A miscommunication issue with a member and a functionality issue with a new website feature have dogged the National Union of Journalists (NUJ) in recent days.
Journalist and NUJ member Kate Bevan told IT Security Guru that, after she had initially used a seven-character password to renew her press card, she was told this was too long and needed to “send the password by email”.
Bevan said: “You should never use anyone’s credentials but your own to log in anywhere. You should never share passwords. You should never ask for a password. And you should never send passwords by email.”
The NUJ later confirmed that this was a mistake, and a six-character PIN should have been requested, and that the NUJ will never ask member to supply their login password. The PIN is set by the member should the member be checked by the police and need verification of their identity.
However the NUJ acknowledged problems in the amount of text which can be entered, which it said it was aware of.
Bevan said that despite being told that she could only enter a 4-6 digit password, she was able to enter a 20-digit PIN without a murmur! She told IT Security Guru that most people won’t pick a random selection of numbers – they’ll use something meaningful, like a birthday or a phone number that they’ll probably use elsewhere. “That kind of thing is always valuable to a bad guy.”
In a statement, the NUJ said it will never ask for union members to supply their login password. “There was a miscommunication with a member of staff at the NUJ last week, where a member had supplied an incompatible 20 character PIN number for the press card verification hotline,” it said. “When requesting a new 4-6 character pin the word password was used, this led to the confusion.”
Security researcher Troy Hunt told IT Security Guru that when you’re only working with logins of up to six digits, hashing and salting would be useless anyway. “Keeping in mind you can calculate about 2.5 billion SHA1 hashes a second, even thousands of iterations of the hash would be near useless with such a small key space.”
