Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

At Blind, a security lapse revealed private complaints from tech employees

techcrunch.com

Post reply on HN
Print view View original

91–100 of 141 posts

Re: At Blind, a security lapse revealed private complaints from tech employees

#91

Post by throwawaymath »

austincheney wrote: post #70
dgzl wrote: post #67

This bothers me: > The database also contained passwords, which were stored as an MD5 hash, a long-outdated algorithm that is nowadays easy to crack. Many of the passwords were easily unscrambled using readily available tools when we tried. That's not how hash functions work... > Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are…

> That's not how hash functions work... Kind of. A hash function just provides a near random set of characters of fixed length for a given set of input in a way where the output characters are reproducible for the given input. Passwords are not stored. It is the computed hash value that is stored. When a user attempts to login with a username and password the password is hashed and compared to the stored hash. That s…

It's cool that you jumped on the opportunity to explain how password hashing works. However, the reporter actually cracked hashes, so we can bypass all of this discussion and plainly see the hashes were insecure.

And for what it's worth:

> To be secure the salt must be stored in a different location from the stored hashes and the salt value should not be statically visible in the source code provided a source code compromise.

This isn't true. Your salt can be totally public if you're using a robust key derivation function. Likewise you can make e.g. the work factor (rounds) public for bcrypt and N, r and p public for scrypt (cost factor, block size and parallelization parameters).

The rest of what you said about secrets management in code is sound though.

Re: At Blind, a security lapse revealed private complaints from tech employees

#92

Post by SolaceQuantum »

mrep wrote: post #18
ineedasername wrote: post #17

I'd never checked out Blind before. I just went there and checked out a few of the front page posts & comments. It has some of the most toxic and destructive "advice" I've seen for people asking for help or insight. I'm a bit astounded. Is this typical?

Examples?

My first look at Blind rated cities to work in by how hot/available women were there (e.g. comments like "SF sucks, you have to settle on dating uglies" or "NYC women are so much hotter than SV women, no contest where to live"). The question asked to the Blind community was just "where would it be better to live long term" or something completely not to do with dating or women, but the majority of responses were about the hotness of women dates.

Later on, I found unsavory relationship advisement going on, and further than that, outright racism against Indians in particular. None of these comments were downvoted, many encouraged and agreed upon. (EDIT: Not downvoted, criticized, sorry.(

Re: At Blind, a security lapse revealed private complaints from tech employees

#93

Post by uber-employee »

aryamaan wrote: post #90
mosselman wrote: post #65

"Uber — which later blocked the app on its corporate network." Reason enough not to work there if you ask me.

I don't think this claim is true. Friends who work there clarified they can use Blind at the corp network.

No, it’s true. This was right after the Susan Fowler event when Uber’s Blind channel blew up in membership. They blocked it, people just laughed and turned off wifi, and then they unblocked it a few weeks later.

Re: At Blind, a security lapse revealed private complaints from tech employees

#94

Post by badpun »

marijnz wrote: post #54
sharadov wrote: post #40

Earlier quoted context omitted.

It's pathetic, you see some of the most depraved, narcissistic members of the tech society there. The quality of the discourse you can guess is shockingly bad, and most people are from the Bay area. Is this an accurate representation of people in the Bay? Or is it just a platform for toxic folk to hang out?

I spent more time reading the threads than I should have, it's strangely addicting. I now feel naive for thinking that the people working at the big tech companies have a certain base level of "all-round" skills. In no way I expected so much cynicism, narcism and lack of empathy! Isn't this showing up in interviews? Or should it just be seen as online trolling and venting?

> I now feel naive for thinking that the people working at the big tech companies have a certain base level of "all-round" skills. In no way I expected so much cynicism, narcism and lack of empathy!

Why? These companies are like Wall Street, they pay the most, so they attract people who are predominantly interested in money. These kind of people tend not to be the most upstanding.

Re: At Blind, a security lapse revealed private complaints from tech employees

#95

Post by toss1 »

Their core functionality is to keep the confidentiality of its users.

There is widespread available technology and know-how on how to do this successfully and consistently.

Blind failed miserably at this fundamental task.

Yet... >>Blind last month secured another $10 million in new funding after a $6 million raise in 2017

So the VCs are perfectly happy to dump millions into a company that is dishonest and incompetent (see also Uber, Theranos), while thousands of competent honest startups go begging.

Provides a bit of background into why most VC funds struggle to outperform the market

Re: At Blind, a security lapse revealed private complaints from tech employees

#96

Post by astura »

farazzz wrote: post #21
eat_veggies wrote: post #3

Earlier quoted context omitted.

> Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.” !!!!!!

Isn’t SHA2 the standard hashing algorithm? If not, what do people use now?

For password storage? Bcrypt.

Re: At Blind, a security lapse revealed private complaints from tech employees

#97

Post by ceejayoz »

dgzl wrote: post #71
free652 wrote: post #69

Earlier quoted context omitted.

The passwords were md5 hashed and most likely broken using dictionary attack or brute forced with tools like hashcat. I forgot my password once, but I knew the general letters and it brute forced in a minute.

Yeah weak hashes are easy to replicate, I was just laughing at the words they used.... Unscramble, like it's an encryption method or something.

I'm perfectly comfortable with saying "unscramble" when talking about using a rainbow table to figure out the corresponding password for a MD5 hash.

If I'm writing docs for MD5, that's one thing. General tech reporting? "Unscramble" is understandable to someone who's never had to implement a password hash, which is most of the populace.

Re: At Blind, a security lapse revealed private complaints from tech employees

#98

Post by vonmoltke »

SolaceQuantum wrote: post #92
mrep wrote: post #18

Earlier quoted context omitted.

Examples?

My first look at Blind rated cities to work in by how hot/available women were there (e.g. comments like "SF sucks, you have to settle on dating uglies" or "NYC women are so much hotter than SV women, no contest where to live"). The question asked to the Blind community was just "where would it be better to live long term" or something completely not to do with dating or women, but the majority of responses were abou…

> None of these comments were downvoted

Blind doesn't have downvotes (which could be part of the problem there).

Post reply on HN