CCP. Does CCP think they're above this?
Athanasios Anastasiou The Illuminati. Pandemic Legion	Posted - 2008.09.30 01:30:00 - [29] Edited by: Athanasios Anastasiou on 30/09/2008 01:33:46 Originally by: NanDe YaNen Correcting some nasty misinformation going on. People with limited experience in security please QFT. To anyone who has ever ripped thousands of passwords from a shadow file, the idea of having multiple hashes for every user is a f&!^%(ng gold mine of access credentials. Hashes are not secure. Hashes are not secure. Hashes are not secure. This is not a security feature in any way and merely creates a database of sensitive information that is serving no purpose. A smart hacker who gets that database can go through and check for duplicate usernames or link a user to another account somewhere and try all of their passwords until one works. Keeping multiple hashes makes a bad security break into a catastrophic one. Hashes are secure. Hashes are secure. Hashes are secure. See what I did there? How about actually justifying this instead of making a dozen posts all saying the same thing? If hashes weren't reasonably secure, I'd be worried about other (and more important) things then my eve account.
Another Forum'Alt	Posted - 2008.09.30 12:31:00 - [30] Edited by: Another Forum''Alt on 30/09/2008 12:31:39

Pages: [1] 2 :: one page
First page \| Previous page \| Next page \| Last page

COPYRIGHT NOTICE
EVE Online, the EVE logo, EVE and all associated logos and designs are the intellectual property of CCP hf. All artwork, screenshots, characters, vehicles, storylines, world facts or other recognizable features of the intellectual property relating to these trademarks are likewise the intellectual property of CCP hf. EVE Online and the EVE logo are the registered trademarks of CCP hf. All rights are reserved worldwide. All other trademarks are the property of their respective owners. CCP hf. has granted permission to EVE-Search.com to use EVE Online and all associated logos and designs for promotional and information purposes on its website but does not endorse, and is not in any way affiliated with, EVE-Search.com. CCP is in no way responsible for the content on or functioning of this website, nor can it be liable for any damage arising from the use of this website.