(11-19-2018, 07:31 PM)slothic Wrote: Password are usually encrypted in sql databases

Spoiler:

(11-20-2018, 04:10 AM)mothered Wrote:

(11-19-2018, 07:31 PM)slothic Wrote: Password are usually encrypted in sql databases

The majority are not. I've personally compromised over 3k and can confidently say that 80%+ are not encrypted.
This Is one example of a pretty big broadcasting service:

Spoiler:

I've found In major organizations, such as Fortune 500 companies, they do In fact encrypt all user passwords.

(11-20-2018, 04:56 AM)God Wrote:

(11-20-2018, 04:10 AM)mothered Wrote:

(11-19-2018, 07:31 PM)slothic Wrote: Password are usually encrypted in sql databases

The majority are not. I've personally compromised over 3k and can confidently say that 80%+ are not encrypted.
This Is one example of a pretty big broadcasting service:

Spoiler:

I've found In major organizations, such as Fortune 500 companies, they do In fact encrypt all user passwords.

A shame. Should be illegal in 2018 to store plaintext passwords. By encryption, do you mean non-plaintext? Encryption by itself in this context carries some assumptions, which would conclude that you've been able to determine that the companies passwords were the result of encryption vs hashing. That would still be just as scary as plaintext in my opinion. But I'm assuming you meant encrypted as in non-plaintext.

(11-20-2018, 05:25 AM)mothered Wrote:

(11-20-2018, 04:56 AM)God Wrote:

(11-20-2018, 04:10 AM)mothered Wrote: The majority are not. I've personally compromised over 3k and can confidently say that 80%+ are not encrypted.
This Is one example of a pretty big broadcasting service:

Spoiler:

I've found In major organizations, such as Fortune 500 companies, they do In fact encrypt all user passwords.

A shame. Should be illegal in 2018 to store plaintext passwords. By encryption, do you mean non-plaintext? Encryption by itself in this context carries some assumptions, which would conclude that you've been able to determine that the companies passwords were the result of encryption vs hashing. That would still be just as scary as plaintext in my opinion. But I'm assuming you meant encrypted as in non-plaintext.

Correct, encrypted form not In plain text.

I agree It Is a shame and most Importantly, alarming to say the least. Given It's a commonality for users to use the same password for most of their online accounts, they can also be compromised. I have countless user:pass, email:pass entries (from the back-end that I've personally breached) and tested them on all major websites. I'd say around 60% were used.

The majority do not have a password complexity requirement nor a minimum character length, hence allow sequential chars and commonly-used passwords. You can see my password entry In the above Image of "1337". Four characters that's (In hacker parlance) commonly-used.

(11-20-2018, 05:40 AM)God Wrote:

(11-20-2018, 05:25 AM)mothered Wrote:

(11-20-2018, 04:56 AM)God Wrote: A shame. Should be illegal in 2018 to store plaintext passwords. By encryption, do you mean non-plaintext? Encryption by itself in this context carries some assumptions, which would conclude that you've been able to determine that the companies passwords were the result of encryption vs hashing. That would still be just as scary as plaintext in my opinion. But I'm assuming you meant encrypted as in non-plaintext.

Correct, encrypted form not In plain text.

I agree It Is a shame and most Importantly, alarming to say the least. Given It's a commonality for users to use the same password for most of their online accounts, they can also be compromised. I have countless user:pass, email:pass entries (from the back-end that I've personally breached) and tested them on all major websites. I'd say around 60% were used.

The majority do not have a password complexity requirement nor a minimum character length, hence allow sequential chars and commonly-used passwords. You can see my password entry In the above Image of "1337". Four characters that's (In hacker parlance) commonly-used.

Thanks for the clarification. You're right about re-using passwords. A breach of your system has consequences further than the data revealed in your own system whether you want to bear that burden or not. Maybe it's wrong to blame the applications and blame the users in that regard, I don't know. I don't have a strong opinion on that yet.

I know internal UIs are generally simplistic and messy since you don't need the same care that customer-facing pages require, but judging by your pic it just looks to be like a typical legacy enterprise application UI. A lot of these companies have not kept up with the times. They don't value developer labor, thus their services suffer and situations like you posted occur. Things don't get updated and vulnerabilities aren't a priority when developers are considered your cost center and are treated as such. Not to mention, such places are rarely recruiting new, competent developers because no one wants to work with unmaintained, legacy spaghetti code while being treated like an uneducated expense source.