Microsoft doesn't let me to login to my GitHub account - Page 1
Forum section: electronics / general

author: RoGeorge
author_rank: Super Contributor
timestamp: September 25, 2019, 10:01:48 pm
content: Today I wanted to login to my GitHub account after a long time.After typing my username and my passwords, Microsoft doesn't let me to log into my account.They want my email to send me a link to reset my password so then I can change it to something stronger.That's stupid at so many levels, obviously they want to collect email addresses.I knew my username/password, so why they not just let me to change it?

author: Sal Ammoniac
author_rank: Super Contributor
timestamp: September 25, 2019, 10:22:31 pm
content: I wonder how they know your password is weak? They shouldn't be storing it in clear text on any of their systems, nor should they be decrypting it just to test its strength.

author: RoGeorge
author_rank: Super Contributor
timestamp: September 25, 2019, 10:40:48 pm
content: That's averygood question.Maybe their login page sends my password in clear, or the passwords were stored in clear in their database, I don't know.

author: langwadt
author_rank: Super Contributor
timestamp: September 25, 2019, 10:50:28 pm
content: Quote from: RoGeorge on September 25, 2019, 10:40:48 pmI believe Digikey also recently forced everyone with short/weak passwords to change itdidn't you already give them your email when you signed up?

author: hamster_nz
author_rank: Super Contributor
timestamp: September 25, 2019, 11:08:15 pm
content: Quote from: Sal Ammoniac on September 25, 2019, 10:22:31 pmSomething is most likely checking the password strength on your client, before it is hashed and sent to the server.So the server gets:Username: BobHashed password: Gaskljdalkhjsdfhkjlaegkhfrqw12370646781239Is this a weak password: Yes.That is why they can't email you that your password is too weak and request you change it - because they don't know it is week until you sign in.You may find that the CLI git interfaces will still work with the old weak passwords, as they don't have this feature to check the password strength.

author: sokoloff
author_rank: Super Contributor
timestamp: September 25, 2019, 11:25:06 pm
content: The password on web forms is (overwhelmingly) sent in clear text over an https channel (which is end-to-end encrypted).It is (almost) never hashed before transmission in the https stream.I use the parentheticals, because it's possible for someone to do that in Javascript, but it's extremely rare.This means that github/microsoft will have access to your unencrypted password when you're in the process of logging in from a web form. If they're being responsible about security, they should not have you unencrypted password at any other time.

author: RoGeorge
author_rank: Super Contributor
timestamp: September 25, 2019, 11:51:41 pm
content: Quote from: hamster_nz on September 25, 2019, 11:08:15 pmI was trying to report a bug in another repo that's not mine, and only minor inconvenience, so it's not so critical that they don't let me into GitHub, I'll try tomorrow to reset the pass with a fake email account.

author: Psi
author_rank: Super Contributor
timestamp: September 26, 2019, 07:22:41 am
content: They don't need your password in plain text to prove it's insecure, or prove it has been added to a password list.They probably ran a common-password or leaked-password list through the password hash function that they use and found matches to hashed passwords in their system.I'd be more worried if you use that password elsewhere. It may indicate that recently your password was leaked by someone and added to a password list.

author: Mr. Scram
author_rank: Super Contributor
timestamp: September 26, 2019, 07:26:35 am
content: Quote from: Sal Ammoniac on September 25, 2019, 10:22:31 pmThey likely have a list of hashes of known weak passwords and compare the hash to it. Comparing passwords with known used or weak ones is fairly commonplace nowadays.

author: Kilrah
author_rank: Unknown
timestamp: September 26, 2019, 08:23:00 am
content: Just standard procedure, nothing to see here, move along. They already have your email by the way obviously.

author: RoGeorge
author_rank: Super Contributor
timestamp: September 26, 2019, 09:07:01 am
content: Quote from: Psi on September 26, 2019, 07:22:41 amIf other people doesn't have the message I got, then it's almost certain that somehow that password leaked into a brute force list, thank you for pointing that. It was not very weak, 8 characters including caps and numbers, and is one of those passwords I use in places about I don't care much.However, why the whole e-mail address request, instead of just letting me access the account to change the password? Why the whole e-mail reset token ping-pong?

author: Mr. Scram
author_rank: Super Contributor
timestamp: September 26, 2019, 09:14:09 am
content: Quote from: RoGeorge on September 26, 2019, 09:07:01 amTwo factor may be the answer. As others have stated they should already have your address and having people confirm as much information as possible when you reset their password isn't terrible practice.

author: sleemanj
author_rank: Super Contributor
timestamp: September 26, 2019, 09:20:12 am
content: I wouldn't be surprised if your original password was on a list...https://haveibeenpwned.com/https://haveibeenpwned.com/Passwords

author: bitwelder
author_rank: Super Contributor
timestamp: September 26, 2019, 09:27:02 am
content: From:https://help.github.com/en/articles/creating-a-strong-password(which you get by clicking on the 'Learn more' on their login form)Quote

author: RoGeorge
author_rank: Super Contributor
timestamp: September 26, 2019, 10:34:40 am
content: Quote from: sleemanj on September 26, 2019, 09:20:12 amI'm not gonna check my real password with an online 3rd party, but I'll download the encrypted SHA-1 list and check for myself.Just out of curiosity I tried on the webpage verificator123412341234123412341234and they are all in the compromised hashed lists, yet1234123412341234so 4 times 1234 is not compromised.Almost any other single word I could come up in about 10 minutes of tries, either English or Romanian, was compromised, too.Later edit:----------That online checker is funnier than I thought:SchroedingersCat - pwnedGedankenexperiment - OKLATER LATER EDIT:Bad news is I just tested a few passwords that I know for sure they were to be found in a plain text paswsords list available from torrents about 2 years ago, and these well known compromised appears NOT compromised in thehttps://haveibeenpwned.com/verifier.

author: Kilrah
author_rank: Unknown
timestamp: September 26, 2019, 11:15:11 am
content: Quote from: RoGeorge on September 26, 2019, 09:07:01 amBecause since your password was considered weak it was immediately deactivated so people can't access your account with it, so neither can you. You thus have to go through the password reset procedure.Perfectly normal way to go about it.

author: sokoloff
author_rank: Super Contributor
timestamp: September 26, 2019, 11:23:59 am
content: As someone in the web/e-commerce/security industry (and not a particular apologist or fanboy of Microsoft), everything I see here suggests that github and Microsoft are competently doing the right thing here.

author: soldar
author_rank: Super Contributor
timestamp: September 26, 2019, 01:03:04 pm
content: IMHO MS takes security so seriously it can be a pain. I have a Hotmail account which half the time I have difficulty accessing because I have changed location and/or device. I go to China and it blocks me and sends an email with a code to my backup account. Except that is a Google account which is also suspicious. Thankfully GMail is satisfied if I can tell them the email address I use as security without needing to send an email there. Otherwise we would go around in circles forever. A PITA.IMHO if suspicious Hotmail should allow just answering a security question and even that should not be too frequent.

author: Cyberdragon
author_rank: Super Contributor
timestamp: September 26, 2019, 01:06:49 pm
content: lol, that website is funny to see what stupid stuff people use as passwords.Who here is using "fartknocker"?

author: sokoloff
author_rank: Super Contributor
timestamp: September 26, 2019, 01:17:48 pm
content: "That's amazing; I've got the same combination on my luggage!"

author: RoGeorge
author_rank: Super Contributor
timestamp: September 26, 2019, 02:16:58 pm
content: Quote from: Kilrah on September 26, 2019, 11:15:11 amOK. But if instead of me it were to be an attacker, then Microsoft will ask the attacker, "Hey, tell me an email of your choice, to send you a reset token." so the attacker would give whatever address prefers, get the reset tolken and still compromise my account.An attacker that arrives at the capture screen shown in the OP will still compromise the account. So how is this reset token supposed to help the users?Note that at this point GitHub does NOT have any email to contact me, it never has, because years ago when I created the account, e-mail address was optional.

author: Monkeh
author_rank: Super Contributor
timestamp: September 26, 2019, 03:08:24 pm
content: Quote from: RoGeorge on September 26, 2019, 02:16:58 pmThat's only possible because you don't have an email address, which is your own fault. If you had an email address tied it would never send an email to a different address.This is intended tomake you set a proper password. If they don't force you to do so you'll never pay any attention.

author: Mr. Scram
author_rank: Super Contributor
timestamp: September 26, 2019, 06:26:48 pm
content: Quote from: RoGeorge on September 26, 2019, 02:16:58 pmBy not leaving an email you left Github no other choice than this one. They literally don't have a better way of validating you due to you not giving them one.

author: donotdespisethesnake
author_rank: Super Contributor
timestamp: September 27, 2019, 12:31:36 pm
content: If you don't think hackers would ever bother hacking github repos, think again :https://www.theverge.com/2019/5/6/18531222/hacker-data-theft-ransom-stolen-git-code-bitcoinI appreciate passwords and security stuff is a PITA, but Microsoft are trying to save users from their own laxity.