Knuddels: Chat platform must pay after hacker attack fine

Post by pbhjpbhj » Thu, Nov 22, 2018, 3:27 PM UTC

johannes1234321 wrote: post #34

pbhjpbhj wrote: post #28

Earlier quoted context omitted.

€20k doesn't seem much to me. Cheaper than taking on a security consultant. Not that you need a security consultant to know passwords shouldn't be stored (at all, nevermind plaintext). If they're doing that then they're likely being sloppy elsewhere, and by only paying €20k across the last n years they might have saved a €million. If your company is in the same boat probably worth not bothering to get any security is…

The fine is small since they completely complied with all inquiries and took proper steps to inform users and improve security. Thus do what the actual goals is. Making money is no a goal of GDPR, but ensuring data safety.

Post by judge2020 » Thu, Nov 22, 2018, 3:28 PM UTC

ygra wrote: post #22

tyingq wrote: post #15

"Knuddels is safer than ever." Corporate speak is just so funny. The bar for "safer than ever" is pretty low when your dev team hasn't heard of password hashing.

Well, you can work your way up with ever increasing levels of safety by adding first MD5, then moving to SHA-1, then adding a salt, and eventually something sensible like bcrypt. That's four more press releases right there :-)

Post by tyingq » Thu, Nov 22, 2018, 3:29 PM UTC

Double_a_92 wrote: post #40

tyingq wrote: post #15

"Knuddels is safer than ever." Corporate speak is just so funny. The bar for "safer than ever" is pretty low when your dev team hasn't heard of password hashing.

The passwords to login where actually hashed. But they stored another copy in plaintext on purpose, to censor the users password if they wrote it into chat...

Post by xaitv » Thu, Nov 22, 2018, 3:32 PM UTC

Drakim wrote: post #46

hnaj wrote: post #42

According to the link: https://www.baden-wuerttemberg.datenschutz.de/lfdi-baden-wue... They were doing this so they could filter out the passwords from chats (i.e. to make it so users can't give out their passwords to other users). Not saying this justifies it, but it's interesting.

It's possible to do that without storing the passwords in plain text though! Run each word of the chat though the same hash+salt mechanism and compare to what you have stored.

Post by gpm » Thu, Nov 22, 2018, 3:34 PM UTC

xaitv wrote: post #57

Drakim wrote: post #46

Earlier quoted context omitted.

It's possible to do that without storing the passwords in plain text though! Run each word of the chat though the same hash+salt mechanism and compare to what you have stored.

But what if people have multi-word passwords? At that point the solutions become so over-engineered(either use some ngram-like setup to detect passwords being posted or save a hash for each separate word of the user's password, which also decreases security since then you know the user has a multi-word password) that you might as well drop that feature.