StockX was hacked, exposing millions of customers’ data • Hacker News Board

Re: StockX was hacked, exposing millions of customers’ data

#101

Post by fortran77 » Mon, Aug 05, 2019, 1:54 PM UTC

consumer451 wrote: post #93

fortran77 wrote: post #83

Earlier quoted context omitted.

It sure looks like Wordpress, but are you sure? They don't have the wordpress login page at /wp-login.php and I don't see references to /wp-* in the source.

I haven’t looked at the site myself yet, but renaming those is sometimes used a security through obscurity.

And not such a bad idea, either! I use Wordpress just for a company landing page, and moved all the defaults. It took probe attacks down to almost nothing. It used to get probed all day long for Wordpress unpatched bugs in both Wordpress and popular plugins. The scripts all give up after getting 404 on the usual pages.

Re: StockX was hacked, exposing millions of customers’ data

#102

Post by pgm8705 » Mon, Aug 05, 2019, 2:59 PM UTC

gruez wrote: post #75

jnbiche wrote: post #63

Earlier quoted context omitted.

While I don't agree with the way he spoke, was C# one of the de facto or explicit in-house languages of the company, and Ruby was not? If so, he may have been referring to the fact that the company already had many libraries in C# that you could use. Plus, if C# was one of their areas of expertise, it's typically best to use that as opposed to a new, unfamiliar language unless you're explicitly testing out a new appr…

>While I don't agree with the way he spoke, was C# one of the de facto or explicit in-house languages of the company, and Ruby was not? If so, he may have been referring to the fact that the company already had many libraries in C# that you could use. Plus, if C# was one of their areas of expertise, it's typically best to use that as opposed to a new, unfamiliar language unless you're explicitly testing out a new app…

This is correct. Our company was under the Quicken "Family of Companies" umbrella, but we were a 5 person start-up building a web app unrelated to Quicken.

Re: StockX was hacked, exposing millions of customers’ data

#103

Post by mattnedrich » Mon, Aug 05, 2019, 3:04 PM UTC

harrygallagher4 wrote: post #44

I got an email 3 days ago asking me to reset my password due to "system updates" and initially assumed it was just a phishing email. Since gmail is pretty aggressive about filtering those I looked into it more and realized it was genuine which made me even more confused because I couldn't imagine what sort of "system updates" they could've done that would require a password reset for all users. I kind of assumed they…

I had the same reaction to the email

Re: StockX was hacked, exposing millions of customers’ data

#104

Post by carti » Mon, Aug 05, 2019, 5:09 PM UTC

alephnan wrote: post #46

I expect a lot of downvotes for this post from people who have not had experience working with people in fashion. Investors should be weary of people from the fashion industry. I say this as someone who has both a computer science degree and a fashion design degree, and 90% of my friends were in the fashion industry at some point. Coming from tech, you'll find people here are much flakier and just unreliable. In the…

This comment plays into some awful streetwear stereotypes. "ym bape compilation" is about as representative of streetwear as a video of Raiders fans rioting is representative of professional sports, if not less so. Sure, there are some assholes. Where aren't there?

I think the sort of behavior you describe can happen with any sort of niche or exclusive retail. It's not particularly fair to single out streetwear here, which already has a negative stigma in many circles.

I'd assume the bouncers would be there primarily to prevent shrinkage. Seems reasonable to have people around to ensure running off with hundreds of dollars of clothing is less attractive of a proposition. Sorry you had to deal with that confrontation either way, though.

I'm curious how much of the flakiness attributed to fashion applies to other arts or arts-adjacent areas.

Re: StockX was hacked, exposing millions of customers’ data

#105

Post by aarbor989 » Mon, Aug 05, 2019, 6:35 PM UTC

harrygallagher4 wrote: post #44

I got an email 3 days ago asking me to reset my password due to "system updates" and initially assumed it was just a phishing email. Since gmail is pretty aggressive about filtering those I looked into it more and realized it was genuine which made me even more confused because I couldn't imagine what sort of "system updates" they could've done that would require a password reset for all users. I kind of assumed they…

I thought the same thing when I received it. However, at the end I gave them the benefit of the doubt that perhaps they were migrating from one hashing algorithm to another and decided to just reset everyone's password in the process. Lying about the breach entirely is so shady

Re: StockX was hacked, exposing millions of customers’ data

#106

Post by [deleted] » Mon, Aug 05, 2019, 7:44 PM UTC

gist wrote: post #31

maxdata wrote: post #20

I very nearly worked there in their engineering department, but once I got through the initial HR interview into the technical stuff, there were so many red flags that I got outta there as soon as I could. A few higher level people who were all let go with me ended up going there, and having met up with them a few times, I've heard some absolute horror stories about everything ranging from dev workload, to security,…

> there were so many red flags that I got outta there as soon as I could Instead of joining the bashing party and lieu of making a broad statement why don't you detail what some of those red flags were?

[deleted]

Re: StockX was hacked, exposing millions of customers’ data

#107

Post by UncleMeat » Tue, Aug 06, 2019, 5:56 PM UTC

toyg wrote: post #95

UncleMeat wrote: post #57

Earlier quoted context omitted.

There are two topics that are HUGELY overrepresented in discussions of computer security: password complexity and password hashing. MD5 hashes is not good. But it also isn't catastrophe level security. If you aren't reusing passwords then the hashing choice doesn't matter since the system has already been breached. If you are reusing passwords you don't exactly want to rely on bcrypt hardness to keep you safe. If I c…

This is bad advice and you should feel bad. We know people reuse passwords. This is a non-negotiable threat model for any user-facing system. Given this, one should make password-decryption as hard as possible. MD5 is just not good enough by any standard, in 2019.

We do know this. And we can also choose how we spend our energy on education and outreach. IMO, we should be pushing password managers and 2fa as hard as humanly possible. People can only integrate so much security advice. If I'm providing guidance for a business that wants to improve the security posture of its users, I'd tell them to make 2fa integration as easy as possible and to encourage their users to use password managers before spending time on the particulars of the cryptographic storage of passwords.

Re: StockX was hacked, exposing millions of customers’ data

#108

Post by morgajel2 » Wed, Aug 07, 2019, 5:36 PM UTC

FDSGSG wrote: post #99

rvz wrote: post #12

> ...The company “robbed their users of the chance to evaluate their exposure” by not informing customers of the breach when it happened... StockX is valued at $1B and aside from their cataclysmic choice of using MD5 + salt as their way of hashing passwords (They obviously don't take security seriously) the company failed to inform their customers of this security breach as soon as it happened and left it very late f…

> calculating all those MD5 collisions What now? What do MD5 collisions have to do with passwords?

you don't need the password, you just need a string that when hashed produces the same hash as the password e.g. the hash of "insecurepass123" has a hash of 79054025255f, which is the same hash as "%AZQ%ɟr71V4[m6S49cH͠3BW".

If you know the hash is, either will match the hash.