Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

43M passwords hacked in Last.fm breach

techcrunch.com

Post reply on HN
Print view View original

81–90 of 172 posts

Re: 43M passwords hacked in Last.fm breach

#81

Post by bigiain »

tudorw wrote: post #64
bigiain wrote: post #53

Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…

why should users care ? what makes you think it's our job to make them care, we built another shitty system, it's not the users fault, asking them repeatedly to do something proven by cognitive science to be very challenging for most is just dumbness incarnate....

Exactly - why should they?

So why are we pretending they do - and requiring them to give us email addresses and set up secure passwords?

(Especially when the "upgrade password storage to something more secure than plain text or MD5" is constantly being deprioritised below "add features X, Y, and Z that the product owner claims our next three investors on our pitch schedule have Tweeted about in the last month"... "We'll 100% definitely get to it once Series A comes in. for sure! Except perhaps for the 7 million 'legacy users' we signed up with plaintext passwords during our growth hacking private investor and seed round stages...")

Re: 43M passwords hacked in Last.fm breach

#82

Post by bigiain »

kodfodrasz wrote: post #78
jcrites wrote: post #77

Earlier quoted context omitted.

It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for…

You seem obsessed with one implementation. Passwords themselves are obsolete. Actually the problem is already solved for at least a decade: Certificate based authentication. Browsers support it. Try StartSSl registration, for example.

Yeah - but that's like saying "email security and integrity has been solved for two decades", while _technically_ true, how many of you have talked your mom through setting up PGP and had her then "just use it"? (or tried to handhold a less-than-technical colleague through getting a StartSSL account?)

I'm pretty sure if any service less-technical than a CA authority starts pushing wide-spread user-driven in-browser certificate-based authentication, within days there'll be scammers and phishers faking the setup process to install untrustworthy ssl root certs so they can mitm Paypal/Facebook/everybody... How would _you_ explain to your mom the difference between installing Pinterest's new authentication certificate, and installing, say, the Charles Proxy ssl MITM cert?

Re: 43M passwords hacked in Last.fm breach

#83

Post by brian-armstrong »

123456 is actually a /fantastic/ password if you don't care what happens to the account. If you aren't going to the trouble of using a password manager, and the account doesn't mean much to you, then using weak passwords like this rather than your "good" password is a great idea. Save the entropy for your email and bank accounts.

Re: 43M passwords hacked in Last.fm breach

#84

Post by naibafo »

On that note I was just reminded that I could delete my account since I am not using it anyways anymore.

Apparently they removed that option very recently and now you can only 'close' it, which hides it but doesn't ever deletes it. :/

Re: 43M passwords hacked in Last.fm breach

#85

Post by kobayashi »

jcrites wrote: post #77
grrowl wrote: post #60

Earlier quoted context omitted.

Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for…

I'm not a big fan of Steve Gibson, but his SQRL project looked very promising to solve the issue of passwords and password storage (both user and server side).

Re: 43M passwords hacked in Last.fm breach

#86

Post by chmars »

yladiz wrote: post #61
elliotec wrote: post #59

Earlier quoted context omitted.

I've been thinking that for a while, but also how come it's never me? I've had accounts with several hacked systems and sure I try to have pretty strong passwords but... I appear to be safe every time. Famous last words maybe, but then I'll just change my password?

You may appear safe but you never know... Services like Google and Facebook are pretty proactive about making sure unknown users can't access your account easily -- meaning that if someone from Thailand tried to access your account when you usually use it in the US from an unknown device, it'll generally not allow the login. But other services aren't as proactive and may be compromised, so it's definitely better to b…

1Password is moving to its own cloud service … although you can still use the traditional app with third party syncing for now.

Re: 43M passwords hacked in Last.fm breach

#87

Post by Sammi »

DangerDOOM wrote: post #80

>Hashing is a method for encrypting data No it isn't. > MD5 is seriously out of style That's, err, one way of putting it. > The most popular password pulled from the Last.fm database was 123456. L Seriously, it’s 2016 people These accounts were made more than four years ago... > use a platform like LastPass Yeah about that... https://news.ycombinator.com/item?id=9721212 Poor reporting is poor. Why do I expect more fr…

Md5crypt Password scrambler is no longer considered safe by author: http://phk.freebsd.dk/sagas/md5crypt_eol.html

Also a better way to explain hashing algorithms to the lay person is to call them fingerprinting algorithms.

Re: 43M passwords hacked in Last.fm breach

#88

Post by yladiz »

chmars wrote: post #86
yladiz wrote: post #61

Earlier quoted context omitted.

You may appear safe but you never know... Services like Google and Facebook are pretty proactive about making sure unknown users can't access your account easily -- meaning that if someone from Thailand tried to access your account when you usually use it in the US from an unknown device, it'll generally not allow the login. But other services aren't as proactive and may be compromised, so it's definitely better to b…

1Password is moving to its own cloud service … although you can still use the traditional app with third party syncing for now.

Really? That's one of the main reasons I chose 1Password... Here's to hoping they keep both ways to sync!

Re: 43M passwords hacked in Last.fm breach

#90

Post by camtarn »

grrowl wrote: post #60
bigiain wrote: post #53

Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…

Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

It's worth pointing out that in this particular case, some people will have created their Last.fm accounts more or less solely for use with Audioscrobbler, a protocol which allows them to track music listens through various third-party music players.

The important bit about that is that the Last.fm/Audioscrobbler account credentials get typed directly into the third-party players - usually there's no browser involved in authentication, and in some cases the players will also be on a mobile device.

There's a definite incentive for passwords to be simple (if you're going to type them in on a mobile keyboard) and weak (because it's just music metadata).

So, a 'magic link' style of logging in might work here, but it would have to be complemented by an easy way of generating auth tokens for player apps - for instance, short one-time-use codes that expire quickly.

Post reply on HN