Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

21–30 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#21

Post by throwaway834343 »

lawtalkinghuman wrote: post #18
erklik wrote: post #6

Earlier quoted context omitted.

> I can not believe the motivation can simply be to get subtitles to watch movies personally Why can't it be? Does everything require a money motive? Is it impossible that people want to do something good?

> Does everything require a money motive? On HN, apparently. See the recent thread on Wordle. The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting. The warez scene is a subculture and community for the people who participate in it. It is depressing that HN participants are so often mystified by the idea people might be motivate…

I should have been more clearer. Please see my other comment https://news.ycombinator.com/item?id=29991505 for clarification. I am glad to see comments like yours at HN honestly.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#22

Post by verytrivial »

PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

Can anyone talk me out of the Firefox password manager? It has a poor "general" use case for non-website passwords and treats mobile as a second-class satellite, but it seems to just work and the sync between mobile and desktop is very handy.

https://hacks.mozilla.org/2018/11/firefox-sync-privacy/

I read and understood just enough of this when it was published to know it would make the foundation an object of ridicule if it was ill-conceived, but I obviously rely on implementation details being tickety boo.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#23

Post by johnchristopher »

Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surface for not much benefits to users (and probably themselves).

edit: at the time I also was young and naive [0] and thought the open part of opensubtitles meant that people submitted subtitles in their free time out of their good heart and the site was simply hosting and organizing them, no problem with displaying ads on the website or at the beginning of the subs I thought, to make up for hosting costs. Subs hunting was so much fun at the time /s. But having to register to "prevent abuse" was a tad too much.

[0] still am by the way, thanks for asking :)

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#24

Post by johndoeee »

lawtalkinghuman wrote: post #18
erklik wrote: post #6

Earlier quoted context omitted.

> I can not believe the motivation can simply be to get subtitles to watch movies personally Why can't it be? Does everything require a money motive? Is it impossible that people want to do something good?

> Does everything require a money motive? On HN, apparently. See the recent thread on Wordle. The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting. The warez scene is a subculture and community for the people who participate in it. It is depressing that HN participants are so often mystified by the idea people might be motivate…

> The reality is likely to be: they make a very small amount from ads and user donations that might, if they're lucky, cover the costs of hosting

Opensubtitles has a VIP program at $15 a year.

It's quite easy to find the person who runs the site and, according to their CV, this is basically their job. That'd make Opensubtitles a for-profit piracy site, i guess.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#25

Post by FDSGSG »

throwaway834343 wrote: post #5

What is the motivation to run this non profit site? I can not believe the motivation can simply be to get subtitles to watch movies personally. I suspect this is not really non profit as there the site supports ads. My guess is the owner is making decent money via ads. To the readers of this comment, if you can make a rough calculation of the ad revenue with good assumptions to validate or invalidate my theory, that…

Opensubtitles is definitely for-profit. They sell lots of ad space, including ads injected into the subs themselves.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#26

Post by wasmitnetzen »

Deukhoofd wrote: post #20
gattilorenz wrote: post #7

> Tue Jan 18, 2022 2:34 pm > In August 2021 we received message on Telegram from a hacker, who showed us proof that he could gain access to the user table of opensubtitles.org, and downloaded a SQL dump from it. Wait, they got proof in August and release the info only now? Was this because they were trying to be in a talk with the hacker? It wasn't really clear, but it's a long time...

They explain more here: https://forum.opensubtitles.org/viewtopic.php?p=46845#p46845

So, still a wrong procedure. They should have told everyone to renew their password and view them as compromised in August.

Edit: typo

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#27

Post by wasmitnetzen »

verytrivial wrote: post #22
PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

Can anyone talk me out of the Firefox password manager? It has a poor "general" use case for non-website passwords and treats mobile as a second-class satellite, but it seems to just work and the sync between mobile and desktop is very handy. https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ I read and understood just enough of this when it was published to know it would make the foundation an object of ridicul…

KeepassDX (Android) has a really nifty keyboard feature which allows you to even put passwords in apps, which the regular Firefox Sync doesn't support. Maybe that's the use case which makes you do the switch?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#28

Post by labster »

ilogik wrote: post #4
m3adow wrote: post #2

> The site was created in 2006 with little knowledge of security, so passwords were stored in md5() hashes without salt Ouch! I hope they learned their lesson: Security is an ongoing effort.

for 2006 that's actually not bad. When I joined my first company in 2010, to my horror, they were using plain text passwords for users

My first company was using MySQL’s OLD_PASSWORD() function in 2013 — straight, with no salt or spice of any kind — in its 64-bit glory. Horrified, I did some research and threw bcrypt up there right away. Not sure if it was my my first commit, or the branch fixing 20 or so SQLIs was the first. I became my company’s software security expert out of sheer terror.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#29

Post by 8organicbits »

theplumber wrote: post #14

Why do we learn that passwords are obsolate and webauthn is the only sane choice?

I believe webauthn requires end users to perform key management. I suspect that is currently a harder task for the average user than a memorized or written-down password. Special hardware tokens may help, but I'm not sure how we'd convince average users to care or buy them.

Are there any webauthn only sites, besides demos?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#30

Post by woutifier »

franciscop wrote: post #8

> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed pass…

Defense against rainbow tables is obtained via salt, not via slow hashes. A rainbow table is a space-time tradeoff (you give space, and you get time), so using a slow hash only "encourages" (for lack of me knowing a better word) creating rainbow tables.

Adding long salts on the other hand requires the attacker to create an infeasible number of rainbow tables (one for each possible value of the salt).

Post reply on HN