Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StockX was hacked, exposing millions of customers’ data

techcrunch.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: StockX was hacked, exposing millions of customers’ data

#61

Post by elliekelly »

wpietri wrote: post #10
txcwpalpha wrote: post #7

> The stolen data contained names, email addresses, scrambled password (believed to be hashed with the MD5 algorithm and salted) This is absolutely atrocious if this is the case. MD5, even with a salt, can be cracked in a matter of seconds even with the most basic hardware. MD5 hasn't been an acceptable password hashing algorithm for at least a decade now, and StockX was created in 2015, long after the creators shoul…

Given that data, doesn't their attempt to call this "system updates" constitute a violation of California's data breach notification laws? https://oag.ca.gov/privacy/databreach/reporting

Oh man this is an interesting grey area. If the data was “encrypted” then they aren’t required to notify unless the encryption key is reasonably believed to have been acquired by the hacker.

I don’t know anything about MD5 or what makes it vulnerable but if StockX has no reason to believe the hacker acquired the key they could certainly make the argument they had no notice obligation.

Reading the statute (and assuming MD5 is as weak as everyone here says) I would say it falls outside the definition of “encrypted” but it really kind of depends on how honest the security engineers were with the lawyers.

I’ve never thought to ask “how encrypted?” when dealing with a breach but I definitely will now.

Re: StockX was hacked, exposing millions of customers’ data

#62

Post by alasdair_ »

ryanlol wrote: post #22
txcwpalpha wrote: post #15

Earlier quoted context omitted.

Look up benchmarks for cracking MD5 hashes. You can crack an MD5 hash of an average length password (and StockX only requires an 8 character password), even with a salt , within seconds with a single consumer grade GPU. A hacker group with any serious setup for hash cracking has almost certainly already cracked most, if not all, of these hashes.

Unless you presume that you know the salt your comment is utter nonsense. The fact that the article says “believed to be” strongly suggests that things are not as simple as they’re “believed to be”, because if the passwords were easy to crack that’d be trivial to prove.

>Unless you presume that you know the salt your comment is utter nonsense.

Usually the attacker will also know the salts in a breach of this type, unless the company did something clever with the salts (doubtful since they used MD5).

Re: StockX was hacked, exposing millions of customers’ data

#63

Post by jnbiche »

pgm8705 wrote: post #45
PopeDotNinja wrote: post #40

Earlier quoted context omitted.

I had a similar experience, but I made the mistake of taking the job. I spent several months in denial about how smart people who act so... not smart. At one point, I asked the CTO for guidance on how to work with the team architect whose feelings I kept hurting. For example, I wrote a constructor for a class, and the architect asked me what "def initialize" was for, and got upset when I asked if they knew how OOP in…

I used to work closely with Quicken Loans and other FoCs and can attest that this behavior is commonplace. There is this strange culture within the Family of Companies where non-tech leaders think that tenured Quicken engineers and tech people are these sort of super-geniuses. Many years back I was a part of a company in the Quicken led start-up space. We were often "encouraged" to meet with Quicken or FatHead senior…

While I don't agree with the way he spoke, was C# one of the de facto or explicit in-house languages of the company, and Ruby was not? If so, he may have been referring to the fact that the company already had many libraries in C# that you could use. Plus, if C# was one of their areas of expertise, it's typically best to use that as opposed to a new, unfamiliar language unless you're explicitly testing out a new approach.

Also, in general, for programming in the large, many experienced programmers, having worked on multiple large-scale software projects, tend to prefer statically-typed languages. We've found by experience that in such large-scale systems, major refactorings are much, much smoother and feasible in statically-typed languages (although unit and integration tests are certainly still needed). And a whole class of errors are eliminated.

I don't think RoR is trash, but if you were starting a large program that would be used across multiple departments whose in-house language was C#, it was probably the right call to suggest switching to C#.

Please note: I'm not a C# programmer, and have never done any work in C# (although I've worked many dynamically-typed and statically-typed languages, and have a clear preference for the latter for large-scale software projects). So this isn't something I have any personal investment in.

Finally, I do get it, working for these types of companies is misery for most programmers. I've worked in such companies. But in this case, the senior may have had a good point.

Re: StockX was hacked, exposing millions of customers’ data

#64

Post by alasdair_ »

kokowawa393 wrote: post #50
whatshisface wrote: post #29

Earlier quoted context omitted.

That would be a civil case prosecuted by the other companies, not a criminal case.

It should be criminal.

People that re-use passwords should be considered negligent. There is no reason to do so for anything but the most trivial logins.

Re: StockX was hacked, exposing millions of customers’ data

#65

Post by jnwatson »

elliekelly wrote: post #61
wpietri wrote: post #10

Earlier quoted context omitted.

Given that data, doesn't their attempt to call this "system updates" constitute a violation of California's data breach notification laws? https://oag.ca.gov/privacy/databreach/reporting

Oh man this is an interesting grey area. If the data was “encrypted” then they aren’t required to notify unless the encryption key is reasonably believed to have been acquired by the hacker. I don’t know anything about MD5 or what makes it vulnerable but if StockX has no reason to believe the hacker acquired the key they could certainly make the argument they had no notice obligation. Reading the statute (and assumin…

The non-password data was not encrypted, so is definitely a breach of California law.

Re: StockX was hacked, exposing millions of customers’ data

#66

Post by alephnan »

omarchowdhury wrote: post #60
alephnan wrote: post #46

I expect a lot of downvotes for this post from people who have not had experience working with people in fashion. Investors should be weary of people from the fashion industry. I say this as someone who has both a computer science degree and a fashion design degree, and 90% of my friends were in the fashion industry at some point. Coming from tech, you'll find people here are much flakier and just unreliable. In the…

Whose hat did the paper fall out of?

The store's. I put the hat on while I continued shopping. I had every intention of buying the hat, but apparently the paper fell out. The employee came to me fist-clenched, with a fighting tone. I'm sure you're skeptical and think there's two sides to every story, but I don't want to expand too much on the story for privacy and retaliatory concerns. I invite you to come to SoHo, NYC and visit a few stores if you have any doubts.

Re: StockX was hacked, exposing millions of customers’ data

#67

Post by omarchowdhury »

alephnan wrote: post #66
omarchowdhury wrote: post #60

Earlier quoted context omitted.

Whose hat did the paper fall out of?

The store's. I put the hat on while I continued shopping. I had every intention of buying the hat, but apparently the paper fell out. The employee came to me fist-clenched, with a fighting tone. I'm sure you're skeptical and think there's two sides to every story, but I don't want to expand too much on the story for privacy and retaliatory concerns. I invite you to come to SoHo, NYC and visit a few stores if you have…

I've lived in NYC all my life and am familiar with the scene.

Did they ask you nicely (initially) to pick it up? What was the tone of your response? These are two missing clues on how this might have gotten started.

Re: StockX was hacked, exposing millions of customers’ data

#68

Post by doctorpangloss »

barbecue_sauce wrote: post #54
rvz wrote: post #12

> ...The company “robbed their users of the chance to evaluate their exposure” by not informing customers of the breach when it happened... StockX is valued at $1B and aside from their cataclysmic choice of using MD5 + salt as their way of hashing passwords (They obviously don't take security seriously) the company failed to inform their customers of this security breach as soon as it happened and left it very late f…

Jeez. Even coding bootcamps teach developers to use at least bcrypt for passwords.

It’s just a Wordpress site using ancient defaults. It’s not exactly a technology business.

Re: StockX was hacked, exposing millions of customers’ data

#69

Post by xkcd-sucks »

barbecue_sauce wrote: post #54
rvz wrote: post #12

> ...The company “robbed their users of the chance to evaluate their exposure” by not informing customers of the breach when it happened... StockX is valued at $1B and aside from their cataclysmic choice of using MD5 + salt as their way of hashing passwords (They obviously don't take security seriously) the company failed to inform their customers of this security breach as soon as it happened and left it very late f…

Jeez. Even coding bootcamps teach developers to use at least bcrypt for passwords.

Then they get into I dustry and get told that getting stuck in the weeds of security isn't something which generates value

Re: StockX was hacked, exposing millions of customers’ data

#70

Post by PopeDotNinja »

alephnan wrote: post #47
PopeDotNinja wrote: post #40

Earlier quoted context omitted.

I had a similar experience, but I made the mistake of taking the job. I spent several months in denial about how smart people who act so... not smart. At one point, I asked the CTO for guidance on how to work with the team architect whose feelings I kept hurting. For example, I wrote a constructor for a class, and the architect asked me what "def initialize" was for, and got upset when I asked if they knew how OOP in…

Sounds like you dodged a bullet. Did you end up working at another Fashion-Tech company? I'm curious how much of this is characteristic of Fashion-Tech industry in general.

I dodged a bullet indeed. Out of the dozen other devs there, there was exactly one person I'd care to work with again. They got pushed out a month or two later, and post-shenanigans felt infinitely better.

My advice is to do what you gotta do to pay the bills, but don't delude yourself into thinking that a crazy sauce employer will change its ways because you try extra hard to change them when they resist your attempts to do so.

Post reply on HN