Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

43M passwords hacked in Last.fm breach

techcrunch.com

Post reply on HN
Print view View original

131–140 of 172 posts

Re: 43M passwords hacked in Last.fm breach

#131

Post by GurnB »

anoonmoose wrote: post #15
sotojuan wrote: post #7

Earlier quoted context omitted.

How is Last.fm one of your favorite sites after that horrible redesign that erased tons of user-generated content?

Because it still does exactly what I want it to do, and what I've wanted it to do since I signed up in 2004, which is keep logs of every song that I listen to. The user-generated content side of it was added after I signed up (I think?) so I don't see how I could really miss it. 230K songs since 2004. http://www.last.fm/user/ryxxui

173K Songs since Nov 2004. http://www.last.fm/user/GurnB But I took 4 or 5 years off.

Re: 43M passwords hacked in Last.fm breach

#132

Post by atdt »

brian-armstrong wrote: post #83

123456 is actually a /fantastic/ password if you don't care what happens to the account. If you aren't going to the trouble of using a password manager, and the account doesn't mean much to you, then using weak passwords like this rather than your "good" password is a great idea. Save the entropy for your email and bank accounts.

I see your point, but 123456 is still a stupid password. A brain-dead password scheme like "1 " (e.g., "1 Snuggles last.fm") is just as easy to remember, won't show up in rainbow tables, is nominally difficult to brute force, and you're more likely to be able to use it, as opposed to '123456', which many sites will balk at.

(To be clear: I am not endorsing this scheme. It is superior to '123456', but it is still bone-headed.)

Re: 43M passwords hacked in Last.fm breach

#133

Post by Nadya »

grrowl wrote: post #60
bigiain wrote: post #53

Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…

Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

>Yes, it move the single point of failure to the user's email account

That is already the case for the supermajority of people. They use one email account for everything and you can simply "Recover Password" on various services once you gain access to their email account.

Not many people purposefully use unique, individual email addresses for every single service they sign up for...

Re: 43M passwords hacked in Last.fm breach

#134

Post by CWuestefeld »

Question about password best practices. Our site just went through pen testing, as part of auditing for PCI compliance.

One thing we got dinged on was that we don't keep a password history, so that the user can't revert to their previous password. The tester's report said, "This, in turn, results in users utilizing a single password for a long period of time, which may result in password disclosure"

It seems to me that this is the opposite of the truth. If I'm keeping a password history, then in the event of a breach, there is that much more data that would leaking, potentially disclosing password data if we made a mistake in the rest of how we handle it (hashing, etc.). And while I'm not a crypto expert at all, it seems to me that if there's a list of salted, hashed passwords, then given that the salt is a constant per user, an attacker would have some leg up in discovering the original password if there were many samples that included the same salt.

If I want to minimize the data I can disclose about users, I ought to minimize the amount of data that I'm storing about them.

Re: 43M passwords hacked in Last.fm breach

#135

Post by Flenser »

CWuestefeld wrote: post #134

Question about password best practices. Our site just went through pen testing, as part of auditing for PCI compliance. One thing we got dinged on was that we don't keep a password history, so that the user can't revert to their previous password. The tester's report said, "This, in turn, results in users utilizing a single password for a long period of time, which may result in password disclosure" It seems to me th…

"given that the salt is a constant per user"

Just use a different salt for each password, not each user

Edit: You're probably right about everything else.

Re: 43M passwords hacked in Last.fm breach

#136

Post by nathanaldensr »

finchisko wrote: post #122

The tragicomic part is how they enforcing password complexity: Your password is not strong enough. New passwords must: Be at least six characters long Contain one or more numbers Include at least one of the following special characters: !"#$%&'()*+,-./:; ?@[\]^_`{|}~, or a space So password efZeLmur3ivio4t7 is not safe enough to be used by last.fm and they use md5 without salt to protect it?

A password that follows that "security scheme" is pass1!, which KeePass 2 reports as having a quality of 18 bits. efZeLmur3ivio4t7, an illegal password, has a quality of 86 bits. Whoever was responsible for that decision should be fired. Either implement a real password strength algorithm based on entropy, or don't implement any except maybe minimum length.

Re: 43M passwords hacked in Last.fm breach

#137

Post by discordance »

grrowl wrote: post #60
bigiain wrote: post #53

Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…

Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

If you're going to recommend emailed 'magic links', then might as well use Google/Facebook/etc as an SSO indentity provider

Re: 43M passwords hacked in Last.fm breach

#138

Post by theandrewbailey »

bigiain wrote: post #82
kodfodrasz wrote: post #78

Earlier quoted context omitted.

You seem obsessed with one implementation. Passwords themselves are obsolete. Actually the problem is already solved for at least a decade: Certificate based authentication. Browsers support it. Try StartSSl registration, for example.

Yeah - but that's like saying "email security and integrity has been solved for two decades", while _technically_ true, how many of you have talked your mom through setting up PGP and had her then "just use it"? (or tried to handhold a less-than-technical colleague through getting a StartSSL account?) I'm pretty sure if any service less-technical than a CA authority starts pushing wide-spread user-driven in-browser c…

> (or tried to handhold a less-than-technical colleague through getting a StartSSL account?)

I tried getting one myself a few years ago, and I couldn't. The process was too obtuse and obscure for me to follow along the entire way.

Re: 43M passwords hacked in Last.fm breach

#139

Post by donatj »

ultramancool wrote: post #126
bigiain wrote: post #53

Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…

What on last.fm ever needs a secure password though? Maybe someone can listen to my premium radio if I paid for it, or scrobble as me, but I really don't care about either of those. As a user, a less secure password for sites that need less security just makes sense.

See, I disagree. I think scrobbling is Last.fm's biggest feature and it's important for them to keep it accurate. I would be devastated if someone messed up my scrobbles, I've been scrolling for 10 years and have amassed very nice statistics about my listening habits. On top of that I have to imagine they sell this data to record companies and the less accurate the data the less valuable.

Re: 43M passwords hacked in Last.fm breach

#140

Post by theandrewbailey »

zer0gravity wrote: post #74
bigiain wrote: post #53

Regular reminder that new users in general don't care at all about the security of your site. Most of your signups are not going to generate and store a secure password "just to try you out", as evidenced by the most common password here "123456". If you force people to signup to try your site/app, many (most?) of them are going to use a crap password. If you're _lucky_ that'll be 123456, and not their email/facebook…

The security model based on passwords kept by site provider is totally broken. I, as a user, don't want to keep 20 different passwords for 20 different sites. What I want, is host my own security agent through which I can talk with any site. If I want to authenticate with site x, I simply point it to my security agent url and that's that. Open ID was/is an idea. This approach will drastically lower the incentive for…

That's the idea behind cloud free password managers (like KeePass) and their browser plugins.
Post reply on HN