UK government's password checker sends plaintext password in the URL over HTTP

http://www.getsafeonline.org/themes/passwrdcheck/index.html

by markhemmings • 12 years ago

226 114 12 years ago

PeekPoke2• 12 years ago

Jesus wept....

facorreia• 12 years ago

This is appalling and inexcusable for a site who claims to help improve security and that claims to have in the team people such as "a foremost expert on information security awareness"[1]. So this cannot be attributed to ignorance.

[1] https://www.getsafeonline.org/about-us/

stuaxo• 12 years ago

It was probably outsourced to accenture or similar who then paid the cheapest devs they could find in india.

opendais3• 12 years ago

Yes this is terrible...but it isn't the "UK Government" its a private corporation as per: https://www.getsafeonline.org/about-us/

It also does work over https: https://www.getsafeonline.org/themes/passwrdcheck/index.html

So I'm pretty sure this is just the fact they failed to setup the redirect. Rather than mocking them on Hacker News, we should just tell them they broke that part of their setup at some point and should fix it?

EDIT:

Tried to contact them, got a "The form you submitted contained the following errors

Missing Data.(DIFFERENT_IP)"

error which has nothing to do with the form I submitted. XD

Could someone contact them by their contact us page to get this fixed?

ZoFreX• 12 years ago

Get Safe Online is a jointly funded initiative between several Government departments and private sector businesses. In fact, we are the Government’s preferred online security advice channel.

There are adverts everywhere about it with obvious government endorsement.

It's not just that they send it over HTTP. It shouldn't send it anywhere, it should all be done client-side with JavaScript. It's more than "you made a little mistake" it's "who are you to tell people what is, or isn't, secure when you can't even manage the basics?"

opendais3• 12 years ago

I'm not from the UK and I never believe anything a company puts on its about us page. ;)

If they are doing statistical analysis on password, they'd have to send that information somewhere so I'm not surprised that they are.

Anyone who is concerned about security shouldn't be giving their password to a 3rd party to verify [even via a javascript webpage] for any reason.

Also: "(Never enter your real password into a password checker, as unlike this one, some may be fake)" From the page.

santosha• 12 years ago

It is done client side with javascript, in the results.js on the results page. If they'd put it on the original page, it would all have been client side. The only reason I can think of for doing it this way is statistics collection for later.

gtirloni3• 12 years ago

Just sent an email to their WHOIS contacts.

Torn• 12 years ago

They're on twitter too @GetSafeOnline

knotty66• 12 years ago

Even over HTTPS it wouldn't be secure. The password is in the URL so would be stored in the users browser history, and possibly also web-server logs and sent as referrer headers with assets on the secured page.

madaxe_again2• 12 years ago

It IS "UK Government" - it's a QUANGO, so they can keep it at arms length and wash their hands of it, but be under no illusions, this is a government led initiative for which they ultimately, if not in practice, bear responsibility.

The cynic in me says that this is a deliberate effort to grab as many passwords as possible. It sounds outlandish, but what actions of our rogue agencies haven't been?

gtirloni3• 12 years ago

That would be a waste of resources given the chances of a real criminal testing his/her password strength on a government-operated website are very remote. Even then, they would have to invest in marketing to get people to actually use it when, we all know now, the GHCQ/NSA can simply collect everything at critical infrastructure points.

This looks like a good idea, poorly executed.

Alupis3• 12 years ago

This is the same government that thought they could "block all porn" on the internet?

cs02rm0• 12 years ago

True, ish, they are very much involved.

https://www.cyberstreetwise.com is the website UK government used to get people to send them their passwords.

coriny• 12 years ago

So this may be a coincidence, but I just followed that link and got a warning from malwarebytes about a malicious website trying to connect to my computer.

I've tried a couple more times and not got it again. Anyone else see anything?

EDIT: The IP address reported by MalwareBytes is blocked, but I still don't know if it was just coincidence that the warning popped up a second or two after clicking that link. If anyone else experiences anything similar let me know.

Still it seems to me that this would be an awesome site to use as a watering hole for ensnaring naive web users, i.e. the kind who won't even notice when they are massively infected.

tyho• 12 years ago

I just called who I think is the head of the site, a little ironic that the head of a site that is funded by the government to educate how to secure ones privacy online publishes his mobile number in the WHOIS data for said site, he asked me to email him with my concerns, which I have now done.

neura2• 12 years ago

If you do visit the https version of the page, some of the links back to page still have a hard coded http:// instead of https://

bitJericho• 12 years ago

http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

TazeTSchnitzel• 12 years ago

http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

dublinben• 12 years ago

http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

I wouldn't trust this site at all with actual passwords.

markhemmings• 12 years ago

My initial thoughts are just why not do this client side using javascript? No need for the string to leave the client.

x1798DE2• 12 years ago

Not sure how this works, but if I were writing something that checks "goodness" of passwords, I'd want to check it against a large, sorted list of like the 100 million most common passwords (since almost anyone attackers would start with a dictionary attack, and 10-100 million passwords is decently quick to run against a weak key derivation function). Such a database would be huge, so you'd prefer to do that server-side.

dasmoth• 12 years ago

Bloom filter?

gpvos2• 12 years ago

They don't seem to do a dictionary check at all.

neura2• 12 years ago

Look at the list of things they check. It shows you how they calculate the score for the password. The actual scoring is in fact done in JavaScript, which you can see when you inspect the page.

They want the password on the server side purely for statistics or some other reason that has nothing to do with scoring how "secure" the password is.

nl• 12 years ago

Like dasmoth says, use a Bloom filter.

Or run the length and character checks in Javascript, then hash the password and send the hashed version for dictionary lookup.

maaarghk2• 12 years ago

Hahahahaha. This is a total embarrassment and it is why we can't have nice things. There is always this for a decent alternative:

https://howsecureismypassword.net/

jacquesm• 12 years ago

'abcdefghij' would take 9 hours to crack?

unfunco• 12 years ago

Thankfully correcthorsebatterystaple takes a quintillion years. I'm safe.

maaarghk2• 12 years ago

I thought they did a bloom search over the top 1000 most common passwords or something, I guess if you feel very strongly about this you could contact the creator :)

Pxtl4• 12 years ago

Password1234567890

It would take a desktop PC about A quadrillion years to crack your password [Tweet Result]

LeoPanthera2• 12 years ago

OK, but if you keep reading:

"Your password looks like it might just be a word and a few digits. This is a very common pattern and would be cracked very quickly."

danielweber• 12 years ago

abcdefghijklmnopqrstuvwxyz

46 quintillion years

score!

gtirloni3• 12 years ago

(Never enter your real password into a password checker

In their defense, it's stated pretty clearly that you shouldn't enter your real password and that this website allows you to test the "type of passwords" you use.

They could use the fact that it's over HTTP to teach a second lesson in the results page about HTTP vs HTTPS, and warn the user again that he/she should stopping using that password immediately.

yenoham• 12 years ago

But their reasoning for not entering your real password into a checker is "...unlike this one, some may be fake"

Then they follow it up with "Why not get your family, friends and workmates to test their passwords too?"

And the placeholder in the input field is "Enter your password".

gpvos2• 12 years ago

Not very clearly. Most people would read over that sentence (I did at first, although I of course wouldn't dream of entering my real password into that site). It should at least be displayed in bold red.

usefulcat• 12 years ago

And immediately after they tell you not to enter your real password, they say "Why not get your family, friends and workmates to test their passwords too?"

Donzo• 12 years ago

If the sentence you quoted were the one that they used, I would agree with you that it was stated clearly. Unfortunately, they chose to word it this way:

"(Never enter your real password into a password checker, as unlike this one, some may be fake)"

The sentence is parenthetical, undermining it's importance, and it goes in two different directions, which makes it hard to follow. They should clearly advise users against entering their "real" password in one sentence, and then attest to the authenticity of their password checker in a separate sentence.

By the end of their sentence, it's hard to tell whether they mean that I shouldn't put my "real" password into other password checkers. The implication is that their password checker is real and safe. A clearer way to phrase it would be like this:

"Don't put your real password into this password checker."

sdernley• 12 years ago

It's implied at first glance that it's for testing your password though.

Most people wouldn't even know the mistake they've made and are probably sending the results link on too.

iak8god• 12 years ago

Wow, their advice is terrible too: "86% Exceptional" http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

middus• 12 years ago

XKCDs correct horse battery staple earns merely 40% ("Warning: Your passwords are weak and your digital life is at risk!")

http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

x1798DE2• 12 years ago

When in fact it should earn a 0%, because it's in most common password dictionaries now?

giancarlostoro• 12 years ago

http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

Capitalize the first letter of correct and battery. Then you get 100% :)

splike• 12 years ago

Change a '5' to a '6' and add a '1' and you get 100%

http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

Pxtl4• 12 years ago

Password12345 gets 93%.

rikkus2• 12 years ago

This is what I wrote in their 'Contact' form, which returned an error:

'The form you submitted contained the following errors Missing Data.(DIFFERENT_IP) Return to Previous Page'

I used your password checker here:

http://www.getsafeonline.org/themes/passwrdcheck/index.html

I notice that it has set the form field to hide my password as I type it, that there are two lock symbols next to the password box, and that the box is surrounded by a metallic looking image.

These factors would probably lead one to believe that you were treating my password with care, ensuring that it would only be relayed to yourselves and no-one else would be able to read it.

As an untrusting person, I typed something which is not one of my passwords into the box, just to see what would happen. When I submitted the form, my password was transmitted in clear text over the Internet, where it could be read by anyone who happened to be in a position to sniff traffic. This includes my office network!

For a site named 'Get safe online', this seems like the most incredible irony. I will be spreading the word that this site is utterly unsafe to visit, as it is unlikely that I have co-incidentally found the single problem.

I notice you advise people that a password 'like' 'SP1D3Rm@n' is secure. This is patently false as such a password is very simple to crack.

Again, this one issue I found, after choosing a single page to test, gives me a complete lack in confidence in the advice of the site. I will also be telling people not to heed advice found here.

Please get some real expert advice on security as the advice you are giving to others, and the problem[s] with your site are likely to cause real problems for people.

zhte415• 12 years ago

I did a WHOIS, and seeing a domain registration date back to 2005 gave an air of credibility. So then I visited Internet Archive and browsed several pages https://web.archive.org/web/20080701000000*/http://getsafeon...

They seem like experts... experts in subtle verbal manipulation for those without technical understanding, at least that is how it reads for me.

Over years of archives, including the OP post, 'protect your family' continually appears as a headline. Monetisation is not explicitly outlined, it appears to be government or PPP funded.

Scare tactics, targeted at those probably less internet aware then the HN crowd, rather than education, appear to fund this website by whatever means.

Alupis3• 12 years ago

"We have short time to beat powerful computer attack"

And see how pixelated their main banner image is?

Not only bad grammar, but poor images. Really am ammeter website.

chrismorgan• 12 years ago

Wow, “vwcsgwuqmhcmzlsfgdmbuvi” is laughable, 24%, while replacing the last two characters with “V:” is exceptional, 100%?

afandian• 12 years ago

This seems like the right venue to let them know that you have been a victim: https://www.getsafeonline.org/share-your-story/

pdpi3• 12 years ago

Considering how they deduct points for "bad practices", and how avoiding those "bad practices" actually makes for a smaller password space, I have half a mind to spend some time figuring out exactly how much smaller the password space is for a given length if you follow all of their advice.

Anderkent• 12 years ago

That's not quite right. Assuming you were picking passwords randomly discarding ones that have repeat letters etc makes for a smaller password space, certainly. However that's not how most passwords are generated, especially among the people that need this advice most. If your password generation algorithm is 'think out a random string' and produces 'aabbbbdccdc' then your password space is tiny.

Those practices are meant to address the most common 'patterns' in human-generated passwords, therefore effectively enlarging the password space (any cracker has to enumerate more complicated patterns or brute-force, rather than the simple pattern that our brains would generate by defualt)

pdpi3• 12 years ago

For each rule in isolation, that's true enough. But the point stands: once you add together all those good practices (repetitions, consecutive letters, multiple character sets), how much does that actually reduce the password space? I'm not saying that the space becomes tiny, I'm saying that it becomes smaller, and I'm not sure whether "smaller" is still acceptably large, and it's an assumption that's worth checking.

romaniv• 12 years ago

Any password rules decrease the overall possibility space. The point is that they try to move your password away from the high-probability areas of that space that hackers try first.

It's like kicking someone out of apartment. Yes, you know for sure they aren't anywhere in that apartment, but it still makes it harder to locate them in the city with high probability.

Singletoned• 12 years ago

They are also encouraging people to type their password into random sites, which is IMO the worst aspect of this.

bkurtz13• 12 years ago

Pass#123 is "exceptional". It worries me that people are slow to accept the realities of the xkcd comic on pass phrases (http://xkcd.com/936/). We are training people to think they are secure with passwords that are ridiculously easy to brute force.

mydigitalself• 12 years ago

I think the best thing about this is that "Open, sesame" gives a green light, 87% and Exceptional status.

krzrak• 12 years ago

"Failure Your passwords are laughable which makes you an easy target for cyber criminals. You should disconnect your computer now or got to..."

Seriously this is wording on government site? I find it offending.

ianamartin• 12 years ago

how safe is this password really? and is it better if I add a goat?

Gets 100% safe

VBprogrammer• 12 years ago

  The Data Protection Act

  Under the Data Protection Act, we have a legal duty to protect any information we collect from you. We use encryption software to safeguard your data, and keep strict security standards to prevent any unauthorised access to it.

I'm lost for words.

danfolkes• 12 years ago

Yep, and they add the password to the url: https://www.getsafeonline.org/themes/passwrdcheck/results.ht...

mnw21cam• 12 years ago

<cynical> Nice way for UKGov to harvest a load of passwords for their own use </cynical>

Pxtl4• 12 years ago

What a wonderful tool:

http://www.getsafeonline.org/themes/passwrdcheck/results.htm...

Password12345

is ranked 93% Exceptional!

psychometry• 12 years ago

It's great that the results page has the password right in the URL as a GET variable. Makes it much easier to share it on Facebook.

willvarfar• 12 years ago

Sort of like http://privatekeycheck.com/ in the worst possible way?

passfree• 12 years ago

This is so wrong in some many levels.

1. They should not ask for any password first of all 2. They post the password to their server when they could have checked it on the client 3. The password is sent as GET meaning that it is in the URL and it will be recorded in your history and perhaps anything else that keeps log of the URLs you visit

100% fail

roywiggins• 12 years ago

    password1234
    50%: Sufficient
    
    a12345678910
    92%: Exceptional

So, they try to give you negative points for "sequential numbers" but you get more points for having numbers than you lose, so it's useless. As long as you have a 12-character string with at least one number and one letter, your password will probably pass.

hawkharris4• 12 years ago

We should stop using the term "password" and start emphasizing passphrases. A full sentence is much easier to remember, yet harder to crack, than a shorter, cryptic password. Or, as XKCD put it: http://xkcd.com/936/

There's a widespread misconception that words are always bad because of dictionary attacks, but that concern is moot if you use unique words or simply use a long sentence. A major advantage of sentences is that, because they're memorable, you can more easily use a different password for every site.

RussianCow• 12 years ago

I completely agree, but too many websites put upper limits on the password length (which is completely idiotic) to be able to do this in practice.

hawkharris4• 12 years ago

I agree. It is frustrating when websites place arbitrary limits on characters in a passphrase. It's even more frustrating when they add specific rules (e.g. must use at least one number) that actually lower the number of possible combos in the string.

l-p• 12 years ago

Well, how would they fit the passwords in the database if there was no limit? =)

unfamiliar• 12 years ago

but that concern is moot if you use unique words

You could say the same thing about passwords using random characters. The problem isn't getting people to remember them, it's getting people to use random passwords/unique words in the first place. Telling people to "use a long sentence" will just result in them picking common sentences most of the time like "To be or not to be" or "Live long and prosper".

hawkharris4• 12 years ago

Well, let's say you have a 5-digit password made up of letters and numbers. That's 60466176 combinations.

Now let's say you have a 4-word passphrase. There are about 120,000 words in English. There may be more if you include derivatives of words. That includes 2.0736e+20 combinations, not considering the entropy introduced by spaces between words or punctuation marks.

That's just to demonstrate the power of passphrases...but it's not quite a fair comparison; no one has such an expansive vocabulary. So, finally, let's assume that a dictionary attack includes 20,000 of the most commonly used words, and all of the user's words are common, by this standard.

The result is still 1.6e+17 -- again, not including spaces or punctuation: significantly more than an alphanumeric password.

CamperBob2• 12 years ago

No, we should come up with something that works better than either, and is more usable. Passwords suck. Does anyone here seriously think we'll still be using them 50 years from now?

JTxt2• 12 years ago

I agree! I've been using passphrases for about 12 years, but in this form:

Ia! Ibupfa1y,bitf:

(It's the first letter of every word in that sentence.)

A sentance relevant to me that also refers to the site is easier for me to remember than random words. But perhaps I could make it longer... Use the kxcd idea too.

The entropy is huge unless/until everyone starts making 3 word passphrases the same way with very common words.

There can also be dictionary attacks on common passphrases, especially after a large site is compromised.

Lately I've been changing it up by offsetting my fingers on the keyboard.

Unfortunately each password/phrase input has different requirements and limits, and there's many different confusing help texts for explaining it. And it's frustrating to find out the limits after committing to memory and submitting.

What's a good, plainly written ux standard that we can advocate?

tnorthcutt• 12 years ago

Using a password manager

yeukhon• 12 years ago

I see no difference behind the glory.

Why? Once you changed the word "password" to "passphrase", and get rid of those insane password requirements (must contains 1 upper case, 1 lower case, up to X length, 1 symbol, must not repeat same character twice or consecutively, etc), people start to use passphrase. But with enough attacks, you will build a passphrase table and people who use passphrase then will use the same passphrase on multiple sites which means it is the same as password and then site developers will come out and say "we will implement additional requirements - at least this length with these complexity".

A password which is 12 chars long and complex enough is hard to break. The problem is that people use the same password and credentials gets stolen every day. Can you trust random forums today running your password?

tempestn• 12 years ago

One problem with this is that most people are typing passwords on phones now, so the longer they are, they more annoying they are to type in. (Although I suppose word completion would help with a passphrase. Although for security it probably shouldn't be enabled for password fields.) Anyway, the real solution is a password manager with unique random sequences of characters for passwords.

Perhaps Microsoft, Apple, and Google could get together to build (or buy and open source) a password manager that would be integrated with their various platforms, for the common good. (I realize solutions already exist, but this would make it much more likely that the general public would use it.)

naturalethic• 12 years ago

They clearly need more money.

TimWolla2• 12 years ago

Do they really subtract score for consecutive lowercase / uppercase letters or consecutive numbers? Disallowing that reduces the overall entropy.

dc2447• 12 years ago

http://ismycreditcardstolen.com/

TimWolla2• 12 years ago

And it's down again. After submitting a password I get redirected to the homepage.

DanBC• 12 years ago

It is depressing that money is spent on that website rather than on curating a list of good password managers for all platforms and persuading people to move to those.

UK government does do some great IT stuff. This isn't one of those. UK gov also has some horrifically over-budget under-performing train wrecks of IT projects so I guess I should be glad that this isn't one of those.

mraison• 12 years ago

It would be even more fun if they also asked for your email address at the same time (for security, you know, to protect against viruses).

PeekPoke2• 12 years ago

lol - looks like they are in the process of removing the password checker from the site!

jwildeboer• 12 years ago

Page is gone now. Seems someone noticed and did the only right thing.

KaiserPro• 12 years ago

wait, they actually encourage entering you password into random websites?

how in living fuck is that a clever idea?

Pxtl4• 12 years ago

It's gone. Somebody noticed.

a3_nm• 12 years ago

LeoPanthera2• 12 years ago

It seems they heard us, the page is now 404.

KMag2• 12 years ago

  password123; DROP TABLE PASSWORDS --

My password score is 502 Error: Bad Gateway. What did everyone else score?

In all seriousness, among the http, the GET param, and the laughable entropy estimates, I wouldn't be surprised if they threw in an SQL injection vuln, a buffer overflow, and a couple of XSS vulns as Easter eggs.

UK government's password checker sends plaintext password in the URL over HTTP

Related Stories