No Encrypted Login On Hak5.org?

[kahhak]

Does anyone else see the irony that hak5.org still doesn't use SSL for its forum login?

-poll added-

Edited March 3, 2012 by kahhak

[int0x80]

I was bummed when I first signed up. Once my creds come out of my SSH tunnel, they are just hanging out in the clear :(

[Jason Cooper]

What is especially depressing is that a few years ago the site was hacked and users passwords were released. Looking at the username password combinations that were released they were obviously grabbed by a packet sniffer and not obtained from cracking the hashes from the database. At that point you would have thought that upgrading to SSL would have been a given. Then at least you are making them work to get the passwords :)

[Mr-Protocol]

Complex passwords aren't really that hard with tools like oclhashcat. GPU power for the win.

[Jason Cooper]

Complex passwords aren't really that hard with tools like oclhashcat. GPU power for the win.

Yes there are some pretty cool tools that can crack password hashes quickly for certain levels of complexity, but that is no reason to continue passing passwords around in plain text.

[Infiltrator]

It's a shame that the Hak5 website doesn't have SSL, when other popular websites such Tweeter and Facebook already have it by default.

[kahhak]

Full site SSL would help to stop sidejacking, and that would be great. Full site SSL generally increases processor usage and usually screws up 3rd party ads. I can understand Darren's reluctance to implement that (though I encourage him to reconsider).

However, I can't think of a good excuse not to have SSL at least for the login script. I've emailed Darren and Shannon about this a couple times, but didn't get a reply.

int - I think it's time for you to continually tug on Darren's ear until he gets SSL login setup.

This makes me concerned in general. Are passwords encrypted in the backend? Salted?

[int0x80]

int - I think it's time for you to continually tug on Darren's ear until he gets SSL login setup.

This makes me concerned in general. Are passwords encrypted in the backend? Salted?

I'll be out in SF soon so will talk to him then. I'm not sure how the IPBoard software stores passwords; but yes, one would hope it's at least random salts + something from the SHA family; if not also multiple iterations, which really cost nothing in CPU time.

[The Sorrow]

Most website software does hash passwords before storing them in the SQL database. Mine does anyway... Could only hope IP Board is better developed than phpBB3.

[digip]

Its a hacker forum. By default, you should be using a trash password, that you don't use anywhere else. SSL is an obstacle but one that could be easily removed if an attacker gained root. In order to sniff passwords in the clear from the web server, they would already have to of gained access. Any compromise of the site and forum software, means salts do you no good since you could just pull the salt value from the forum config files, dump the hashes from the database, and crack them offline, like mentioned above with GPU cracking/oclhashcat, etc. Its preventing attacks in the first place that is the hard part. No amount of encryption or salted passwords can prevent decryption if the server itself is compromised.

[Jason Cooper]

No amount of encryption or salted passwords can prevent decryption if the server itself is compromised.

True, but SSL (provided you always use SSL for connecting to the site) can help reduce the risk of a number of other forms of attack where the attacker is on your local network and doesn't control the server.

[digip]

True, but SSL (provided you always use SSL for connecting to the site) can help reduce the risk of a number of other forms of attack where the attacker is on your local network and doesn't control the server.

If the attacker is on YOUR local network, you got bigger fish to fry than them sniffing your forum password. I'm all for reducing risk, and yes, SSL would be nice, but if the attack was from your home network, they could use SSL strip, DNS poison/clone sites or worse, compromise your machine itself and just install a keylogger.

If you connect to Hak5 from outside your home, use a VPN or SSH Tunnel.

[hexophrenic]

Its a hacker forum. By default, you should be using a trash password, that you don't use anywhere else

^^^^^^This^^^^^^. Seriously, what is the worst thing that can happen if you beloved Hak5 forum password is compromised? Let's all take a deep breath and remember to consider the value of the asset we are protecting rather than bearing pitch forks. OMFG!!1!1!11! Someone posing as hexophrenic posted some sh!t on the Hak5 forum about digip. Really?

All that being said, SSL for login pages and posts really should not be that difficult and should be the default whenever possible.

[kahhak]

Sorry about starting this long thread - it was more to point out the irony in preaching security, but not practicing it. Why not make the site as secure as it resaonably can be?

I use the same password here as I do on my luggage. It's unguessable, someone would have to try all 1000 combinations of the 3 digits to get in.

[Jason Cooper]

If the attacker is on YOUR local network, you got bigger fish to fry than them sniffing your forum password. I'm all for reducing risk, and yes, SSL would be nice, but if the attack was from your home network, they could use SSL strip, DNS poison/clone sites or worse, compromise your machine itself and just install a keylogger.

The more advanced attacks like SSL strip are very good reasons why whole sites should be available via https. As long as you explicitly visit the https version then you will either get a secure connection, a warning about an invalid certificate or no connection at all.

So if a https version of a site is available then bookmark that one and use that.

[Infiltrator]

That would cause problems, your suggesting to close port 80 and just use ssl via 443, some phone providers, etc do not allow access to ports, sadly some also include 443 meaning the site would be inaccessible.

I think what he means is that Hak5 can still use port 80 for normal browsing of the site/forums,

but only use SSL for sensitive information such as when logging into your account, so your password doesn't get sent in clear text.

Edited March 3, 2012 by Infiltrator

[kahhak]

Locking your front door is largely ineffective for stopping an indruder, but does that mean that we shouldn't lock our doors? Combination locks can be picked really easily, but does that mean that we should yell out the combination every time we unlock our own combo locks?

Come on guys, let's not pretend that it's ok that a website has clear text authentication, especially a site dedicated to these type of topics.

Any mobile phone service carrier that blocks SSL/443 traffic is crazy. What phones/providers do this? None of the major carriers that I know of here in the US are blocking 443.

I'm disappointed that Darren hasn't chimed in on this. I'm going to assume that he's to crazy happy about the Pineapple MK4 to bother with this. Darren: I'll trade you an annual SSL certificate for the MK4...

[kahhak]

I'm blocked from 443 unless I pay $10 to unlock it

What service?

[Mr-Protocol]

Forget SSL, HSTS.

http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

[kahhak]

Forget SSL, HSTS.

http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

Interesting concept - I can't say that I'd heard of it before. Isn't HSTS just SSL, but with theoretically better enforcement? With HSTS, SSL Strip wouldn't work, and return visitors should be alterted IF their browser remembers the visit and some sort of other stripping method is used. It would still break ads. It would still be a problem for mobile users who (apparently) can't use port 443.

Baby steps, let's get SSL enabled first....