Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

43M passwords hacked in Last.fm breach

techcrunch.com

Post reply on HN
Print view View original

31–40 of 172 posts

Re: 43M passwords hacked in Last.fm breach

#31

Post by rhizome »

joecool1029 wrote: post #23
anexprogrammer wrote: post #16

Earlier quoted context omitted.

Easy. CBS bought them late 2007. Dev and updates pretty much stopped. They limited tracks you could play directly. Then they killed radio. I'm really sad to see it die, it was better at introducing me to new artists than any other service before or since, and the radio was brilliant.

Oh you must have left awhile ago then. I agree they ruined the best music discovery service on the web, but even without it the site was dated but functional.. until last year. Last year CBS decided the whippersnappers needed a redesign and took out around 80% of the features and put the site into a perpetual beta state.

Could have been worse, they could have hired the guy who redid Flickr and Chowhound.

Re: 43M passwords hacked in Last.fm breach

#32

Post by whorleater »

matt_wulfeck wrote: post #22

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc. This drastically reduces the amount of valid logins from a dump that's even just a few days old. 2factor is simply not enough (though I still want it for impor…

Automatic password changing would be a mess if you ever got locked out of your password manager, combined with the fact that if the protocol for password changing was to be breached, you'd be locked out of that account as well.

Re: 43M passwords hacked in Last.fm breach

#33

Post by allendoerfer »

dogma1138 wrote: post #26
matt_wulfeck wrote: post #22

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc. This drastically reduces the amount of valid logins from a dump that's even just a few days old. 2factor is simply not enough (though I still want it for impor…

>I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. There isn't really a need for a standardized API it would make things easier but if 1password wanted it's not a very hard thing to do without it. All you need is to do an HTTP request to change the password most sit…

>I have a similar setup of several scripts that update the password for various services I have by generating a random password in Keepass getting the old password sending the password request post and updating the Keepass entry.

You would benefit from open-sourcing them, so others could help you keep up with websites changing.

Re: 43M passwords hacked in Last.fm breach

#34

Post by sosborn »

Alex3917 wrote: post #30

We really need some laws around this... Prison time for web developers that store passwords insecurely, and substantial fines for anyone whose password can be brute forced from one of these leaks.

> Prison time for web developers that store passwords insecurely

What a terrible idea.

Re: 43M passwords hacked in Last.fm breach

#35

Post by anexprogrammer »

joecool1029 wrote: post #23
anexprogrammer wrote: post #16

Earlier quoted context omitted.

Easy. CBS bought them late 2007. Dev and updates pretty much stopped. They limited tracks you could play directly. Then they killed radio. I'm really sad to see it die, it was better at introducing me to new artists than any other service before or since, and the radio was brilliant.

Oh you must have left awhile ago then. I agree they ruined the best music discovery service on the web, but even without it the site was dated but functional.. until last year. Last year CBS decided the whippersnappers needed a redesign and took out around 80% of the features and put the site into a perpetual beta state.

Didn't really give up until they had the fabulous idea to replace direct streaming with playing poor match Youtube videos as radio. That killed radio finally and made a none functioning joke of the main reason I bought my network music player.

Was mad about that as Last radio was my first choice for work listening.

The site was dated as they were frozen in 2008 - After CBS bought them there was one update very soon after then the site didn't change at all until last year. Minor updates and bug fixes only.

As for the update last year, pretty and vacant, doesn't bring back the things I loved about the site, but lets me see lots of pretty graphs of things I'm not interested in. I took a look at libre fm after that, but that's even more abandoned.

Re: 43M passwords hacked in Last.fm breach

#36

Post by [deleted] »

matt_wulfeck wrote: post #22

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc. This drastically reduces the amount of valid logins from a dump that's even just a few days old. 2factor is simply not enough (though I still want it for impor…

[deleted]

Re: 43M passwords hacked in Last.fm breach

#37

Post by 001spartan »

Alex3917 wrote: post #30

We really need some laws around this... Prison time for web developers that store passwords insecurely, and substantial fines for anyone whose password can be brute forced from one of these leaks.

As someone who has very strong feelings about sites not letting me choose secure passwords, or storing them insecurely...no.

Fines for storing passwords insecurely and getting breached, sure. This is already handled by PCI/HIPAA, but could definitely stand to be improved. Prison time? There's no possible way that would end well.

Fines for "anyone whose password can be brute forced from one of these leaks"? So that means 80% of people out there would be given "substantial fines". Not going to happen.

Re: 43M passwords hacked in Last.fm breach

#38

Post by Alex3917 »

001spartan wrote: post #37
Alex3917 wrote: post #30

We really need some laws around this... Prison time for web developers that store passwords insecurely, and substantial fines for anyone whose password can be brute forced from one of these leaks.

As someone who has very strong feelings about sites not letting me choose secure passwords, or storing them insecurely...no. Fines for storing passwords insecurely and getting breached, sure. This is already handled by PCI/HIPAA, but could definitely stand to be improved. Prison time? There's no possible way that would end well. Fines for "anyone whose password can be brute forced from one of these leaks"? So that me…

> So that means 80% of people out there would be given "substantial fines". Not going to happen.

How is that any different than giving speeding tickets? If you behave recklessly in a way that puts others at risk, you should have to make restitution to society.

Re: 43M passwords hacked in Last.fm breach

#39

Post by NamTaf »

I spent 3 days off work a few weeks ago watching the Dota International and spent the whole time searching through my emails for 'account', 'registration', etc. trying to find everything I'd ever signed up to and finally move it all to a password manager because I really knew better and was lazy for the past several years. It took 3 days of like 6 hours a day half doing this to update all that I could think of and find. That ended up being about 150 passwords in total.

Even still, I missed last.fm and probably a whole host of other ones that I'll never remember. Passwords are a goddamn nightmare.

Re: 43M passwords hacked in Last.fm breach

#40

Post by niftich »

dogma1138 wrote: post #26
matt_wulfeck wrote: post #22

I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. Or I can schedule them all to be updated every day, etc. This drastically reduces the amount of valid logins from a dump that's even just a few days old. 2factor is simply not enough (though I still want it for impor…

>I would like to see websites make password changing a simple and standardized API call. That way integration with things like 1password will allow it to automatically change the password with each login. There isn't really a need for a standardized API it would make things easier but if 1password wanted it's not a very hard thing to do without it. All you need is to do an HTTP request to change the password most sit…

LastPass scripted this [1] for their product.

[1] https://blog.lastpass.com/2014/12/introducing-auto-password-...

Post reply on HN