Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

31–40 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#31

Post by chompychop »

wasmitnetzen wrote: post #27
verytrivial wrote: post #22

Earlier quoted context omitted.

Can anyone talk me out of the Firefox password manager? It has a poor "general" use case for non-website passwords and treats mobile as a second-class satellite, but it seems to just work and the sync between mobile and desktop is very handy. https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ I read and understood just enough of this when it was published to know it would make the foundation an object of ridicul…

KeepassDX (Android) has a really nifty keyboard feature which allows you to even put passwords in apps, which the regular Firefox Sync doesn't support. Maybe that's the use case which makes you do the switch?

Do we need to toggle this feature somewhere in the settings? I use KeepassDX but I've never been asked by the app to auto-fill in passwords on websites or other apps.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#32

Post by etu »

franciscop wrote: post #8

> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed pass…

A properly implemented use of password_hash() would also allow them to use the same field and code for different algorithms over time.

What I mean is, the stored data contains which algorithms it is. So they can in their code or configuration change which algorithms to use and how many times it should hash. Then on login they can verify the password against the hash and also check if the stored hash needs to be rehashed against the current set settings, then it can create a new hash from the password the user entered on login and store that in the database.

Then you get automatic hash upgrades to match the current settings of the hashing of the passwords on the site with basically no user interaction (other than the act of logging in to have the password in plain text).

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#33

Post by martin_a »

> It is kind of amazing, that the site was hacked now, after 15 years - so that hacker must have spent quite a lot of time and energy on it.

I'm pretty sure that it did not take "that hacker" 15 years to find this vulnerability.

Pretty strange forum post.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#35

Post by YPPH »

>On the technical side, he was able to hack the low security password of a SuperAdmin, and gained access to an unsecured script, which was available only for SuperAdmins. This script allowed him to perform SQL injections and extract the data.

It can be tempting to forgo the same security considerations when programming backend applications which aren't ordinarily accessible to the public. I guess this is a reminder why the temptation must be resisted.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#37

Post by morelish »

I wonder how the hacker got network access to the database? I couldn't work out from what I read. It said the DB had a weak superuser password. But it didn't say how the hacker managed to make network calls to the DB. Presumably there was some initial entry point to get inside the network? It sounds like maybe the web-application user verification was poor and the app allowed admin users to make arbitrary DB calls?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#38

Post by gwd »

woutifier wrote: post #30
franciscop wrote: post #8

> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed pass…

Defense against rainbow tables is obtained via salt, not via slow hashes. A rainbow table is a space-time tradeoff (you give space, and you get time), so using a slow hash only "encourages" (for lack of me knowing a better word) creating rainbow tables. Adding long salts on the other hand requires the attacker to create an infeasible number of rainbow tables (one for each possible value of the salt).

> Defense against rainbow tables is obtained via salt, not via slow hashes.

And bcrypt includes stores a unique salt next to the hash for every password, making rainbow tables completely useless.

https://en.wikipedia.org/wiki/Bcrypt

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#39

Post by Aeolun »

martin_a wrote: post #33

> It is kind of amazing, that the site was hacked now, after 15 years - so that hacker must have spent quite a lot of time and energy on it. I'm pretty sure that it did not take "that hacker" 15 years to find this vulnerability. Pretty strange forum post.

Website still managed by a just graduated 21 year old?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#40

Post by brobinson »

joren485 wrote: post #16
franciscop wrote: post #8

> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed pass…

> I'm not sure if bcrypt/blowfish is still the recommended algorithm or there's newer better ones While bcrypt is already much, much better than using MD5 or SHA256, the best practice is to use Argon2. In practice, it is more important to use a hashing algorithm that is designed for passwords (e.g. bcrypt, argon2, scrypt) than it is to choose the best one. As this breach shows, many sites are still using insecure has…

Which mode do you/would you use? Hybrid?

I haven't had to write any password storage code since before Argon2 won the 2015 competition so I haven't gone deep on the "side channel attack vs. memory hardness" tradeoff question when picking the mode. I am curious which mode others are using.

Post reply on HN