MyPasswordBuddy: An incredibly insecure password manager (mypasswordbuddy.com)

6 points by caryme 16y ago ↗ HN

I happened across this site today and made an account for kicks. There is no https, your user password is stored in the clear, and in my short time on the site I got a database error.

I hope no one uses it.

8 comments

[ 2.8 ms ] story [ 33.7 ms ] thread

teuobk 16y ago ↗

I'm a bit confused: is this meant to promote the site or to criticize it?

clistctrl 16y ago ↗

it seems to be vulnerable to sql injection... so my guess is criticize

Nyarly 16y ago ↗

"Hey! Tell me all your passwords and the sites they're associated with!" And you're worried about sql injection?

lurkinggrue 16y ago ↗

I try to add an account and all I get is:

Microsoft OLE DB Provider for SQL Server error '80040e14'

Incorrect syntax near ','.

/web/admin/onlinepasswordmanager/default.asp, line 1039

markgamache 16y ago ↗

No SSL. Sign me up!

thepsi 16y ago ↗

They offer an optional extra feature (paid) that I wasn't expecting:

http://www.mypasswordbuddy.com/web/admin/

EvanK 16y ago ↗

i also love how they're shamelessly stealing their graphics from fallout 3

patrickS 16y ago ↗

Better to use offline password management like Sticky Password.

http://www.stickypassword.com