Shoutbox

Log file is storing password in plain text inside .ple file? - Printable Version

-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Messenger Plus! for Live Messenger (/forumdisplay.php?fid=4)
+---- Forum: WLM Plus! Bug Reports (/forumdisplay.php?fid=7)
+----- Thread: Log file is storing password in plain text inside .ple file? (/showthread.php?tid=84511)
Log file is storing password in plain text inside .ple file? by MeEtc on 06-25-2008 at 01:19 PM

I was just in contact with someone who was asking for assistance on IRC, asking why the password for a log was stored in plain text. I had the person send the log, and surely enough the password is plainly visible when opened in notepad.

Now, the user himself is gone, but I did get contact info and the logfile itself. anyone know why this happened?

RE: Log file is storing password in plain text inside .ple file? by RaceProUK on 06-25-2008 at 07:16 PM

I couldn't find my password in my logfiles. Anyway, I think the password is just used to make the encryption key.

RE: Log file is storing password in plain text inside .ple file? by MeEtc on 06-25-2008 at 08:58 PM

well for the log file the user sent to me, I opened the file in notepad and the password was right there in the first line, each character separated by spaces. I open it with the log viewer, type it in without the spaces, and it is decrypted

RE: Log file is storing password in plain text inside .ple file? by Felu on 06-26-2008 at 04:45 AM

Weird for I cannot find my password anywhere in the ple file when opened in Notepad.

Can you(MeEtc) or anyone else see their password in the ple file?

RE: Log file is storing password in plain text inside .ple file? by John Anderton on 06-26-2008 at 04:50 AM

Can I have a look at this log file? IRC share or sending via WLM will do (considering you should publicly send it since its private). I just want to check a few things (and no, I obviously don't care to read logs or take emails or anything of the sort :P)

RE: Log file is storing password in plain text inside .ple file? by NanaFreak on 06-26-2008 at 06:09 AM

um could they have put in a password hint that is the password??

because the hint is not encrypted and they may have thought that plus wanted to confirm the password and didnt read that it was the hint... so yea i dunno if that made sense but yea i know what i was on about...

lol

RE: Log file is storing password in plain text inside .ple file? by John Anderton on 06-26-2008 at 06:11 AM

quote:
Originally posted by NanaFreak
um could they have put in a password hint that is the password??

because the hint is not encrypted and they may have thought that plus wanted to confirm the password and didnt read that it was the hint... so yea i dunno if that made sense but yea i know what i was on about...

lol
That was one of the possiblities. I was just going to check the location of the password and come to a definite conclusion :)
RE: Log file is storing password in plain text inside .ple file? by NanaFreak on 06-26-2008 at 06:16 AM

lol so it did make sense!!! yay...

RE: Log file is storing password in plain text inside .ple file? by John Anderton on 06-26-2008 at 09:33 AM

I just read "password" and "hint" in your post and realised what you meant :P I tend to skim through posts. Its become a habit by now :P

RE: Log file is storing password in plain text inside .ple file? by CookieRevised on 06-26-2008 at 09:56 AM

quote:
Originally posted by RaceProUK
I couldn't find my password in my logfiles. Anyway, I think the password is just used to make the encryption key.
yep, hence it is not stored anywhere.... If only we can convince a lot of people of that :D

quote:
Originally posted by John Anderton
quote:
Originally posted by NanaFreak
um could they have put in a password hint that is the password??

because the hint is not encrypted and they may have thought that plus wanted to confirm the password and didnt read that it was the hint... so yea i dunno if that made sense but yea i know what i was on about...

lol
That was one of the possiblities. I was just going to check the location of the password and come to a definite conclusion :)
Bang on... The definite conclusion is that it IS the hint; the guy on IRC simply typed his password in the hint box.

So either he didn't read the label properly, or either something got lost in the translation. If it is the later, it would be helpfull to know what translation he was using so that this can be checked out... (MeEtc?)

MeEtc: The hint is stored starting from offset 0x23 as a unicode text. Thus not "with spaces in between". What you would see are the unicode characters which consist of two bytes each. For normal ascii characters the second byte (LSB since it is Little Endian) is 0x00. In notepad this is shown as a space since it can't show ascii character 0x00....

[Image: attachment.php?pid=914998]
click for bigger size

;)
RE: Log file is storing password in plain text inside .ple file? by MeEtc on 06-26-2008 at 12:33 PM

quote:
Originally posted by CookieRevised
it would be helpfull to know what translation he was using so that this can be checked out
He says he's from Sweden, so I'm going to assume Swedish?
quote:
Originally posted by CookieRevised
The hint is stored starting from offset 0x23 as a unicode text.
... And thats exactly where the text begins
RE: Log file is storing password in plain text inside .ple file? by vaccination on 06-26-2008 at 01:06 PM

Moral of the story; don't make your password hint your password.

RE: Log file is storing password in plain text inside .ple file? by CookieRevised on 06-26-2008 at 02:12 PM

unless your password is the password hint...

(I'm confusing myself now :p)

RE: Log file is storing password in plain text inside .ple file? by John Anderton on 06-26-2008 at 02:15 PM

quote:
Originally posted by CookieRevised
unless your password is the password hint...

(I'm confusing myself now :p)
That's exactly what you're not supposed to do. :P
RE: Log file is storing password in plain text inside .ple file? by Felu on 06-26-2008 at 02:52 PM

quote:
Originally posted by John Anderton
quote:
Originally posted by CookieRevised
unless your password is the password hint...

(I'm confusing myself now :p)
That's exactly what you're not supposed to do. :P
I actually know a handful of people who do that :P.
RE: Log file is storing password in plain text inside .ple file? by Patchou on 06-27-2008 at 05:41 AM

lol.. alright, I'll prevent newer versions of Plus! to accept the password as the hint.