The problem with website security is us!

[JMH]

I write a lot about website security. Sometimes I’ll publicly point out flaws in software but there are many, many other times where it remains a private conversation for various reasons. The one common thread across most of these incidents is that as developers, we often make bad security design decisions. It’s us – the organic matter in the software development process – that despite the best of intentions make bad choices that introduce serious risks.

My belief – and one of the key reasons I so frequently write publicly about security – is that the best way to combat risks in software is to educate developers. All the security scans and penetration tests in the world won’t help when it can take just a single line of bad code or a solitary configuration setting made by the developer to bring everything undone. Of course it’s frequently much more than just one mistake too, ultimately, dear developer friends, it’s “us” that build mechanisms such as the one behind Tesco’s password recovery system:

Passwords are stored in a secure way. They’re only copied into plain text when pasted automatically into a password reminder mail.

Troy Hunt: The problem with website security is us!

 

[AceInfinity]

lol, it's funny because I know lots of other's passwords... Friends, relatives, etc... And the network of people that exist for the people that I know as well. This is so true I can't disagree. Nobody needs to "hack" anything if they wanted, they could probably just guess, or use a dictionary to bruteforce their way in. This is why:

1) You don't use dictionary words in your password
2) You don't use your name
3) Anything specific to you

You should at least be using a combination of things, but even I would suggest doing that. Your name combined with the birth year is still not good. If my name was Bob Smith for example, perhaps I would have a password like this:

smithb0b24

Or:

$mithb0b24

And depending on which websites, case sensitivity, matters, you could use an alternation as well:

$mItHb0B24

Something like that is much better than something like "smith24". Mine is of no significance to myself at all, nor does it contain anywords, but it is 14 values in length both lowercase and uppercase letters, mixed with numbers. The larger your password is too, the more secure it would be to a bruteforce attack, because obviously there's more combinations.

My recommendation? A password that is at least 7 values long.

So regardless of how secure a website is, the last thing it comes down to is the password you chose as a user on the site lol. Aside from that, even if your password is good, it could be down to the developer that doesn't know what they are doing. Sending stuff in plain text over HTTP requests that could be intercepted... Allowing execution of javascript that could introduce an XSS attack, or perhaps not checking the input before the code later uses that data to query an SQL database introducing an SQL injection vulnerability?

Such easy mistakes to avoid, but yet these are all still THE most common thing you see, and who's to blame? Not the system itself, but us.