Hacker News Reader

Comment by rwmj | Hacker News Reader

Virgin UK stores and sends the password in the clear. (Evidence: Whenever I call them on the phone, I have to read out my password, which is the same as the one you use to log in through the website).

TBH I'm not especially bothered by this.

View on HN

It's entirely possible that the phone representative is entering your password into their system, which then checks it against the stored hash.

Try reading your password to somebody else and getting them to enter it correctly. Unless your password is terrible, you should find that you can tell the difference between them verifying a text field vs. entering it into the system pretty easily.

Yeah. I always use random passwords for the answers to "security questions", and it's fascinating to read them off over the phone. It's obvious that they're stored in the clear, because they don't care about (for instance) case or spacing.

The system could normalize the password (convert to upper/lowercare, remove spaces) before hashing it. It'd be dumb, but not as bad as storing in plain text.

I don't find that likely, though.

Amazon used to do it: http://www.wired.com/2011/01/amazon-password-problem/

Unless it's "CorrectHorseBatteryStaple"

That evidence isn't conclusive. They could be entering the password into an application that verifies with a hashed value.

If you're talking about virgin mobile, I remember reading that they have separate password storage for online and phone - is it possible that you've just set them to the same thing?

Reply on news.ycombinator.com