43M passwords hacked in Last.fm breach • Hacker News Board

Re: 43M passwords hacked in Last.fm breach

#141

Post by vidarh » Fri, Sep 02, 2016, 2:17 PM UTC

CWuestefeld wrote: post #134

Question about password best practices. Our site just went through pen testing, as part of auditing for PCI compliance. One thing we got dinged on was that we don't keep a password history, so that the user can't revert to their previous password. The tester's report said, "This, in turn, results in users utilizing a single password for a long period of time, which may result in password disclosure" It seems to me th…

Consider that leaking their past passwords only matters if they reuse them elsewhere.

If they reuse passwords, then chances are you will expose them just as much if you don't force them to rotate passwords, when they end up putting their password into a scam site or run by people who store plain text.

And if you don't check for reuse, you are not forcing them to rotate passwords.

In the face of that, you can't do much better than to make it harder for them to keep reusing passwords on your site so at least a password leak elsewhere won't expose their account with you.

(And re-using the salt is a mistake; don't do that)

Re: 43M passwords hacked in Last.fm breach

#142

Post by vidarh » Fri, Sep 02, 2016, 2:23 PM UTC

atdt wrote: post #132

brian-armstrong wrote: post #83

123456 is actually a /fantastic/ password if you don't care what happens to the account. If you aren't going to the trouble of using a password manager, and the account doesn't mean much to you, then using weak passwords like this rather than your "good" password is a great idea. Save the entropy for your email and bank accounts.

I see your point, but 123456 is still a stupid password. A brain-dead password scheme like "1 " (e.g., "1 Snuggles last.fm") is just as easy to remember, won't show up in rainbow tables, is nominally difficult to brute force, and you're more likely to be able to use it, as opposed to '123456', which many sites will balk at. (To be clear: I am not endorsing this scheme. It is superior to '123456', but it is still bone…

The point is that you should only use this kind of password in places where you really do not care about someone else getting access.

It doesn't really matter what it is. It matters that it's something you're not for a moment tempted to think of as a "real" password and that you would never dream of using for any account where a data leak would affect you, but merely as a "they're stupidly asking me for a password for an account I don't care about, so lets just give them this" token.

I'd lean towards agreeing with you that it's better to pick something else, but only to slightly reduce the inconvenience of someone messing with your account "just because".

Re: 43M passwords hacked in Last.fm breach

#143

Post by theandrewbailey » Fri, Sep 02, 2016, 2:31 PM UTC

brian-armstrong wrote: post #83

123456 is actually a /fantastic/ password if you don't care what happens to the account. If you aren't going to the trouble of using a password manager, and the account doesn't mean much to you, then using weak passwords like this rather than your "good" password is a great idea. Save the entropy for your email and bank accounts.

"Saving" entropy is ridiculous. It is literally everywhere, always growing, and can be called up on demand. Random password generators are a thing.

Re: 43M passwords hacked in Last.fm breach

#144

Post by kodt » Fri, Sep 02, 2016, 2:32 PM UTC

guard-of-terra wrote: post #98

New passwords must: Be at least six characters long Contain one or more numbers Include at least one of the following special characters: !"#$%&'()*+,-./:; ?@[\]^_`{|}~, or a space There's no way I'll remember a last.fm password like that! :(

Password managers are a must these days.

Re: 43M passwords hacked in Last.fm breach

#145

Post by tombert » Fri, Sep 02, 2016, 2:32 PM UTC

CWuestefeld wrote: post #134

Question about password best practices. Our site just went through pen testing, as part of auditing for PCI compliance. One thing we got dinged on was that we don't keep a password history, so that the user can't revert to their previous password. The tester's report said, "This, in turn, results in users utilizing a single password for a long period of time, which may result in password disclosure" It seems to me th…

PCI Compliance is kind of arbitrary. I once worked for a company that kept all their passwords in plain text, and still managed to get compliance. I was just an intern at the time, and I still thought that was kind of weird, especially since this was around 2011 and not the mid-90's.

Re: 43M passwords hacked in Last.fm breach

#146

Post by chriswarbo » Fri, Sep 02, 2016, 2:40 PM UTC

josteink wrote: post #109

> it’s 2016 people — use a platform like LastPass to generate randomized, complex passwords that are unique to every service for which you sign up. Another way to read this statement is that passwords simply doesn't work. We need something different. Something better. And from the comments we find this: > I am a bit confused. The article states that this happened in 2012, why is it posted today? Something happened in…

> The number of passwords and the severity of the hack were not uncovered until today. The passwords were stored using unsalted MD5 hashing.

Re: 43M passwords hacked in Last.fm breach

#147

Post by theandrewbailey » Fri, Sep 02, 2016, 2:41 PM UTC

amq wrote: post #89

Is it really that difficult to upgrade all passwords with something like bcrypt(original md5)?

It's not that it's difficult; it's not a good idea. It does not increase randomness (entropy), and would probably decrease it. In that situation, update the hash with a new method upon login.

Re: 43M passwords hacked in Last.fm breach

#148

Post by guard-of-terra » Fri, Sep 02, 2016, 2:56 PM UTC

kodt wrote: post #144

guard-of-terra wrote: post #98

New passwords must: Be at least six characters long Contain one or more numbers Include at least one of the following special characters: !"#$%&'()*+,-./:; ?@[\]^_`{|}~, or a space There's no way I'll remember a last.fm password like that! :(

Password managers are a must these days.

I have several devices and enjoy being sometimes login on stray device I don't own.

Re: 43M passwords hacked in Last.fm breach

#149

Post by ryan-c » Fri, Sep 02, 2016, 3:01 PM UTC

Nadya wrote: post #133

grrowl wrote: post #60

Earlier quoted context omitted.

Emailing a single-use "sign in link" to a user (Slack calls these "Magic Links") is the way forward. Yes, it move the single point of failure to the user's email account, but expecting the regular user to use (and remember) unique passwords for each service is impossible -- they simply won't do it. Plus, when/if your service is breached, you won't compromise all their other accounts as well.

>Yes, it move the single point of failure to the user's email account That is already the case for the supermajority of people. They use one email account for everything and you can simply "Recover Password" on various services once you gain access to their email account. Not many people purposefully use unique, individual email addresses for every single service they sign up for...

> Not many people purposefully use unique, individual email addresses for every single service they sign up for...

When they do, generally email for all of them ends up in the same account anyway.

Re: 43M passwords hacked in Last.fm breach

#150

Post by lostcolony » Fri, Sep 02, 2016, 3:04 PM UTC

throwawayReply wrote: post #103

jcrites wrote: post #77

Earlier quoted context omitted.

It's really a shame that we haven't solved this problem yet as an industry. I was thinking we could build a general purpose version of "Magic Links" for logging in, where the format of the email is well-defined, and the user's browser is able to receive these messages on their behalf through some form of integration. You could imagine a webmail provider offering some kind of polling or websocket API for listening for…

This has some advantages but there are negatives too. Do I really want Google or Facebook to get a notification every single time I log in to a service because they get an email with a "magic link"? Google / Facebook already know enough about services used, do we really want to transfer even more information their way? Also, another trouble with this is the loss of anonymity. There are very few places to register an…

Mail.com? Outlook.com? A lot of them, if you provide an SMS number, you'll need to verify it, but you can skip it by providing security questions or an alternate email address (that itself does not need to be verified).