Horrible practice of storing users passwords

Written by Paweł Barut
I've read today terrifying article about un-ethical storage of users password. It is often common practice that users passwords are stored unencrypted in database. But this case is even more dreadful. It about software, G-Archiver, that is available to everyone. If you ever used this software, you should change your G-mail password right now.
So what is the problem:

• G-Archiver has build in user-name and password for one of g-mail accounts.
• Whenever someone uses G-Archiver and provides his credentials for g-mail, user-name and password is send to author of this software
• Additionally, any one who finds out the user-name and password stored in G-Archiver, can get passwords of thousand of previous users.

Go and read. Hope there are not too many of software that works like this one. It is really terrifying, that some people are so irresponsible. It could be well planed action to collect gmail users and passwords, or it could be just lack of imagination what are the consequences. I would like to believe that it was the second one.

But also big corporations do not care for security enough. It is common practice, that users password is stored internally as plain text. It can be easily found out by using "I forgot my password" feature. If in return you will get email with your original password, then it is a crappy web side. And you should never reuse password passed to such web side as this is big risk for you. Take a look at Password Security: It’s Not That Hard (But You Still Can’t Get It Right) for further explanation and examples.

Cheers Paweł

--
Related Articles on Paweł Barut blog:

• Security: getting DBA rights quite easy
• „Do not use Linux, please, pirate our software” - Microsoft
• Spam, Spam filters, Being Spammer, Being Filtered-out ...
• Do not trust Google Maps

Do not trust Google Maps

Ok, Might be title is too strong, but you should not trust Google Maps when searching for streets in Krosno, Poland (city where I was born). Here is sample, try to search for "Lwowska, 38-400 Krosno, Poland" and you get:
Search is working correctly, but names on street do not match reality. Instead of "Lwowska" street is "Jana Lenarta". Another example is "Platynowa" instead of "Podkarpacka". It seems that all street names are messed up on map. Hope they fix it soon.

Cheers, Paweł

Pictures on Google map

Few days ago I wrote about idea to integrate Google Maps and Picasa pictures in the way that you can see pictures on map. Today I've discovered that it is already done in very similar way. When you go to maps.google.com there is an new tab My Maps. Then you can check "Photos from Panoramio" and you can scroll and pane map to see pictures from different places. Really cool feature. I'm looking forward for same functionality with Google Picasa. BTW, Panoramio was (will be) bought by Google in May 2007. I wonder if they integrate it with Picasa ...
Have Fun with pictures




Cheers, Paweł

After Vacations: Tagging Photos with Geo Location

Welcome back after my vacations. This time nothing about Oracle, but about some idea that was in my mind for few years and now is life: Google Picasa has new functionality: putting pictures on maps. I'm using Picasa to share pictures with friends and family for more than year now. And often I was asked: where did you take this picture? Now I can tag pictures with Geo coordinates and then are shown on map. Take a look at my public galleries on picasa, especially latest one with some pictures from my vacations.
There are still some features that I would like to see;When playing with google maps I would like to have option to show pictures from specific place. Pictures from public galleries could be presented. There might be an copyright issue, but it could be solved easily: users will have option to allow (or not) to publish pictures this way.
And I must buy Camera with build in GPS receiver to simplify mapping pictures...


Cheers, Paweł