Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

11–20 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#11

Post by causi »

throwaway834343 wrote: post #5

What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…

These days a lot of the subtitle files actually have ads embedded in the text itself, either during the movie or at the beginning/end.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#12

Post by pizza234 »

stubish wrote: post #9

At one point I think you could use opensubtitles.org without a username and password. I wonder in hindsight if the liability of storing PII was worth it?

I think one use case was subtitle downloading (typically, a client like Subdownloader) for VPN users, whose requests would be denied if unauthenticated.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#13

Post by lillecarl »

PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

I use my own domain and give each website their own e-mail address too, so I know who is breached/selling my information. For password management I use BitWarden, to which I am a paying customer of 15$ a year for their premium features (Premium features being TOTP integrated into the password manager, probably something else too that I don't use).

BitWarden is open source, both server and clients. There's even a third party implementation of the server in rust that seems to be mostly compatible. Both the official and the third party server are self-hostable.

BitWarden runs their infrastructure on Azure, uses Azure managed databases and Azure managed backups. So I'm quite comfortable having my passwords there.

The only feature I miss is that I'd like BitWarden to send me an email with all my passwords, encrypted so that I own a backup of my data too in case the worst happens.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#15

Post by burai »

m3adow wrote: post #2

> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Ouch! I hope they learned their lesson: Security is an ongoing effort.

16 years without reviewing password security seems like a massive oversight. A major leak like this it's a high price to pay to learn this lesson.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#16

Post by joren485 »

franciscop wrote: post #8

> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed pass…

> I'm not sure if bcrypt/blowfish is still the recommended algorithm or there's newer better ones

While bcrypt is already much, much better than using MD5 or SHA256, the best practice is to use Argon2.

In practice, it is more important to use a hashing algorithm that is designed for passwords (e.g. bcrypt, argon2, scrypt) than it is to choose the best one. As this breach shows, many sites are still using insecure hashes, like MD5, because it worked 15 years ago.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#17

Post by Grimburger »

throwaway834343 wrote: post #5

What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…

I've only ever interacted with it after account setup year ago via a rpi running Kodi which automatically downloads subtitles now and then, unless specifically searching for different versions barely remember it exists. I hope they make money somehow but get the feeling it's mostly just a bunch of api leeches like myself.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#18

Post by lawtalkinghuman »

erklik wrote: post #6
throwaway834343 wrote: post #5

What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…

> I can not believe the motivation can simply be to get subtitles to watch movies personally Why can't it be? Does everything require a money motive? Is it impossible that people want to do something good?

> Does everything require a money motive?

On HN, apparently. See the recent thread on Wordle.

The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting. The warez scene is a subculture and community for the people who participate in it.

It is depressing that HN participants are so often mystified by the idea people might be motivated by intrinsic or social factors to engage in peer-based production (whether legal or not) when so many of the companies they run or work for exist only because of peer-based production efforts like Linux and other FOSS software.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#19

Post by throwaway834343 »

erklik wrote: post #6
throwaway834343 wrote: post #5

What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…

> I can not believe the motivation can simply be to get subtitles to watch movies personally Why can't it be? Does everything require a money motive? Is it impossible that people want to do something good?

I should have been more clearer. I can understand running a hobby site to chat with fellow hobbyists which is a motivation for socializing. In this case its pretty much static. I fail to understand the motivation.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#20

Post by Deukhoofd »

gattilorenz wrote: post #7

> Tue Jan 18, 2022 2:34 pm > In August 2021 we received message on Telegram from a hacker, who showed us proof that he could gain access to the user table of opensubtitles.org, and downloaded a SQL dump from it. Wait, they got proof in August and release the info only now? Was this because they were trying to be in a talk with the hacker? It wasn't really clear, but it's a long time...

They explain more here:

https://forum.opensubtitles.org/viewtopic.php?p=46845#p46845

Post reply on HN