This Kong Stores Passwords in Plaintext

Description

This is a three-panel meme that uses characters and themes from the video game Donkey Kong 64 to criticize poor password security. The top of the image has text that reads, 'When the password reset email shows your password in the clear...'. Below this, three panels feature the character Lanky Kong. The first panel's caption is 'HE HAS NO HASH', the second is 'HE HAS NO SALT', and the final, bottom panel concludes with 'THIS KONG IS STORING PASSWORDS IN PLAINTEXT'. The meme cleverly parodies the lyrics of the 'DK Rap' from the game, replacing the original lines about style and grace with fundamental security concepts. For senior developers, this is a direct and humorous jab at any system that fails to hash and salt user passwords, which are basic, non-negotiable security practices. Receiving your password in a reset email is a dead giveaway that the service is storing it in plaintext, a massive security vulnerability that exposes all users

Common Tags

SecurityFlaws SecurityVulnerabilities SensitiveDataExposure Encryption WeakPasswords

Comments

Anonymous ★ Top Pick Finding plaintext passwords in a database is the adult version of finding out the DK Rap lyrics were actually meant to be serious

Anonymous ★ Top Pick

Finding plaintext passwords in a database is the adult version of finding out the DK Rap lyrics were actually meant to be serious
Anonymous

When a reset email coughs up my password in plaintext, I skip the pentest and just `grep -R "INSERT INTO users VALUES("` - if they’ve never met bcrypt, they’re probably blind-dating SQL injection too
Anonymous

The real security vulnerability here isn't the plaintext storage - it's that after 20 years in this industry, we still have to explain to product managers why 'but the customer wants to see their password' isn't a valid requirement, right before they ask if we can just ROT13 it twice for 'extra security'
Anonymous

When your password reset email reveals your actual password, you know someone skipped the entire OWASP Top 10 and went straight to 'A02:2021 - Cryptographic Failures: Speedrun Edition.' It's the security equivalent of finding out your bank stores account numbers in a public Google Sheet - technically impressive in its commitment to doing everything wrong. At least they're consistent: no hash, no salt, just raw passwords marinating in a VARCHAR(255) like it's 1995. The real tragedy? Somewhere, a senior architect approved this in a design review while nodding sagely about 'keeping it simple.'
Anonymous

This Kong's DB schema: passwords varchar(255), security varchar(0)
Anonymous

My reset email included my password; turns out their auth is literally SELECT password FROM users, KDF: none, salt: regrets, and the KMS is the Sent folder - end-to-end plaintext
Anonymous

If your app can email my password, that wasn’t a reset - it was SELECT password FROM users; their KDF is ‘hope’ and the breach report writes itself
@ZgGPuo8dZef58K6hxxGVj3Z2 5y

Encryption can't be broken thats not present.
@RiedleroD 5y

storing all the keys and salts in the same table as the passwords
@viktorrozenko 5y

if my recollection is correct, having access to a salted hash and the salt doesn't actually pose a risk as rainbow tables (the sole reason to use salts) are still useless even if you have the salt
1. @RiedleroD 5y
  
  I don't know that much about encryption, I'm just trying to be somewhat funny.
  
  @viktorrozenko 5y
  
  i was just a bit concerned with my own knowledge. cuz we do have to implement such data stores at work
  
  @RiedleroD 5y
  
  I have 0 practical knowledge in the field, I'm taking your answer over mine every time. But do research it if you're unsure.
2. dev_meme 5y
  
  _Currently_ existing rainbow tables are useless. Nothing prevents you from generated new one specifically for leaked DB / salts of selected users. But yes, entire process still is a mess and problematic. Anyway, good, strong password with weird symbols still could be considered as "unbreakeable".
  
  dev_meme 5y
  
  with or without rainbow tables
  
  @viktorrozenko 5y
  
  Thanks :)
  
  dev_meme 5y
  
  Just don't use md5 or similar outdated unsafe shit
  
  @viktorrozenko 5y
  
  Ofc not. I'm not that retarded
  
  dev_meme 5y
  
  Good for you!
@viktorrozenko 5y

😂
@viktorrozenko 5y

and i was afraid that if i'm wrong... then we're fucked
@furqan 5y

is this still a reality?
@furqan 5y

I mean do organizations still store passwords? in plain texts?
1. @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  Some yeah like startups or minecraft servers lol
  
  @furqan 5y
  
  how difficult is hashing for them? I mean what's the reason? I am baffled tbh
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  They dont know better
  
  @furqan 5y
  
  https://www.google.com/search?q=best+practices+to+store+passwords+in+DB&oq=best+practices+to+store+passwords+in+DB First result:
  
  @feskow 5y
  
  Imagine writing minecraft plugin that stores players' pasword in plain text for admin to see lol
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  Lol thats probably real
  
  @sylfn 5y
  
  and placing some backdoor to join as admins on other servers
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  😂😂😂
  
  @feskow 5y
  
  2b2t in a nutshell
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  Like that PHP hack recently
  
  @furqan 5y
  
  do you have a link about this?
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  Yeah
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  https://www.google.com/amp/s/arstechnica.com/gadgets/2021/03/hackers-backdoor-php-source-code-after-breaching-internal-git-server/%3famp=1
  
  @furqan 5y
  
  hahaaha
2. @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  Btw just remembered that telegram stores the local pin in plain text lol
  
  @RiedleroD 5y
  
  I mean, the pin is mostly for toddlers to not accidentally send stuff, no?
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  Well yeah because all pictures and media is unencrypted in the folder too
  
  @RiedleroD 5y
  
  a non-issue then
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  But the problem occurs when u use the same pin on other places
  
  @RiedleroD 5y
  
  that's the users fault imo
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  Yeah😂😂😂😂
  
  @furqan 5y
  
  hahah yeah but apparently cause of users faults company's names get tarnished so thye have to keep in mind that the users going to be a dumbass
  
  @RiedleroD 5y
  
  there really is no justice in this world…
  
  Deleted Account 5y
  
  If you don't put a warning saying "we store your (pin|password|details) in plaintext, it's wrong to do so.
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  Yeah this should be a regulation. Good idea
  
  Deleted Account 5y
  
  No
  
  @furqan 5y
  
  yeah, and many people do that duh
  
  @furqan 5y
  
  WOW the app lock pin?
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  Yes
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  The one that is not stored online
  
  Deleted Account 5y
  
  Wait what
  
  @ZgGPuo8dZef58K6hxxGVj3Z2 5y
  
  And yeah this was the case I am not 100% sure but I think they store a hash now
  
  Deleted Account 5y
  
  Ok
@RiedleroD 5y

:0
@sylfn 5y

i use incorrect as my password: when I ever forget it, website reminds Your password is incorrect.

Use J and K for navigation

This Kong Stores Passwords in Plaintext

Description

Categories

Common Tags

Comments

More like this

Why Would I Ever Use a Different DSA k

Maximum CVE Density per Rack Unit

Legendary Stack Overflow Post About Incompetent Security Auditor Demanding Plaintext Passwords