McGill will double your password if you don’t do it first

http://www.mcgill.ca/it/channels/news/faculty-and-staff-mcgill-will-double-your-password-if-you-don%E2%80%99t-do-it-first-238834

by isbadawi • 12 years ago

117 125 12 years ago

mcgill.ca

vitamen• 12 years ago

Is this effective at stopping attacks (given that it is public knowledge), or is it mostly a measure to annoy users into updating their passwords to something less cumbersome?

Cerium3• 12 years ago

I think this is to annoy the users.

cannedbass• 12 years ago

Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.

hga• 12 years ago

There are several ways this can be done without that.

Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.

sehrope• 12 years ago

> Seemed like a good idea until it dawned on me that this means the passwords are stored as plaintext.
There are several ways this can be done without that.
Easiest is if they store the date of the last password change or otherwise know you haven't changed it. If it's old enough, double the plaintext before handing it to the hashing function.

Not quite. What you'd need to do is halve the user's entered password if it's older than the cutoff date. If the user enters "foobarfoobar" then you'd halve it to "foobar" before hashing and comparing it to what's stored.

If you only have the old hashed password stored then you don't have the hash of the doubled password, nor can you can infer it.

This whole approach is silly of course. They should just force everybody to reset their passwords.

comboy• 12 years ago

This must be some security joke. I would worry more about passwords not being hashed than the fact that some users didn't change them.

rspeer• 12 years ago

The fact that they're able to "double your password" is a bad sign. Here's what this implies to me:

* McGill had a database of everyone's password in plaintext at the time of Heartbleed

* McGill is concerned about mitigating possible security compromises due to Heartbleed, including these plaintext passwords, which if they were compromised were compromised all at once

* Despite this concern, McGill still has a database of everyone's password in plaintext. Oh, and a large proportion of them are still the possibly-compromised ones.

* They're comfortable announcing this fact to the Web, for some reason.

I really hope the first thing they do after doubling the password is put it into a password-hashing function and throw away the plaintext, and then make those users change them anyway, because the doubled passwords are still compromised. It sounds unlikely.

Nogwater2• 12 years ago

I don't think that's necessarily true. Let's say they have all of the passwords stored as bcrypt hashes, and they also know the last time you changed your password. They could just update the application logic to check that your password is of the form <pw><pw> if your last change date is before X. Then to check the password, they just take the first half and check that against the hash.

pwr22• 12 years ago

Oh God...

Aldo_MX2• 12 years ago

  "password123password123".match(/^(.+)\1$/)[1]

oxryly13• 12 years ago

So, in other words, this is an elaborate prank?

StavrosK2• 12 years ago

This would break passwords like "foofoo", since they'd think it was already doubled, they'd check "foo" against the hash and it would fail. Then again, you can get around that with doubling it again after checking, so I don't know.

cheez2• 12 years ago

Yep, basically:

    if(userHasUpdatedPw) { checkPw(hash(pw)) }
    else{ checkPw(hash(pw+pw)) }

primitivesuave• 12 years ago

It's quite easy to come up with a scheme to manipulate the password client-side. I'd assume an organization with any technology credence whatsoever knows not to store unencrypted passwords by now.

zackify4• 12 years ago

take a look at pearson's blackboard, they store passwords in plain text.

jszymborski• 12 years ago

The problem is that these passwords are used on everything from printer services to cisco vpn access to federated network ("eduroam") where "client-side" isn't somethin McGill controls.

McGill does some beautiful IT admin stuff. And then it does some scary-ass shit like this.

dllthomas4• 12 years ago

I'm not sure, but there may be some hash functions for which H(concat(a, a)) = F(H(a)). I'd worry a little about their security in some contexts - particularly if that generalized beyond just duplication, it seems likely vulnerable to length extension attacks if used for HMAC, &c - but for password hashing it might be fine and would clearly be better than plain text. It's not impossible they were already using a hash for which that's true - just unlikely.

Another possibility would be that they compute and send both H(a) and H(firsthalf(a)), if fisthalf(a) == secondhalf(a). That would work with any hash function, but I think would not appreciably increase security.

bmm6o2• 12 years ago

there may be some hash functions for which H(concat(a, a)) = F(H(a))

If H is secure then F is not computable. If they can do a trick like this then their hashing is no good.

Another possibility would be

Yeah, you can approach it like a puzzle and figure out what crazy set up they could have, but Occam's Razor has to apply at some point. I'm betting they did the dumb thing, not the strange thing that is mostly pointless.

temuze• 12 years ago

Theoretically, they could have HAD the password in plaintext, then doubled it, salted it and hashed it in the new DB.

bengali3• 12 years ago

this makes sense, as they also doubled(+2) the min password lengths. 18 char would be rather annoying to me though.

Dylan168072• 12 years ago

They can put a flag on the database and check that the cleartext you send them when logging in is doubled before hashing half of it.

I can't count how many times I've seen something that could easily be done at login time and people conclude that the service must be storing plaintext or multiple hashes.

This isn't even a direct security measure in the first place. This is to annoy people into updating their passwords.

Theodores• 12 years ago

You are correct - for UX reasons you don't want to be causing people to change password unnecessarily, so a check at login for length is the obvious way to do it, informing people on an as needed basis that their password is too short. I just don't think they want short passwords on their system any more. Hence there is nothing sinister about what they are doing and how they are storing passwords. The evidence fits the scenario that they say it is.

scottydelta2• 12 years ago

Even if they 'check that the cleartext you send them when logging in is doubled before hashing half of it' and calculate hash of the doubled string, what will they check it against? They don't have the hash of double the string until and unless they were storing the plain-text.

overgard• 12 years ago

There's also the "exactly 8" limit increased to "8 to 18". Why even have those limits? If you're hashing it there's no reason to have a limit at all.

kngspook2• 12 years ago

I've always wondered this... So many organizations do this.

nemanja2• 12 years ago

I always thought that the max is there to discourage users from setting passwords so long they can't remember them (and instead write them down on a post-it that's right on the monitor).

serioussecurity• 12 years ago

I believe old versions of mailman fall on their face when using pw more than 8 chars.

mappu• 12 years ago

In general yes. But don't forget there was CVE-2013-5750 with Django's PBKDF2 implementation, where arbitrary-length passwords could DoS the server. An upper bound is probably a safe thing to have (but 18 is too low)

jasonj794• 12 years ago

A better way to do this would have been:

* hash current passwords with a salt, unique to each password entry, and throw away the plaintext entries.

* keep a history of hashes per user, to prevent changing to a past password

* ensure fair complexity of the incoming password

* once the deadline has been reached, force users who have not yet changed their password to do a password reset via an online form

* never, ever again think that doubling a password is a proper way to fix a security issue, ever...

ars3• 12 years ago

never, ever again think that doubling a password is a proper way to fix a security issue, ever...

I don't think that's it, I think it's just to annoy people into changing it.

lukifer• 12 years ago

ensure fair complexity of the incoming password

As we all know, a typical password validator formula is a great way to encourage people to choose "Secr3t!", or something else equally bad.

I'd really like to see a password field that auto-generated pass phrases using full english words from a sufficiently large wordset (in the vein of "correct horse battery staple"), possibly even enforcing such phrases as the only valid type of password. Every user gets a strong password they can actually remember. (...although possibly a non-starter for mobile contexts.)

pyre• 12 years ago

In pseudo-code:

  if not check_password(submitted_password) then
    HTTP 401
  else if password_last_changed < threshold then
    change_password(submitted_password + submitted_password)
    HTTP 401
  else
    log_user_in()
    HTTP 200
  endif

burke• 12 years ago

No, they quite clearly did this:

    if password_requires_rotation()
      p1, p2 = split_in_half(password)
      fail unless p1 == p2
      verify(p1, ciphertext)
    else
      verify(password, ciphertext)

chias• 12 years ago

As Dylan stated, an example of a way to do this on login without storing passwords in plaintext:

    login():
    needsPasswordDoubled = [has user changed password since XX date?]
    username = [username post parameter]
    password = [password post parameter]
    if login successful:
        if needsPasswordDoubled:
            replace stored password hash with hash(password | password)
        else:
            return success
    return failure

Done. That said, the security of this is a joke: anyone who wants to compromise McGill accounts and (a) has a valid (old) username and password and (b) has seen this public press release is simply going to double all of their compromised passwords. But still, typing a double-password is annoying if you don't want to do it. So this is really just a way to "force" people to change their passwords without forcing a password reset.

eridius• 12 years ago

The security of this is a joke because this isn't a security move. It's not designed to make the users secure after the Heartbleed vulnerability. It's purely designed to make logging in annoying for the users, so they finally change the password they should have changed a while ago.

Seems a heck of a lot better than force-expiring passwords like I'd expect any other company to do.

wfjackson• 12 years ago

The need to change passwords arose in April, when the Heartbleed vulnerability was revealed. Heartbleed makes systems vulnerable to data theft since attackers can use it to gain access to systems and then proceed to access and steal information without leaving a trace.
Even though our central IT systems are protected against Heartbleed, any accounts that have already been stolen still pose a security risk. Almost 20,000 members of the McGill community did change their McGill Password, but thousands more did not, and so additional actions have become necessary.

So, ff the people who got the passwords read this post then all they need to do is double the passwords they got with HeartBleed to gain access?

Perhaps they should quadruple the password? /s

pcthrowaway• 12 years ago

The point isn't to make their system more secure, it's to annoy the users into changing their password.

Cerium3• 12 years ago

No, It does not mean that the password is stored as plaintext. Simply keep a flag for "UpdatedRecently?", if the flag is false, then not only should the first half of the input correctly match the hash, but the first half the input should match the second half.

ChristianBundy• 12 years ago

How is that helpful for mitigating security issues though?

Aldo_MX2• 12 years ago

Unless you are being specifically targeted (ie. the attacker knows that you have to repeat the password twice), you mitigate the easiest possible attack: user/password combination from a stolen database.

Although I suppose this was done to force the users to change their password.

tempestn• 12 years ago

Because it annoys the holdout users into changing their passwords.

WallWextra• 12 years ago

Do you consider this likely?

Cerium3• 12 years ago

I'd probably flip a coin.

Nogwater2• 12 years ago

After all of this effort, they're still limiting passwords to 18 characters? Why would they do that?

jasonj794• 12 years ago

I't because they are still storing passwords in cleartext... If they were hashing passwords (which is the correct way to do it) there would be no limit.

simlevesque2• 12 years ago

That is simply not true. I used to think the same but real world experience showed me that a lot of websites hash the passwords but they still set a limit to password length. You should read this : https://www.reddit.com/r/gfycat/comments/2m7ddd/how_does_gfy...

zackify4• 12 years ago

what the actual fuck

simlevesque2• 12 years ago

this is hilarious

zackify4• 12 years ago

This is the same thing as blackboard, they store every password in plain text, nobody seems to care. I've been trying to bring attention to it.

okonomiyaki3000• 12 years ago

RIP Security.

btilly• 12 years ago

Doubling the password is cute, but it would be even more effective to change the password for you by appending constant text to it.

The only challenge then becomes what constant text to add.

I would suggest something like, ishouldlistentosecurity. :-)

smlacy• 12 years ago

Although highly suspect and troubling, this does not necessarily require that they have all users original passwords stored in plain text. If they had originally used a hashing function that obeyed the following:

Hash(pw) + Hash(pw) := Hash(pw + pw)

(NB: Where '+' above is really just a stand-in for any pair of combining functions, not necessarily arithmetic addition or string concatenation.)

But, I agree with many others here that the likelihood of stored plain text passwords is very high.

geofft2• 12 years ago

I think that the goal here is not to increase password strength, but to make typing your old, short password so annoying that you pick a different one (that complies with the current password strength rules). That is, this isn't aimed at attackers; it's aimed at users.

If so, it's pretty clever.

abritishguy2• 12 years ago

Then why not just force them to change the password on login?

geofft2• 12 years ago

One possible answer: Because tenured faculty can call up the helpdesk and get policies reversed, because they're tenured and the helpdesk isn't.

Another possible answer: Many systems can't prompt for password changes, and will just continue to log you in (because, especially for remote-access systems, that's better than denying access and hoping you find another way to get logged in). Probably the lazier of the users also don't use very many of the computing facilities, and may just use a few legacy systems.

abritishguy2• 12 years ago

They need to hire some competent IT people

eksith3• 12 years ago

  The McGill Password length has also been increased from exactly eight 
  characters to a variable length of eight to 18 characters.

So they're not using bcrypt (usable length 72). Even PBKDF2 would have been acceptable, but my guess is that they were sold a "layer over" on their stack with this. I can already tell this is a hacky patch.

  Every year, about 1,200 to 1,500 McGill accounts are compromised in 
  one way or another.

Phishing + guessing. I know someone who gets about 2-3 emails a week asking to enter their login info into some site in Brazil or the Czech Republic.

If every site properly salted and hashed passwords, reuse isn't even a problem. But as we know :

  - Most people choose crappy passwords.
  - Most sites use crappy hashing schemes (if they hash at all)

When other sites are compromised, there's an easy list of ready passwords to try against other potential targets.

McGill's problem isn't Heartbleed.

danudey• 12 years ago

They may be artificially limiting the password length because other services which authenticate (e.g. VPNs, mail systems, older UNIX logins, administrative software, payroll, etc.) may have limits on password input fields.

eksith3• 12 years ago

This is why PBKDF2 would have made more sense then. They can centrally authenticate, derive a secondary token from the original pass while specifying the max limit for each of those services. Best of all, this means the mail, UNIX login etc... need not have the same login token.

fabulist2• 12 years ago

Phishing + guessing. I know someone who gets about 2-3 emails a week asking to enter their login info into some site in Brazil or the Czech Republic.

I think it probably has something to do with this.

https://www.mcgill.ca/it/channels/news/email-subject-interna...

eksith3• 12 years ago

That's pretty bad. I think those get filtered before it gets to the inbox most of the time, but the phishing continues too. This one from 2010 is pretty similar :

http://www.mcgill.ca/it/news/phishing-attack-mcgill-email-11...

cgriswald• 12 years ago

On the plus side, they're telling people about the limit. I visit so many websites that will happily take passwords of arbitrary length without complaint... until you try to log in and your password doesn't work because the password you entered was too long and it truncated it.

jschwartzi• 12 years ago

I have an auto loan with a company which truncates the username. It's bizarre because they'll happily let you key in the entire username when you go to log in, but it truncates when you first set your account up.

Why on earth would you ever need to truncate a username?

andrewstuart2• 12 years ago

It's a pet peeve of mine when a site puts a max length on characters (which is dumb itself) and then they don't put a max length on the password input later. Nothing but a regular workout for your 'forgot my password' feature.

It bothers me less now that I use a good password generator/safe, but still bothers me nonetheless.

baby• 12 years ago

So they're not using bcrypt

Bcrypt is not the ONLY secure solution to securely store passwords (contrarily to what everyone is trying to tell you). See Thomas Pornin's answer on SO:

http://stackoverflow.com/questions/2772014/is-sha-1-secure-f...

omgitstom• 12 years ago

Everyone is guessing if they are storing in plaintext or not. But that isn't the actual issue to learn from their mistake. They have publicly asserted what they are doing (which is great information for a hacker), and chose a bad way to attempt to force users to reset their passwords because of a compromise. I would feel better if it was an email directly to mcgill faculty / staff. If you are building out a user management system, you need a way to disable accounts and force a password reset.

You never want to convey any information about the usernames, password, or state of the account _ever_. This is true for error messages during login, but can be applied to any messaging.

mazlix• 12 years ago

this is in no way more secure.... there's a bijection... any password that an attack wants to try they just double so instead of bruteforcing [aab, aac,aad] just [aabaab, aacaac, aadaad] the only reason this makes sense to do is to annoy users into changing their password

hackuser• 12 years ago

I'm not sure it improves security significantly, but the weak link is using passwords as security in an environment like a university.

Getting users to confirm to good password practices is nearly impossible when they are mature, paid employees with money and valuable IP on the line, and at organizations with legal/regulatory security requirements. Imagine accomplishing that with thousands of college students. (I'm not sure there's a good, cost-effective solution, other than to provide more secure options to users who want them.)

scottydelta2• 12 years ago

How can they double the password using the hashes? Are they storing password in plaintext? :O

deckar01• 12 years ago

This strange rule could coexist with hashed passwords:

  if(hash(password) != passwordHash) return false;
  if(passwordUpdateTime < heartBleedTime) {
    changePasswordHash(hash(password + password));
    return false;
  }
  return true;

alfredxing• 12 years ago

Here at UBC all accounts (students, faculty, staff) must have their passwords updated every year. They force you to do it with 3 "skips" available (for if you really don't have time).

achille2• 12 years ago

Looking at a (failed) login flow, it looks like they are using Oracle SSO

    Markers:  
    * Cookie named site2pstoretoken
    * Http header: Oracle-Application-Server-10g/10.1.2.3.0 Oracle-HTTP-Server
    * Layouts are still done via <tables>

cm2187• 12 years ago

Am I the only one alarmed by the general inability of websites to protect sensitive information? There isn't almost a day without a major service leaking passwords or personal details. If we don't get a LOT better at this there will be some major reaction sooner or later, either legislative or in term of public behaviour. Like the government establishing a system of licenses to have the right to handle personal data, or with regular costly audit. But we can't continue at the current pace.

yAnonymous• 12 years ago

Unacceptable. They should have AT LEAST trippled the passwords.

MrSourz2• 12 years ago

That's maybe the next step to prompt the user to change!

Or even better make it forwardssdrawrof though that feels a bit evil. (forwards then reverse)

McGill will double your password if you don’t do it first

Related Stories