Live data from Hacker News

Notice of Data Breach

content.myfitnesspal.com

51–60 of 160 posts

Re: Notice of Data Breach

#51

I use my Facebook as the login mechanism for MyFitnessPal, I wonder if that means my Facebook password has been stolen as well. Better change it, sigh...

How would you even think this would happen?

Maybe because I don’t typically work with authentication software? I feel like that’s not a hard conclusion to reach, don’t understand the incredulous response...

Re: Notice of Data Breach

#52
Would be interesting to know how they identified the breach. It is exactly these situations that I produced Breach Insider[0], in the hope to try and reduce the time to detection down from months to days.

Those of you affected by this breach, have you noticed any unusual spam/emails recently, that may be related to MFP? I’m wondering if they got the tip-off from their users.

[0] https://breachinsider.com

Re: Notice of Data Breach

#53
post #49

Ah, I had an account here. Checked Lastpass, and, great! They've got my six character don't-care-about-MyFitnessPal-security password. bcrypt will not save its secrecy in any way, but it hardly matters.

[deleted]

Re: Notice of Data Breach

#54
The breach notice indicates that hashed passwords were compromised but doesn't mention whether a salt was used when computing the hashes.

Use of a salt makes all the difference, guarding against the use of rainbow tables to look up precomputed hashes of common passwords.

Re: Notice of Data Breach

#56
post #54

The breach notice indicates that hashed passwords were compromised but doesn't mention whether a salt was used when computing the hashes. Use of a salt makes all the difference, guarding against the use of rainbow tables to look up precomputed hashes of common passwords.

> The affected information included usernames, email addresses, and hashed passwords - the majority with the hashing function called bcrypt used to secure passwords.

If they're using bcrypt, then they're using salts since salts are built in to bcrypt.

Re: Notice of Data Breach

#57

Earlier quoted context omitted.

The biggest limitation seems to be getting the nutrient information itself. MyFitnessPal has a huge database of off the shelf food products built in (and restaurants) from all over the world. Much of that information provided to the company for free by its users. MyFitnessPal has a similar advantage to Google, they have the most and richest data, and anyone else entering that market starts at a huge disadvantage. You…

You're absolutely right about datasets being a constraint for any new entrant. The USDA SR28 is free and open but limited scope. OpenFoodFacts has a great dataset overall but ~~you can't download it (other than rate-limited scraping),~~ the license is ~~strict~~ share-alike; and there isn't an OFF personal consumption tracker.

No need to scrape Open Food Facts, they kindly offer a download of the whole database as csv, rdf or mongodb dump: https://world.openfoodfacts.org/data

It is 100% crowd sourced open data under the ODbL licence (same as OpenStreetMap).

Re: Notice of Data Breach

#59

Earlier quoted context omitted.

What’s wrong with it, out of interest? It seems to work perfectly reliably for me, and I’m super happy that they aren’t getting all change-happy with it.

The iOS app has been pretty good (if a bit buggy and slow), but the desktop web interface is so bad to the point that I haven't used it in over a year -- and I use myfitnesspal daily.

I've definitely had the app perma-crash on me recently, where the only way to get out of the boot-then-crash loop was to delete and reinstall it.

It also fails at the iOS quick access menu about 80% of the time. e.g. you hard-press the app icon, go to "log food" and it goes back to the home page. Or you do the same for "scan barcode" and again most of the time it opens the app and sends you to the home page again. This has been the case for months.

Re: Notice of Data Breach

#60
post #45

Somebody is about to come across 250 pictures of me in my boxers standing in front of a dirty mirror with my belly popping out. I only hope they don't judge me for the size of my belly not really changing over those 250 days...

That was my first thought as well. But as per the article, only usernames, emails, and hashed passwords were taken.
Post reply on HN