[Gabrielfair]

For the people who don't know what this means. WeChat is saving the passwords of all its users in plaintext. Which means the company and their employees can see your password. Which means CCP could use this password to gain access to your other accounts

[davedx]

No you can't assume that, someone in the reddit chat had a more reasonable explanation:

- password goes through filter check onSubmit and some flag is set on the account immediately, it's added to a queue, pw is hashed and stored

- "account moderation" worker picks up task from its gigantic queue of Chinese accounts that need some automated action taking on them, bans account, notifies user, does whatever else needs to be done when closing an account for a service like WeChat

Edit just to remark: a lot of people commenting on this thread are making some pretty big assumptions about both what apps do do and should do with passwords.

In my experience, you can more or less say this: most companies and applications in 2020 do hash passwords before storing them in the database.

Beyond that, all bets are off.

[Darvon]

What percentage of your networth would you bet that the Chinese government can't access WeChat passwords?

[luc4sdreyer]

What percentage of your networth would you bet that the Chinese government _can_ access WeChat passwords?

[umvi]

I'd bet it all. The CCP is like God within the borders of China. They have omnipotence and omniscience.

To be clear, I wouldn't bet it all that the passwords are stored in plaintext. But I would bet it all that the CCP has their own special key and/or backdoor access which allows them to continue having omnipotence and omniscience while keeping pesky foreign powers out.

[MiroF]

You'd bet it all that they're using some sort of invertible scheme to store passwords?

I doubt it. The CCP is bad, but it's also pretty rational. Doing this would just be dumb.

[strictnein]

I mean, I'd love to double my net worth, so 100%

[diabeetusman]

7%

[BluePen7]

After my initial laugh at your response, I realized 7% is about what I'd bet too.

My first foray into options trading I lost around 3% of my net worth, and I'd say I'm more than twice as confident about this than I was about that.

I'd evaluate the odds of the CCP doing something, to be in line with the odds of them benefiting from doing something, regardless of the expense/risk to their populace.

There's nothing I'd really put past them, we know for a fact they harvest organs from political dissidents, but we're skeptical on if they'd store passwords plaintext?

Given people tend to re-use passwords, I'd imagine having a massive trove of plaintext passwords for all Chinese citizens, or even anyone who communicates with them, would be incredibly useful.

Not to mention the fact that they have to maintain a list of anti-CCP passwords, which would be a tedious process, or they'd have to automate something to detect anti-CCP sentiment. I think an interesting experiment would be to see what less obvious anti-CCP passwords get you banned. With enough probing and data, I'd possibly increase my wager to 10%.

As a well known and outspoken critic of the CCP, she might be elevated to the status where they actually just have a person reading everything she types into WeChat 24/7. Do you think they fully staff the night shift, or would the ban have taken twice as long outside of Chinese business hours?

[solotronics]

I am a gambler and I think this is a sure bet so 10%

[ufmace]

Well it depends on what you mean. I'd say there's basically a 100% chance they can access your account. In a properly designed system for this, there would be a feature for allowing certain admin users to log in as an arbitrary user and access all of their information as them, without ever seeing or typing their password, so the actual password is kept secure and there are logs of which admin "ghosts" which user accounts when.

Would I bet that the Chinese Government has this properly implemented and can't access passwords once set? Yeah no way.

[thiht]

Why would they need it? Can't they just ask WeChat if they need anything? (Including privileged access bypassing any password)

[emsy]

The flaw in your reasoning is that you apply western standards of what consists of reasonable behavior.

[cryptonector]

At the very least passwords that raise that flag get saved.

Just in terms of security policies this is nuts.

Inspecting the political contents of passwords is nuts and tyranny.

Inspecting the contents of passwords at all is nuts and spectacularly bad.

[pbhjpbhj]

Well it's wrong, and stupid under my Worldview .. but from the point of a fascist dictatorship I can see how it seems reasonable. Catch people who think they're doing something hidden and who appear to have disdain for the state machine.

Like choosing business associates based on their politics, just at a larger scale.

[TimothyBJacobs]

> Inspecting the contents of passwords at all is nuts and spectacularly bad.

Evaluating a passwords' strength or complexity is incredibly routine.

[cryptonector]

That's not the same. This is deferred, and looking specifically for banned content.

[AtHeartEngineer]

Occam's razor says this is not the answer

[Shivetya]

that the password passes through any filter check other than refusal for being insufficient in strength should be a red flag to anyone. that any site would flag passwords for review should be the last flag you ever need to know to not trust the site.

[mjal]

That doesn't have to be the case at all. They could send the password (plaintext, hashed or otherwise) elsewhere to get checked that just takes a little bit of time, and get some form of positive/negative response back. Or any number of similar alternatives. It's still bad, but let's not jump to conclusions.

[dirtyid]

The OP is Bethany Allen-Ebrahimian, a China reporter that's likely on the CCP shitlist. Most likely there are actions specifically targeting her account that she's conflating with general policy. Also she could... just be embellishing. As someone who follows the space, her reporting is occasionally very questionable. But my money is her account was being monitored there's a trigger to ban if she takes account changing actions. This way CCP can slowly weed out foreign reporters instead of blanket ban.

[Alex3917]

But why would they be doing that? It’s possible, but doesn’t make a lot of sense.

[ceejayoz]

> But why would they be doing that?

Because the CCP is a totalitarian state with an interest in controlling expression, even in passwords?

[FuckButtons]

Is it more likely that they want people to have nice passwords so set up filters to make sure, or that they know everyone’s password because they want to be able to see what all of China is saying to each other? I’ll continue to believe it’s the latter unless I see a better explanation.

[ceejayoz]

It's highly unlikely they need folks' passwords to "see what all of China is saying to each other". I'd fully expect the Chinese government to have full access to that, without any need for a password.

[dylan604]

Unless they assume the average Chinese user is just like the average user everywhere else on the planet which tends to reuse password in multiple locations.

[b112]

What makes more sense, is it is a fabrication, a story for twitter clickbait.

Just because WeChat does numerous, dislikable things, doesn't mean they monitor passwords. Or did this.

[vgaldikas]

I even tried to change my name too FUCK CCP, and it went ok. But then I got into a problem:

https://imgur.com/a/JbUclhL

Is there like only one xi jingling in the whole china? If not, what at others supposed to do?

[oefrha]

Others probably use Chinese characters, not a romanized version.

[baybal2]

> Is there like only one xi jingling in the whole china? If not, what at others supposed to do?

Change their surnames

[vgaldikas]

You might be right. Just to test I signed up for it, set it the exact same password, and 45 seconds is long past, but I don't appear to be banned.

[justadudeama]

I think the fact that she is a western journalist who speaks out against the CCP makes a reasonable explanation that her account is more 'watched' then the average account.

[vgaldikas]

Well I would imagine they would just automate such thing?

And why would you do fuckery with a journalists password? Seems like especially stupid thing to do

[gpm]

What makes more sense, a platform known for censorship and asshatery censored someone, or a journalist who's income relies on her reputation made up a small largely non-story that won't earn her any money but will ruin her reputation if it's proved to be false?

[oefrha]

One nice property of this largely non-story is it simply can’t be proven false; it doesn’t even come with any evidence.

[usrusr]

A caring dev sneaking in a blacklist to reduce the risk of physical harm for users who unexpectedly find themselves in a rubber hose attack?

Surely the least likely of all possible explanations, but an easter egg blocking passwords that are variations of "I refuse to cooperate" would be a hidden artistic statement in its own way.

[panpanna]

That is actually worse.

Would you trust the third party that flagged this as offensive:

F*ckCCP89

Edit: given that her account was permanently deleted after just 45 seconds, I actually think some party member working at WeChat is monitoring her activities in real-time. The password probably get him angry enough to push the permadelete button.

[andrewflnr]

Actually, the timeline indicates to me that it was automatic. Considering that they wouldn't assign someone solely to watch one journalist's account for infrequent changes, I think it's unlikely that any human saw it in the first few seconds after it happened and took it on themselves to take irrevocable action in the next second after that. My feeling is that queueing delays of various sorts took up most of the 45 seconds, but I would love to hear better ideas on that point.

Would a native Chinese speaker even have that visceral emotional reaction to English profanity? I'm curious about how that impact translates.

[BluePen7]

They don't need to have a visceral emotional reaction, they just need to know it's a strong anti-CCP sentiment. Given how frequently we use Fuck ____ in English for things we don't like (Fuck Cancer, Fuck the police, etc), it's a pretty obvious one.

I'd also assume they'd assign the english speaking North American dissidents to a monitoring person who speaks good english.

[discordance]

If the account was blocked in 45 seconds then it would be highly unlikely it was moderated by a human.

[panpanna]

But given that people have not been able to reproduce this suggests this was probably not automated.

Also, I have hard time seeing an automated system that deletes someone's account including all data for using the f-word in their password.

[hunter2_]

Maybe the people trying to reproduce it didn't already have strikes against their account and this reported could have.

[myrandomcomment]

Why? China does flag people for monitoring 24/7. Is it hard to believe that in China where the party values stability over everything else that they would not have ID people that they feel post / report unfavorably on the CCP as someone to be tracked / watch by a human at all times? The Chinese state security apparatus is quite good and has near unlimited budget and man power.

[dhimes]

Not necessarily. Could be filtering before hashing. Or saltless, and comparing against a known list of hashes (essentially cracking their own list).

[Znafon]

This is wrong for multiple reasons: they can check whether the password is offensive before hashing it and they wouldn't need your password to access your account anyway.

[kerng]

It makes perfect sense that the government gets all the cleartext passwords forwarded.

People reuse passwords, so its likely that WeChat passwords allow access to other systems (like Facebook, Twitter, Alibaba, Amazon,...)

This attack angle of just collecting passwords for government has not yet occured to me before.

[baybal2]

I'm surprised that's not being raised before. Tons of passwords in the web are still 100% plaintext on the other end of TLS connection.

And then people getting surprised from where do those ginormous plaintext password leaks come from.

All kinds of popular online forum engines were being hacked for password captures since times immemorial. PHPBB still uses server side hashing for example.

Now, for people concerned, take a look who was the party who sank crypto forms at W3C.

[justadudeama]

Not saying this isn't important data, but at some point does 2FA make this an innefective method to spy on your citizens? If I have 2FA on my Amazon, if the CCP tried to get into it I would just get a notification with a code, and do nothing except maybe change my password. Additionally, there are probably all sorts of account logs saying "this is who logged in when from what IP address" that are associated with a lot of these accounts.

Direct access via the companies themselves is probably much more valuable today.

[tialaramex]

SMS-based 2FA is pretty weak, I think you can reasonably assume that a resourceful government adversary can silently divert SMS codes intended for your phone to their systems.

In the case of China in particular we know that part of the "Great Firewall" have IP addresses associated with Chinese residential ISPs, whether those are "hijacked" or the relevant agency just asks nicely we do not know. So it may be that "Chinese central government intelligence agency" and "My neighbour's WiFi" are similar IP addresses if you live there.

But yes multi-factor authentication can reduce the impact of credential stuffing attacks.

[jordache]

No it doesn't.

WeChat service will receive the password in plaintext. It's able to do processing on that plaintext value.

It is likely storing a hashed version of the password in the database.

[duxup]

That's not accurate.

At some point all passwords are plain text, be it on the client or whatever, they could simply check it before it is encrypted and stored, even on the client end if they wanted to.

[zoomablemind]

Anyone remembers seeing green or red indicator on password strength (min num of special characters, digits). All done at the client, well, letting one to correct before accepting.

In the OP case it could be many factors added together that led to the banning.

This underscores how precious and fragile the freedom of speech is.

[erikig]

I'd be surprised if they didn't have a rainbow table of all weak passwords. The addition of offensive password checking and the ability to ban users based on their content is what's novel and alarming in this case.

[lukevp]

If they’re salting like they should then rainbow tables aren’t useful. They would just have a plaintext list of weak passwords and do a direct lookup. Rainbow tables are just a compression technique for hashed password lookups which wouldn’t work with salting.

[turboturbo]

They can check upon login.