SGNinja101 Posted August 29, 2011 Share Posted August 29, 2011 So we just installed TCAdmin V2 and found out that all passwords are reversible. Then we contacted the support and talked with Luis and he told us that it is by design. Personally I think that it is a major design/security flaw and wanted a broader opinion on it. Link to comment Share on other sites More sharing options...
icekohl Posted August 30, 2011 Share Posted August 30, 2011 Please elaborate on 'reversible'. Link to comment Share on other sites More sharing options...
adamnp Posted August 30, 2011 Share Posted August 30, 2011 (edited) basically, storing passwords using reversible encryption is nearly the same as storing plain text vers of the passwords. The system will store the passwords with a reversible encryption...Basically, allowing you to decrypt it.... Typically, the purpose of this would be to provide apps that use protocols that might require the user's password for auth purposes. I guess you will be relying on customers utilizing secure passwords? We all know thats a joke though .... I agree with the OP....I'm sure Luis can elaborate though on his reasoning. Edited August 30, 2011 by adamnp Link to comment Share on other sites More sharing options...
Nisd Posted August 30, 2011 Share Posted August 30, 2011 Well we are more relying on our Admins having secure passwords, and as we all know people are really bad at reusing passwords. Link to comment Share on other sites More sharing options...
TheHeartSmasher Posted September 2, 2011 Share Posted September 2, 2011 Encrypting passwords is a dangerous thing to do in software. The safer and more secure route would be to use at least SHA-1 hashing with salting. Any reason to downgrade security by encrypting passwords instead of hashing them or using other authentication methods? Link to comment Share on other sites More sharing options...
ECF Posted September 3, 2011 Share Posted September 3, 2011 Luis reasoning is the security feature within TCAdmin that allows you to lock out logins from admins by IP address. Link to comment Share on other sites More sharing options...
LFA Posted September 5, 2011 Share Posted September 5, 2011 I will add an option to disable is in v2. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now