Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

43M passwords hacked in Last.fm breach

techcrunch.com

Post reply on HN
Print view View original

111–120 of 172 posts

Re: 43M passwords hacked in Last.fm breach

#111

Post by wepple »

grrowl wrote: post #60
bigiain wrote: post #53

Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…

Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

> Yes, it move the single point of failure to the user's email account

This isn't even that greater of a concern; it currently is in 99% of cases the method for password reset anyhow.

Re: 43M passwords hacked in Last.fm breach

#112

Post by drdaeman »

jstanley wrote: post #108
throwawayReply wrote: post #103

Earlier quoted context omitted.

This has some advantages but there are negatives too. Do I really want Google or Facebook to get a notification every single time I log in to a service because they get an email with a "magic link"? Google / Facebook already know enough about services used, do we really want to transfer even more information their way? Also, another trouble with this is the loss of anonymity. There are very few places to register an…

> There are few places to get an SMS without a real name and address. I'm building a service to solve this problem right now. It works already and I hope to make it live within the month, it just wants styling and polishing. The idea is you sign up with just a username and password, no email address required. You pay with Bitcoin and can buy a mobile phone number, from a selection of countries, for ~$3/mo. You can th…

Do you have any domain name (even if it has no webserver yet) or some pre-launch page to bookmark?

Don't need such service now, but I had accidental necessity in past few years.

(Also, please consider submitting it to HN when you go live.)

Re: 43M passwords hacked in Last.fm breach

#113

Post by borplk »

Alex3917 wrote: post #30

We really need some laws around this... Prison time for web developers that store passwords insecurely, and substantial fines for anyone whose password can be brute forced from one of these leaks.

How about prison time for people who don't use password managers and re-use passwords?

Re: 43M passwords hacked in Last.fm breach

#114

Post by witty_username »

bigiain wrote: post #53

Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…

OpenID registration is the solution to this problem.

Re: 43M passwords hacked in Last.fm breach

#115

Post by drdaeman »

kodfodrasz wrote: post #78
jcrites wrote: post #77

Earlier quoted context omitted.

It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for…

You seem obsessed with one implementation. Passwords themselves are obsolete. Actually the problem is already solved for at least a decade: Certificate based authentication. Browsers support it. Try StartSSl registration, for example.

Sadly, it's only theoretically solved.

Browser vendors have refused to touch that for years, so everything PKI-related has a cryptic UI hidden beneath 3+ clicks deep in the most obscure settings dialog areas. And some pieces are completely missing, like session state management (it's just like with HTTP auth - there are hacks to implement it, but they're hacks).

Another issue is, with current implementations not really fancying the idea of CA-less self-signed client certificates, so you'll most probably need a certificate-per-site approach. And with a ton of certificates (even if they all for the same public key), you'll need to automatically sync them to another devices somehow.

(The usual reasoning for not doing anything I saw was "no one uses this". Sure thing, given it's barely usable.)

Re: 43M passwords hacked in Last.fm breach

#116

Post by scrollaway »

kijin wrote: post #48
StavrosK wrote: post #20

It looks like our current approach isn't working. What if we had each site publish its login/registration endpoints in a URL, e.g. .well-known/loginurls? Then the password manager could detect you're trying to register or log in and log you in itself, generating your password in the process. Why aren't logins machine-accessible yet?

I made a similar proposal 3 years ago and submitted it to HN. There was a bit of interest, but a lot of people back then seemed to assume that passwords were going the way of the dinosaur anyway so why bother? https://news.ycombinator.com/item?id=5743057 Now that Persona is defunct and there is no privacy-respecting alternative in sight, perhaps we can finally acknowledge the truth that passwords are here to stay for…

Dan Callahan, former developer on Persona, is currently leading development on Portier which will hopefully be a successor.

https://github.com/portier

Re: 43M passwords hacked in Last.fm breach

#117

Post by drdaeman »

bigiain wrote: post #82
kodfodrasz wrote: post #78

Earlier quoted context omitted.

You seem obsessed with one implementation. Passwords themselves are obsolete. Actually the problem is already solved for at least a decade: Certificate based authentication. Browsers support it. Try StartSSl registration, for example.

Yeah - but that's like saying "email security and integrity has been solved for two decades", while _technically_ true, how many of you have talked your mom through setting up PGP and had her then "just use it"? (or tried to handhold a less-than-technical colleague through getting a StartSSL account?) I'm pretty sure if any service less-technical than a CA authority starts pushing wide-spread user-driven in-browser c…

> How would _you_ explain to your mom the difference between installing Pinterest's new authentication certificate

Actually, even with current terrible UIs, there's a reasonably big difference between installing client certificate (there even used to be a HTML tag for those - although it's unsurprisingly marked as "deprecated" now) and trusted CAs.

Re: 43M passwords hacked in Last.fm breach

#119

Post by Naga »

Maybe now I can get access to my account. I forgot my password and tried to jump through their hoops to reaccess my account. They involved calling the support department during business hours. It was the holiday season, so I just gave up.

Re: 43M passwords hacked in Last.fm breach

#120

Post by pjc50 »

kodfodrasz wrote: post #78
jcrites wrote: post #77

Earlier quoted context omitted.

It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for…

You seem obsessed with one implementation. Passwords themselves are obsolete. Actually the problem is already solved for at least a decade: Certificate based authentication. Browsers support it. Try StartSSl registration, for example.

Client certificates tie the user to a specific device, which is terrible. It just moves the problem back to "account recovery".
Post reply on HN