I used to work at a Dan Gilbert Quicken Family of Companies company, and I am not the least bit surprised by this, especially the abysmal choice to use MD5. Let’s just say, the engineering chops across the family of companies is... mediocre, at best.
StockX was hacked, exposing millions of customers’ data
21–30 of 108 posts
Re: StockX was hacked, exposing millions of customers’ data
#22Earlier quoted context omitted.
Sounds alarming, but not true. If you don’t know the salt, you are not cracking an MD5 password on basic hardware . You are probably not cracking the password in any reasonable time, period. And when you have a unique salt per user, that’s basically game over.
Look up benchmarks for cracking MD5 hashes. You can crack an MD5 hash of an average length password (and StockX only requires an 8 character password), even with a salt , within seconds with a single consumer grade GPU. A hacker group with any serious setup for hash cracking has almost certainly already cracked most, if not all, of these hashes.
Unless you presume that you know the salt your comment is utter nonsense.
The fact that the article says “believed to be” strongly suggests that things are not as simple as they’re “believed to be”, because if the passwords were easy to crack that’d be trivial to prove.
Re: StockX was hacked, exposing millions of customers’ data
#23Earlier quoted context omitted.
Sounds alarming, but not true. If you don’t know the salt, you are not cracking an MD5 password on basic hardware . You are probably not cracking the password in any reasonable time, period. And when you have a unique salt per user, that’s basically game over.
Look up benchmarks for cracking MD5 hashes. You can crack an MD5 hash of an average length password (and StockX only requires an 8 character password), even with a salt , within seconds with a single consumer grade GPU. A hacker group with any serious setup for hash cracking has almost certainly already cracked most, if not all, of these hashes.
Show me the benchmarks.
Re: StockX was hacked, exposing millions of customers’ data
#24I very nearly worked there in their engineering department, but once I got through the initial HR interview into the technical stuff, there were so many red flags that I got outta there as soon as I could. A few higher level people who were all let go with me ended up going there, and having met up with them a few times, I've heard some absolute horror stories about everything ranging from dev workload, to security,…
This is endemic to the FoC. When your entire team is recent boot camp grads, this is the end result. The engineering culture is a joke. (Source: former employee.)
Re: StockX was hacked, exposing millions of customers’ data
#25> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted), and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version. The serious tone of this article made me double check if this was April 1st when I read this paragraph. The stolen dat…
We need to start charging companies with criminal negligence if they are not using secure password hashing algorithms. People reuse passwords and this leak puts other companies at risk.
You can't sue a company for your own bad security practices.
Re: StockX was hacked, exposing millions of customers’ data
#26I very nearly worked there in their engineering department, but once I got through the initial HR interview into the technical stuff, there were so many red flags that I got outta there as soon as I could. A few higher level people who were all let go with me ended up going there, and having met up with them a few times, I've heard some absolute horror stories about everything ranging from dev workload, to security,…
This is endemic to the FoC. When your entire team is recent boot camp grads, this is the end result. The engineering culture is a joke. (Source: former employee.)
I'm a current employee in the FoC (just not StockX), and with more than a decade in software development, I am easily the least experienced on our team by several years.
Re: StockX was hacked, exposing millions of customers’ data
#27Discussions regarding use of MD5 hashing is missing the point, Capital One and Equifax had plain text data exposed. The hashing strategy is irrelevant.
Re: StockX was hacked, exposing millions of customers’ data
#28Discussions regarding use of MD5 hashing is missing the point, Capital One and Equifax had plain text data exposed. The hashing strategy is irrelevant.
We're talking about poor security practices that lead to increased risk to consumers right? Doesn't hashing fall within that? I didn't see anybody claiming that was the only factor, it's just one that stick out.
Re: StockX was hacked, exposing millions of customers’ data
#29> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted), and other profile information — such as shoe size and trading currency. The data also included the user’s device type, such as Android or iPhone, and the software version. The serious tone of this article made me double check if this was April 1st when I read this paragraph. The stolen dat…
We need to start charging companies with criminal negligence if they are not using secure password hashing algorithms. People reuse passwords and this leak puts other companies at risk.
That would be a civil case prosecuted by the other companies, not a criminal case.
Re: StockX was hacked, exposing millions of customers’ data
#30I very nearly worked there in their engineering department, but once I got through the initial HR interview into the technical stuff, there were so many red flags that I got outta there as soon as I could. A few higher level people who were all let go with me ended up going there, and having met up with them a few times, I've heard some absolute horror stories about everything ranging from dev workload, to security,…
This is endemic to the FoC. When your entire team is recent boot camp grads, this is the end result. The engineering culture is a joke. (Source: former employee.)
What is "FoC"?