43M passwords hacked in Last.fm breach • Hacker News Board

Re: 43M passwords hacked in Last.fm breach

#21

Post by dogma1138 » Fri, Sep 02, 2016, 1:09 AM UTC

StavrosK wrote: post #20

It looks like our current approach isn't working. What if we had each site publish its login/registration endpoints in a URL, e.g. .well-known/loginurls? Then the password manager could detect you're trying to register or log in and log you in itself, generating your password in the process. Why aren't logins machine-accessible yet?

Password managers already do that, they just check for password type field and the site.

Keepass does that pretty sure all the others also do.

But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.

Re: 43M passwords hacked in Last.fm breach

#22

Post by matt_wulfeck » Fri, Sep 02, 2016, 1:16 AM UTC

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc.

This drastically reduces the amount of valid logins from a dump that's even just a few days old.

2factor is simply not enough (though I still want it for important logins). Automatic password changing would be complimentary.

Re: 43M passwords hacked in Last.fm breach

#23

Post by joecool1029 » Fri, Sep 02, 2016, 1:17 AM UTC

anexprogrammer wrote: post #16

rawrmaan wrote: post #6

Earlier quoted context omitted.

Wow! They had some great growth going on and it seemed to hit a wall hard around 2008-2009. Any idea why?

Easy. CBS bought them late 2007. Dev and updates pretty much stopped. They limited tracks you could play directly. Then they killed radio. I'm really sad to see it die, it was better at introducing me to new artists than any other service before or since, and the radio was brilliant.

Oh you must have left awhile ago then. I agree they ruined the best music discovery service on the web, but even without it the site was dated but functional.. until last year.

Last year CBS decided the whippersnappers needed a redesign and took out around 80% of the features and put the site into a perpetual beta state.

Re: 43M passwords hacked in Last.fm breach

#24

Post by prawn » Fri, Sep 02, 2016, 1:17 AM UTC

dogma1138 wrote: post #21

StavrosK wrote: post #20

It looks like our current approach isn't working. What if we had each site publish its login/registration endpoints in a URL, e.g. .well-known/loginurls? Then the password manager could detect you're trying to register or log in and log you in itself, generating your password in the process. Why aren't logins machine-accessible yet?

Password managers already do that, they just check for password type field and the site. Keepass does that pretty sure all the others also do. But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.

Who wants to be helping every relative set them up and adding to the unpaid support load? So they get mentioned in passing and then people think "Yes, I should do that" and never bother.

Same thing happens with backups.

Re: 43M passwords hacked in Last.fm breach

#25

Post by GolDDranks » Fri, Sep 02, 2016, 1:19 AM UTC

dogma1138 wrote: post #21

StavrosK wrote: post #20

It looks like our current approach isn't working. What if we had each site publish its login/registration endpoints in a URL, e.g. .well-known/loginurls? Then the password manager could detect you're trying to register or log in and log you in itself, generating your password in the process. Why aren't logins machine-accessible yet?

Password managers already do that, they just check for password type field and the site. Keepass does that pretty sure all the others also do. But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.

I started using LastPass just the other day because the recent news made me nervous.

It's NOT easy. The interfaces are clunky. I have to pay to get some basic features like browser plugin. There's a lot of false positives (it suggests me sometimes to save a password even if the field is not for passwords.) Generating secure passwords is hard because some sites validate length and charset only serverside and the poor manager has the invalid password already saved. Some sites play tricks to discourage pasting passwords. More than once I was unable to log in LastPass's online vault because of an "temporary error".

All in all, it was horrible, ergonomy-wise. I don't wonder at all why people aren't using them.

Re: 43M passwords hacked in Last.fm breach

#26

Post by dogma1138 » Fri, Sep 02, 2016, 1:23 AM UTC

matt_wulfeck wrote: post #22

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc. This drastically reduces the amount of valid logins from a dump that's even just a few days old. 2factor is simply not enough (though I still want it for impor…

>I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login.

There isn't really a need for a standardized API it would make things easier but if 1password wanted it's not a very hard thing to do without it.

All you need is to do an HTTP request to change the password most sites allow that to be done in a single request, CSRF might be an issue but non single action forms are usually not protected or there is no need for that and there are ways to bypass CSRF also.

For a company like 1password it wouldn't be hard to build a request profile for say Alexa 500/1000 and automatically change the passwords once a breach hits, I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry.

Re: 43M passwords hacked in Last.fm breach

#27

Post by dogma1138 » Fri, Sep 02, 2016, 1:24 AM UTC

GolDDranks wrote: post #25

dogma1138 wrote: post #21

Earlier quoted context omitted.

Password managers already do that, they just check for password type field and the site. Keepass does that pretty sure all the others also do. But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.

I started using LastPass just the other day because the recent news made me nervous. It's NOT easy. The interfaces are clunky. I have to pay to get some basic features like browser plugin. There's a lot of false positives (it suggests me sometimes to save a password even if the field is not for passwords.) Generating secure passwords is hard because some sites validate length and charset only serverside and the poor…

Keepass is free albit there is no sync unless you set it up yourself, and paying for feature is the nature of commercial products.

The majority of open source products tend to have pretty shitty UI/UX =)

Re: 43M passwords hacked in Last.fm breach

#28

Post by ramblenode » Fri, Sep 02, 2016, 1:26 AM UTC

> The passwords were stored using unsalted MD5 hashing

Ouch.

I guess on the bright side it won't be long before researchers have a new dataset of plaintext passwords.

Re: 43M passwords hacked in Last.fm breach

#29

Post by wonder_er » Fri, Sep 02, 2016, 1:27 AM UTC

GolDDranks wrote: post #25

dogma1138 wrote: post #21

Earlier quoted context omitted.

Password managers already do that, they just check for password type field and the site. Keepass does that pretty sure all the others also do. But again what problem are you trying to solve? using password managers is easy as pie today including automating signup and generating passwords, most people do not use them.

I started using LastPass just the other day because the recent news made me nervous. It's NOT easy. The interfaces are clunky. I have to pay to get some basic features like browser plugin. There's a lot of false positives (it suggests me sometimes to save a password even if the field is not for passwords.) Generating secure passwords is hard because some sites validate length and charset only serverside and the poor…

You're totally right. I use 1password, love it, couldn't live without it, but forgot how unintuitive and tricky it is, until I helped my wife get setup on it.

It took a while just to get up and running with the app/browser plugin/her own account, and now it's going to take a while for it to be part of her regular workflow.

The very first login I gave her (online banking) had such a bad interface 1Password couldn't auto-login.

So the next lesson was "how to work around bad website UIs, using a variety of non-intuitive menus and keyboard shortcuts".

We both use Dropbox to sync our vaults, so then I was talking to her about 2FA (pro/cons for text vs. Google Authenticator app), off-line recovery codes, an appropriate 1pass master password, etc.

There's no way she'd happen across a PW manager and love it. She's using it only because I want her to have access to all our online financials, all of which have long randomly-generated passwords.

I wish you luck! FWIW, I've found 1Password to be consistently better than LastPass.

Re: 43M passwords hacked in Last.fm breach

#30

Post by Alex3917 » Fri, Sep 02, 2016, 1:30 AM UTC

We really need some laws around this... Prison time for web developers that store passwords insecurely, and substantial fines for anyone whose password can be brute forced from one of these leaks.