Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

forum.opensubtitles.org

Post reply on HN
Print view View original

51–60 of 194 posts

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#51

Post by mkdirp »

johnchristopher wrote: post #23

Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API). I always forgot about login details and in my opinion it wasn't needed at all for them except for profile tracking I guess. They forced people to register to get subtitles, they willingly forced people to increase their attack surfac…

> Opensubtitles became really frustrating to use once they began asking for a login and a password to download subtitles in VLC or Xbmc/kodi (basically every time you need to use the API).

This was actually optional, and always was. I think the issue was that they had made some changes in the backend, but the addons didn't update the code to accommodate. At least this was the case for Kodi. The opensubtitles addon has essentially become abandonware anyway. There are now third-party addons that provide the same functionality but without a login, and across different subtitle websites.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#52

Post by tialaramex »

woutifier wrote: post #30
franciscop wrote: post #8

> user passwords are saved in safe form using hash_hmac and sha256 algo with salt and pepper, all md5() passwords are deleted Wait, what? Definitely lesson not learned: - sha256 is not the proper way to store passwords, it's still vulnerable to the same attack as md5, rainbow tables, because it's a FAST algorithm (sure md5 is also poor for collisions, meaning it's worse, but practical attacks for lists of hashed pass…

Defense against rainbow tables is obtained via salt, not via slow hashes. A rainbow table is a space-time tradeoff (you give space, and you get time), so using a slow hash only "encourages" (for lack of me knowing a better word) creating rainbow tables. Adding long salts on the other hand requires the attacker to create an infeasible number of rainbow tables (one for each possible value of the salt).

Technically this class of trades also incurs a lot more hashing (and so the expense of the hash function is important), the trade is valuable because you get to do all the work once, up front, and not spend that time on any particular password hash once you have it.

So e.g. computing a rainbow table for all possible Windows 2000 passwords (up to 14 characters but you're actually only doing 56-bit inputs) in the LANMAN scheme took ages, and produced a fairly large file, but having done so that's it, you, or anyone you give the file to, can reverse LANMAN hashes into working passwords almost instantly.

(Microsoft's LANMAN hash lacked salt, and is stupid in various other ways, MD5 would actually have been a better choice than LANMAN, because you allow arbitrary input passwords and thus good passwords are stronger instead of impossible even though MD5 is much too fast for a good password hash)

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#53

Post by pferde »

pizza234 wrote: post #12
stubish wrote: post #9

At one point I think you could use opensubtitles.org without a username and password. I wonder in hindsight if the liability of storing PII was worth it?

I think one use case was subtitle downloading (typically, a client like Subdownloader) for VPN users, whose requests would be denied if unauthenticated.

Why? The site's raison d'etre is to make subtitles readily available for downloading by anyone. What is the purpose of locking it behind authentication? What did that realistically achieve?

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#54

Post by diarrhea »

Aeolun wrote: post #39
martin_a wrote: post #33

> It is kind of amazing, that the site was hacked now, after 15 years - so that hacker must have spent quite a lot of time and energy on it. I'm pretty sure that it did not take "that hacker" 15 years to find this vulnerability. Pretty strange forum post.

Website still managed by a just graduated 21 year old?

A prodigy at 6 years old back in the day.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#55

Post by diarrhea »

lillecarl wrote: post #13
PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

I use my own domain and give each website their own e-mail address too, so I know who is breached/selling my information. For password management I use BitWarden, to which I am a paying customer of 15$ a year for their premium features (Premium features being TOTP integrated into the password manager, probably something else too that I don't use). BitWarden is open source, both server and clients. There's even a thir…

> There's even a third party implementation of the server in rust that seems to be mostly compatible.

Not just mostly. Vaultwarden also offers server-side features usually only found in paid Bitwarden plans.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#56

Post by joren485 »

brobinson wrote: post #40
joren485 wrote: post #16

Earlier quoted context omitted.

> I'm not sure if bcrypt/blowfish is still the recommended algorithm or there's newer better ones While bcrypt is already much, much better than using MD5 or SHA256, the best practice is to use Argon2. In practice, it is more important to use a hashing algorithm that is designed for passwords (e.g. bcrypt, argon2, scrypt) than it is to choose the best one. As this breach shows, many sites are still using insecure has…

Which mode do you/would you use? Hybrid? I haven't had to write any password storage code since before Argon2 won the 2015 competition so I haven't gone deep on the "side channel attack vs. memory hardness" tradeoff question when picking the mode. I am curious which mode others are using.

Hybrid (Argon2id) is probably the safest bet if you are unsure.

The specific modes are useful dependent on the threat model you are protecting against. Argon2i protects better against timing/side-channel attacks and Argon2d protects better against brute-forcing attacks.

In my opinion, a developer should (in most cases) focus on application security instead of picking the perfect hashing algorithm, as application security is far more crucial.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#57

Post by fernovus »

brobinson wrote: post #40
joren485 wrote: post #16

Earlier quoted context omitted.

> I'm not sure if bcrypt/blowfish is still the recommended algorithm or there's newer better ones While bcrypt is already much, much better than using MD5 or SHA256, the best practice is to use Argon2. In practice, it is more important to use a hashing algorithm that is designed for passwords (e.g. bcrypt, argon2, scrypt) than it is to choose the best one. As this breach shows, many sites are still using insecure has…

Which mode do you/would you use? Hybrid? I haven't had to write any password storage code since before Argon2 won the 2015 competition so I haven't gone deep on the "side channel attack vs. memory hardness" tradeoff question when picking the mode. I am curious which mode others are using.

Argon2ID

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#58

Post by Aissen »

A tip I learned recently: if you see a database with a simple hash with no salt(md5, sha256…) like this, and you want to migrate to a secure password hashing function (bcrypt, argon2…) you don't need to wait for the users to re-login: simply do bcrypt(md5(password)) immediately, and delete the old hashes, and you get higher security.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#59

Post by gck1 »

lillecarl wrote: post #13
PikachuEXE wrote: post #3

Which is why I use password manager, with one unique & strong password per site. Risk management is important as there is no way to know what website has any known or unknown security holes in it. (Especially those built years ago) When possible use password manager with End to End Encryption (E2EE). Maybe Independent Security Audit too.

I use my own domain and give each website their own e-mail address too, so I know who is breached/selling my information. For password management I use BitWarden, to which I am a paying customer of 15$ a year for their premium features (Premium features being TOTP integrated into the password manager, probably something else too that I don't use). BitWarden is open source, both server and clients. There's even a thir…

> I use my own domain and give each website their own e-mail address too

I wish this was a supported feature on @gmail.com domain (not the +{string} thing). I like the idea, but keep thinking that I'll be uniquely identifiable on every database, since it's almost always going to be just 1 entry for the domain I own.

Re: Opensubtitles.org breached – Email addresses, IP addresses, Passwords, Usernames

#60

Post by verytrivial »

wasmitnetzen wrote: post #27
verytrivial wrote: post #22

Earlier quoted context omitted.

Can anyone talk me out of the Firefox password manager? It has a poor "general" use case for non-website passwords and treats mobile as a second-class satellite, but it seems to just work and the sync between mobile and desktop is very handy. https://hacks.mozilla.org/2018/11/firefox-sync-privacy/ I read and understood just enough of this when it was published to know it would make the foundation an object of ridicul…

KeepassDX (Android) has a really nifty keyboard feature which allows you to even put passwords in apps, which the regular Firefox Sync doesn't support. Maybe that's the use case which makes you do the switch?

Bouncing via the system clipboard does feel a little sketchy, yes. The other is the password generation feature is entirely missing on Android, so I need to use another good source of randomn characters or delay until I'm at my desktop. It's really only these two features that are missing for me, but since I create new password relatively rarely (once or twice a month), I find just having it there to be the winning feature. Also the 'copy these random files' as a back-up mechanism for disaster recover seems a bit ... like something I would design, so not great.
Post reply on HN