Author Topic: Secure Login (Read 6621 times)

UncleGene · « **on:** May 10, 2008, 20:09 »

Question to everybody: aint you afraid using sites with insecure login? Looked in the list (do not check all sites, but ~ top 15), and only 5 were secure: IS, SS, FT, Zym and - surprise - ImageCatalog. Looks like for myself I have manageable list of sites to work with

...

P.S. Checked remaining - only moodboard can be added to safe list

UncleGene · « **Reply #1 on:** May 10, 2008, 22:06 »

Sorry, forgot "security 101". The _only_ secure site is zymmetrical.

zymmetricaldotcom · « **Reply #2 on:** May 11, 2008, 07:46 »

Thanks for noticing. We did have a dashboard-style login on all pages before, but there is simply no way to lock down that type of form - you enter your info in perhaps in an shady internet cafe, and your account info would be exposed.

Just bookmarking the HTTPS login page on Zymm is the ideal entry method for regulars, i'd rather have one secure door on my business then dozens of unlocked ones.

My geeky sysadmin side would love to babble on about what else we do to secure things, but it's not really worth tooting own horn, even the best security experts know it's about risk mitigation, not elimination.

le_cyclope · « **Reply #3 on:** May 11, 2008, 08:17 »

Glad to know that at least 1 site is full secure...

Speaking of security, do you guys change your passwords regularly?

I try to do so but maybe not as frequently as I should...

And Keith (from Zimm.) There's seems to be a glitch with your system when I try to change my PW. In Account|Profile, I change Pw and then Update but I still have to use my old pw... What am I missing?

Claude

UncleGene · « **Reply #4 on:** May 11, 2008, 11:12 »

Keith, you still have a hole (easily fixable) - usage of the same password on ftp. Just allow/require to use a different one.

zymmetricaldotcom · « **Reply #5 on:** May 11, 2008, 13:24 »

? The FTP password is different than the registered member password (which is different than how most sites are set up). We explicitly did this for the tradeoff that most people won't want to FTP in SSL mode; it's slow. So, we allow non-secure connections with FTP, and in the extreme event that someones FTP password was compromised, the worst thing a bad guy could do is FTP us images of their aunt Matilda.

As for the question for le_cyclope about password updates, good catch - must have been a recent bug, i've disabled that for now. Will have it fixed shortly.

UncleGene · « **Reply #6 on:** May 11, 2008, 15:05 »

O-ops, sorry, you are right. So - Zymmetrical gets the medal "The Only Secure Stock Site"

It would be interesting to see what other sites can tell...

zymmetricaldotcom · « **Reply #7 on:** May 11, 2008, 15:58 »

Heh well like I tried to say.. no one should ever say "We're 100% secure". It's just not going to happen. The more we can put the trust into code and automatic methods, however, the more business value is gained.

Password changing: The problem is resolved, if you go to https://www.zymmetrical.com/account/profile/ you can change at will. How's that for Sunday Service.

le_cyclope · « **Reply #8 on:** May 11, 2008, 16:17 »

Wow!

Claude

le_cyclope · « **Reply #9 on:** May 11, 2008, 17:01 »

One more remark, I think it's safe to send me an email telling me that my pw has been changed, but not so secure to write my new pw in clear in the message.

But I don't expect any more changes in your system before monday!

Claude

cphoto · « **Reply #10 on:** May 11, 2008, 18:35 »

Quote from: le_cyclope on May 11, 2008, 17:01

One more remark, I think it's safe to send me an email telling me that my pw has been changed, but not so secure to write my new pw in clear in the message.

But I don't expect any more changes in your system before monday!

Claude

On that note, if they can send you your password in clear that means their password DB is not encrypted, and they store the password unencrypted in their DB, so anyone working in that company has access to your password

Not so good...

Password should be encrypted in the DB, that's a very basic rule, and no one should be able to read it. If you forget about it the only way should be to reset it.

Pixart · « **Reply #11 on:** May 11, 2008, 19:25 »

Sure, I can login secure... but I cannot upload. Timeout errors. Fatal something errors... darn, I closed that window. All kinds of code popped up on my screen though.. Guess I'll try another day.

zymmetricaldotcom · « **Reply #12 on:** May 12, 2008, 06:34 »

I'm not going to get much into it on a public forum, but suffice to say we use above industry-standard encryption on all sensitive data including passwords.

Quote from: cphoto on May 11, 2008, 18:35

On that note, if they can send you your password in clear that means their password DB is not encrypted, and they store the password unencrypted in their DB, so anyone working in that company has access to your password Not so good...

Password should be encrypted in the DB, that's a very basic rule, and no one should be able to read it. If you forget about it the only way should be to reset it.

zymmetricaldotcom · « **Reply #13 on:** May 12, 2008, 06:46 »

Well this is a business decision, the same as the 'Forgot Password' function. Is it more secure to not have such features? Yes, but possibly at the expense of convenience.

I am personally much more concerned about scenarios like Cphoto described: a member uses the same password on every site on the internet, and it only takes one unscrupulous one to go fishing with members passwords and see if they can do some funny business with their accounts elsewhere. Like Hal 9000, it's usually humans who mess up.

But, if you enforce a generated password on users, especially a complex one, chances are that they won't remember it and will either bog down your staff answering "what's my password" questions and/or driving away people from using your site because they can never remember the password- it's much easier for them to participate where they remember the password because it is the same as everywhere else.

Layered defense is best.

Quote from: le_cyclope on May 11, 2008, 17:01

One more remark, I think it's safe to send me an email telling me that my pw has been changed, but not so secure to write my new pw in clear in the message.

But I don't expect any more changes in your system before monday!

Claude

Jack Schiffer · « **Reply #14 on:** May 12, 2008, 07:36 »

Looks like Cutcasters joined the secure website club

UncleGene · « **Reply #15 on:** May 12, 2008, 10:27 »

Quote from: Jack Schiffer on May 12, 2008, 07:36

Looks like Cutcasters joined the secure website club

Nope

johngriffin · « **Reply #16 on:** May 12, 2008, 12:56 »

tonight. i'm waiting for feedback from Uncle Gene and will make the changes so its more secure. interesting stuff keith too and thanks for sharing.

UncleGene · « **Reply #17 on:** May 12, 2008, 15:18 »

I did comment on other thread - basically, look at Zym, only they did it the right way

UncleGene · « **Reply #18 on:** May 12, 2008, 20:18 »

P.S. Found secure logins on some sites, just have to bookmark these and never use front pages.

https://secure.istockphoto.com/istock_login.php
https://submit.shutterstock.com/login.mhtml
https://www.fotolia.com/Member/Login
https://www.featurepics.com/login/signin.aspx

Looks like that's it.

maunger · « **Reply #19 on:** May 13, 2008, 05:38 »

Quote from: cphoto on May 11, 2008, 18:35

On that note, if they can send you your password in clear that means their password DB is not encrypted, and they store the password unencrypted in their DB

I don't believe that you can make that assumption - databases can be encrypted regardless of the security on the page.

MicrostockGroup Sponsors

Author Topic: Secure Login (Read 6621 times)

UncleGene

UncleGene

zymmetricaldotcom

le_cyclope

UncleGene

zymmetricaldotcom

UncleGene

zymmetricaldotcom

le_cyclope

le_cyclope

cphoto

Pixart

zymmetricaldotcom

zymmetricaldotcom

Jack Schiffer

UncleGene

johngriffin

UncleGene

UncleGene

maunger

Related Topics

Sponsors

Microstock Poll Results

Sponsors