RM Easymail - bad password storage policy

[mats]

RM are enforcing a new password policy for schools unfortunate enough to still be using easymail. Today, they emailed all users whose passwords don't meet their minimum standard.

 

That's all well and good (and sensible, given some of the passwords our users use), but how do RM know whose password doesn't meet their standard? They must either store passwords using a reversible encryption method, or be storing plaintext. I thought both were a bad idea - come on RM, it's not that hard to do it properly these days!

[edutech4schools]

It might not work like that. When I access our Google Apps for Education admin page the system lists how secure a password is with a colour, so if a user has used some of the recommended security settings in their password they will get an amber colour etc. I can then mail those users or click reset password.

[mats]

It might not work like that. When I access our Google Apps for Education admin page the system lists how secure a password is with a colour, so if a user has used some of the recommended security settings in their password they will get an amber colour etc. I can then mail those users or click reset password.

 

That sounds like the password is checked when it's created and a measure of it's security is stored at that point. The RM one is more like 'we have a problem with hackerz using our smtp servers. Oh, look, lots of our passwords are insecure.'. It's a fairly old system.

[witch]

I have two schools on easymail and am yet to receive any such email

Has anyone else got one?

I've just spoken to them and yes, it is indeed true

 

I've spent 4 months getting everyone's emails to migrate to Office 365 but the boss hasn't yet switched it on.

So now I am going to have to get all 55 staff member's new password

Oh Joy

Edited June 18, 2014 by witch

[mpe]

That sounds like the password is checked when it's created and a measure of it's security is stored at that point. The RM one is more like 'we have a problem with hackerz using our smtp servers. Oh, look, lots of our passwords are insecure.'. It's a fairly old system.

 

The most obvious issue with the "easy"mail system is the lack of encryption on the webmail, IMAP and SMTP auth they are using.

Ideally they should be using non CA signed certs for IMAPS(993) and SUBMISSION(587) since CA signed certs are considerably more vulnerable to undetectable MitM. (Very few apps will flag a change of cert if both are signed by a CA, even a different CA. Just about all of them will if a non CA signec ert changes for ANY reason.)

[mats]

I have two schools on easymail and am yet to receive any such email

Has anyone else got one?

I've just spoken to them and yes, it is indeed true

 

I've spent 4 months getting everyone's emails to migrate to Office 365 but the boss hasn't yet switched it on.

So now I am going to have to get all 55 staff member's new password

Oh Joy

 

I think that you only get the email if your password is too weak - you might be lucky.

[mats]

@mpe - it does have the feel of an old system ready for retirement (see also smartcache) so I'm not expecting updates any time soon. Devs too busy on Neon I reckon.

[mpe]

Unfortunately by their spec my password is too weak

 

Wonder if they have ever seen xkcd: Password Strength

[OB1]

Wonder if they have ever seen xkcd: Password Strength

Or Bruce Schneier's take.