Microchip PIC and it's security. (Microchip really) - Page 1
Forum section: electronics / general

author: boyddotee
author_rank: Contributor
timestamp: June 09, 2022, 07:47:17 pm
content: How secure are PIC/Microchip as as whole? I recently (2022) signed up to their forums under a new account and received my password in plain text? What the? Can anyone one explain why this would be acceptable?

author: dferyance
author_rank: Regular Contributor
timestamp: June 09, 2022, 08:39:11 pm
content: I'm sure it is a totally different department from their engineering. Could be a web team, but also could be a marketing team who's knowledge doesn't extend to security. Often-times companies will trust their vendors when a vendor says their software is secure. Maybe whoever makes the forum told Microchip that it is up to the latest security standards. This is all conjecture of course.Yeah that's really bad but I've had that happen to me on sites before. I click forgot password and got sent the password I had forgotten. Usually truncated which is why I couldn't get in.

author: jpanhalt
author_rank: Super Contributor
timestamp: June 09, 2022, 09:15:03 pm
content: You are worried about a forum? Why?

author: boyddotee
author_rank: Contributor
timestamp: June 09, 2022, 09:19:23 pm
content: Its not about the forum, maybe others will inform you...

author: boyddotee
author_rank: Contributor
timestamp: June 09, 2022, 09:39:28 pm
content: I though the same 15-20 years ago, but think anyone that wants to take advantage will. Sending passwords theses days is a high no no! I'm honestly shocked from a us company!

author: jpanhalt
author_rank: Super Contributor
timestamp: June 09, 2022, 09:51:29 pm
content: Except as a very poor filter for spammers and bots, I see no reason anyone should have to register for a forum/blog. Why use your favorite password(s) to register?

author: boyddotee
author_rank: Contributor
timestamp: June 09, 2022, 10:11:58 pm
content: Are you for real? Couldn't give a toot if you love to spam. This is is a f up 101 in security and microchip is complacent and has been for year's by the sounds of things...

author: jpanhalt
author_rank: Super Contributor
timestamp: June 09, 2022, 10:38:16 pm
content: Go scream to Microchip. I am sure it will take your complaint seriously.BTW, EEVBlog is a very good, even better source for help. Why not seek that help here? Or is your goal just to complain?

author: DavidAlfa
author_rank: Super Contributor
timestamp: June 09, 2022, 10:45:10 pm
content: Email is encrypted nowadays.If your mail was hacked, you have a big problem anyways.Is this Microchip Technical support? Absolutely no.Send this issue to them, nobody here can do anything about it.

author: westfw
author_rank: Super Contributor
timestamp: June 10, 2022, 12:53:08 am
content: Risk analysis. I really don't care if the password I need to submit technical problems, access company fora, download software, and order free samples, is secure or not. Assuming that this is true (I tried the "reset my password" link, and while the final page said "your password has been reset and mailed to you", the email I received did NOT contain the new password), then it seems to me that it's Microchip that is "at risk", and that's their problem.

author: Bassman59
author_rank: Super Contributor
timestamp: June 10, 2022, 05:11:55 am
content: Quote from: DavidAlfa on June 09, 2022, 10:45:10 pmReally?

author: JPortici
author_rank: Super Contributor
timestamp: June 10, 2022, 05:15:51 am
content: The site has the new 2fa crap, the forum still run on ages old engines and has a metric ton of issues that will never be solved.The first thing they should have done after buying atmel should have been migrating the whole shithole to the atmel community, at least that site works.But it seems people that run the forum have a lot of apparent power, they are immovable in fixing things.Certainly complaining here will help

author: boyddotee
author_rank: Contributor
timestamp: June 10, 2022, 06:51:58 am
content: For anyone wondering why complain here and not there I posted the same thing there hasn't been approved yet...Since when did email become encrypted. If a site fails to encrypt user submitted passwords it's unlikely to be sending encrypted emails.

author: Ian.M
author_rank: Super Contributor
timestamp: June 10, 2022, 07:07:37 am
content: I suspect that IT support for their community forums is where Microchip 'parks'PHBswith too much seniority to sack, to minimize their impact on the core of the business. Its the only possible explanation for the entrenched, willfully ignorant incompetence displayed by that department over more than the last decade!

author: hans
author_rank: Super Contributor
timestamp: June 10, 2022, 07:25:57 am
content: I'd beg to question if that plaintext password is really the worst issue out there. Yes it's very bad, and also a bad indication by how much competence the forum software is engineered and deployed.But even database leaks with (salted) hashes get attacked. There are beautiful tools out there that guess MH/s of passwords using dictionary attacks and thousands of common password/word mangling rules. And that's with a single 3080 GPU (imagine if you get a mining cluster of a couple 3090s). I've read that these tools can get a guess rate in the multi-dozen percentage range. The chance that your password "cupofTEA1983@" is discovered in a reasonable timeframe, is getting pretty close.And if you use that password on every website.. well.. good luck rescuing every account after you've been on haveIbeenpwned. So I think that these plaintext password isn't even the worst issue.. it's the use of it on every site that's bad. It's not like that single passphrase is supposed the only key you have to your house, and so you cannot afford to lose it at all. It's your own choice to use an unique, randomly generated password for each site, and store it in an encrypted keychain.Also, I don't think the guys that design fuse bits into ICs is going to bother with a website likely written in PHP, ASP or whatnot. It's not their cup of tea, their department, and I'm sure there are a lot more competent people working in those divisions.

author: boyddotee
author_rank: Contributor
timestamp: June 10, 2022, 07:39:27 am
content: Don't disagree re single password, I do wonder how engrained this culture is. You are right it won't be the same devs but if it's allowed in one department, how could you be sure it's not in another?

author: hans
author_rank: Super Contributor
timestamp: June 10, 2022, 02:00:51 pm
content: That's a good question. Security is not a feature that's tacked on as last thing change, but a general design mindset where you distinguish between what is trustworthy and what is not. It's similar to user input sanitation.. every piece of data that's flowing in your system should have the common-sense check done to it before processed. Just happy-path programming is not robust and secure enough.It's like tacking on a read-out protection security 'feature' so that an attacker can't read the program out a FLASH data via the frontdoor (the ICSP tool). But if it can still load a program to RAM and control debugger functions (like read/writing registers), then that feature is completely useless.Not saying I know of MCUs from MCP that have that bug.It looks like the forum software they used, is bought by some other company. But IIRC the password for the MCP sampling system, was also emailed to me in plaintext (back in the day). So those are not really good signs..

author: TomS_
author_rank: Frequent Contributor
timestamp: June 15, 2022, 02:40:11 pm
content: Was it a password that you supplied that came back in plain text, or one of those "heres a password to get you started, change it when you login" type throwaway passwords?If the former, they wouldnt be the first company or even bit of software to do this (anyone signed up to mailing lists running on mailman? You get a plain text reminder of your password on the 1st of every month!), so there are plenty more jeers to go around. But the Microchip forum is known (amongst people who use it frequently) for its issues, so while its not a great practice to send someone back their own password in plain text, it somewhat wouldnt surprise me.If the later, this seems to be fairly standard practice on a lot of websites I have used, so I personally would not be overly concerned about such a practice, and change it as soon as I login the first time.In my youth I used a single password for everything, but Ive since grown up and now use a password manager. Each website has its own password, and tbh I dont even know what any of them even are since they are so long and complicated and I dont have to remember them any more. Any websites that I particularly care about, and where they offer it, I have 2fa enabled as well.

author: wraper
author_rank: Unknown
timestamp: June 15, 2022, 02:46:28 pm
content: Quote from: DavidAlfa on June 09, 2022, 10:45:10 pmIt also means they most likely store it directly, not hashes. Which means once they have a data breach (which is not that rare), password database will be for sale.

author: NorthGuy
author_rank: Super Contributor
timestamp: June 15, 2022, 02:48:04 pm
content: Quote from: jpanhalt on June 09, 2022, 09:15:03 pmThe password is generic. I use the same password to buy on microchipdirect.com where I have few credit cards stored.Sending plain passwords is certainly a huge security hole. Explaining this to Microchip? Hardly possible ...

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 15, 2022, 06:53:27 pm
content: Yep as mentioned above, if they send back your password in clear, then it means they *store* it in clear, or at least that if they store it encoded, they are able to trivially decode it, which is just as bad.I haven't used a Microchip account in a while so I don't remember this.Although it's now uncommon, some web sites do send you a password in clear the first time you register (one they auto-generate), then you're supposed to change it asap and they'll never send the modified password to you after that. If this is what Microchip does, then the risk is low. But if they send the password you set yourself in clear, then it's plain wrong.